873 files changed, 10395 insertions, 5551 deletions
diff --git a/drivers/Makefile b/drivers/Makefile
index f0afdfb3c7df..194d20bee7dc 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -21,7 +21,7 @@ obj-y				+= video/
 obj-y                           += idle/
 # IPMI must come before ACPI in order to provide IPMI opregion support
-obj-$(CONFIG_IPMI_HANDLER)      += char/ipmi/
+obj-y                           += char/ipmi/
 obj-$(CONFIG_ACPI)              += acpi/
 obj-$(CONFIG_SFI)               += sfi/
diff --git a/drivers/acpi/acpi_apd.c b/drivers/acpi/acpi_apd.c
index d58fbf7f04e6..7dd70927991e 100644
--- a/drivers/acpi/acpi_apd.c
+++ b/drivers/acpi/acpi_apd.c
@@ -122,7 +122,7 @@ static int acpi_apd_create_device(struct acpi_device *adev,
        int ret;
        if (!dev_desc) {
-                pdev = acpi_create_platform_device(adev);
+                pdev = acpi_create_platform_device(adev, NULL);
                return IS_ERR_OR_NULL(pdev) ? PTR_ERR(pdev) : 1;
        }
@@ -139,14 +139,8 @@ static int acpi_apd_create_device(struct acpi_device *adev,
                        goto err_out;
        }
-        if (dev_desc->properties) {
-                ret = device_add_properties(&adev->dev, dev_desc->properties);
-                if (ret)
-                        goto err_out;
-        }
        adev->driver_data = pdata;
-        pdev = acpi_create_platform_device(adev);
+        pdev = acpi_create_platform_device(adev, dev_desc->properties);
        if (!IS_ERR_OR_NULL(pdev))
                return 1;
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 552010288135..373657f7e35a 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -395,7 +395,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
        dev_desc = (const struct lpss_device_desc *)id->driver_data;
        if (!dev_desc) {
-                pdev = acpi_create_platform_device(adev);
+                pdev = acpi_create_platform_device(adev, NULL);
                return IS_ERR_OR_NULL(pdev) ? PTR_ERR(pdev) : 1;
        }
        pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
@@ -451,14 +451,8 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
                goto err_out;
        }
-        if (dev_desc->properties) {
-                ret = device_add_properties(&adev->dev, dev_desc->properties);
-                if (ret)
-                        goto err_out;
-        }
        adev->driver_data = pdata;
-        pdev = acpi_create_platform_device(adev);
+        pdev = acpi_create_platform_device(adev, dev_desc->properties);
        if (!IS_ERR_OR_NULL(pdev)) {
                return 1;
        }
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index b200ae1f3c6f..b4c1a6a51da4 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -50,6 +50,7 @@ static void acpi_platform_fill_resource(struct acpi_device *adev,
 /**
 * acpi_create_platform_device - Create platform device for ACPI device node
 * @adev: ACPI device node to create a platform device for.
+ * @properties: Optional collection of build-in properties.
 *
 * Check if the given @adev can be represented as a platform device and, if
 * that's the case, create and register a platform device, populate its common
@@ -57,7 +58,8 @@ static void acpi_platform_fill_resource(struct acpi_device *adev,
 *
 * Name of the platform device will be the same as @adev's.
 */
-struct platform_device *acpi_create_platform_device(struct acpi_device *adev)
+struct platform_device *acpi_create_platform_device(struct acpi_device *adev,
+                                        struct property_entry *properties)
 {
        struct platform_device *pdev = NULL;
        struct platform_device_info pdevinfo;
@@ -106,6 +108,7 @@ struct platform_device *acpi_create_platform_device(struct acpi_device *adev)
        pdevinfo.res = resources;
        pdevinfo.num_res = count;
        pdevinfo.fwnode = acpi_fwnode_handle(adev);
+        pdevinfo.properties = properties;
        if (acpi_dma_supported(adev))
                pdevinfo.dma_mask = DMA_BIT_MASK(32);
diff --git a/drivers/acpi/acpica/dsinit.c b/drivers/acpi/acpica/dsinit.c
index f1e6dcc7a827..54d48b90de2c 100644
--- a/drivers/acpi/acpica/dsinit.c
+++ b/drivers/acpi/acpica/dsinit.c
@@ -46,6 +46,7 @@
 #include "acdispat.h"
 #include "acnamesp.h"
 #include "actables.h"
+#include "acinterp.h"
 #define _COMPONENT          ACPI_DISPATCHER
 ACPI_MODULE_NAME("dsinit")
@@ -214,23 +215,17 @@ acpi_ds_initialize_objects(u32 table_index,
        /* Walk entire namespace from the supplied root */
-        status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
-        if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
-        }
        /*
         * We don't use acpi_walk_namespace since we do not want to acquire
         * the namespace reader lock.
         */
        status =
            acpi_ns_walk_namespace(ACPI_TYPE_ANY, start_node, ACPI_UINT32_MAX,
-                                   ACPI_NS_WALK_UNLOCK, acpi_ds_init_one_object,
+                                   0, acpi_ds_init_one_object, NULL, &info,
-                                   NULL, &info, NULL);
+                                   NULL);
        if (ACPI_FAILURE(status)) {
                ACPI_EXCEPTION((AE_INFO, status, "During WalkNamespace"));
        }
-        (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
        status = acpi_get_table_by_index(table_index, &table);
        if (ACPI_FAILURE(status)) {
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 32e9ddc0cf2b..2b3210f42a46 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -99,14 +99,11 @@ acpi_ds_auto_serialize_method(struct acpi_namespace_node *node,
                          "Method auto-serialization parse [%4.4s] %p\n",
                          acpi_ut_get_node_name(node), node));
-        acpi_ex_enter_interpreter();
        /* Create/Init a root op for the method parse tree */
        op = acpi_ps_alloc_op(AML_METHOD_OP, obj_desc->method.aml_start);
        if (!op) {
-                status = AE_NO_MEMORY;
+                return_ACPI_STATUS(AE_NO_MEMORY);
-                goto unlock;
        }
        acpi_ps_set_name(op, node->name.integer);
@@ -118,8 +115,7 @@ acpi_ds_auto_serialize_method(struct acpi_namespace_node *node,
            acpi_ds_create_walk_state(node->owner_id, NULL, NULL, NULL);
        if (!walk_state) {
                acpi_ps_free_op(op);
-                status = AE_NO_MEMORY;
+                return_ACPI_STATUS(AE_NO_MEMORY);
-                goto unlock;
        }
        status = acpi_ds_init_aml_walk(walk_state, op, node,
@@ -138,8 +134,6 @@ acpi_ds_auto_serialize_method(struct acpi_namespace_node *node,
        status = acpi_ps_parse_aml(walk_state);
        acpi_ps_delete_parse_tree(op);
-unlock:
-        acpi_ex_exit_interpreter();
        return_ACPI_STATUS(status);
 }
@@ -731,26 +725,6 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
                acpi_ds_method_data_delete_all(walk_state);
                /*
-                 * If method is serialized, release the mutex and restore the
-                 * current sync level for this thread
-                 */
-                if (method_desc->method.mutex) {
-                        /* Acquisition Depth handles recursive calls */
-                        method_desc->method.mutex->mutex.acquisition_depth--;
-                        if (!method_desc->method.mutex->mutex.acquisition_depth) {
-                                walk_state->thread->current_sync_level =
-                                    method_desc->method.mutex->mutex.
-                                    original_sync_level;
-                                acpi_os_release_mutex(method_desc->method.
-                                                      mutex->mutex.os_mutex);
-                                method_desc->method.mutex->mutex.thread_id = 0;
-                        }
-                }
-                /*
                 * Delete any namespace objects created anywhere within the
                 * namespace by the execution of this method. Unless:
                 * 1) This method is a module-level executable code method, in which
@@ -786,6 +760,26 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
                                    ~ACPI_METHOD_MODIFIED_NAMESPACE;
                        }
                }
+                /*
+                 * If method is serialized, release the mutex and restore the
+                 * current sync level for this thread
+                 */
+                if (method_desc->method.mutex) {
+                        /* Acquisition Depth handles recursive calls */
+                        method_desc->method.mutex->mutex.acquisition_depth--;
+                        if (!method_desc->method.mutex->mutex.acquisition_depth) {
+                                walk_state->thread->current_sync_level =
+                                    method_desc->method.mutex->mutex.
+                                    original_sync_level;
+                                acpi_os_release_mutex(method_desc->method.
+                                                      mutex->mutex.os_mutex);
+                                method_desc->method.mutex->mutex.thread_id = 0;
+                        }
+                }
        }
        /* Decrement the thread count on the method */
diff --git a/drivers/acpi/acpica/dswload2.c b/drivers/acpi/acpica/dswload2.c
index 028b22a3154e..e36218206bb0 100644
--- a/drivers/acpi/acpica/dswload2.c
+++ b/drivers/acpi/acpica/dswload2.c
@@ -607,11 +607,9 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state)
                                }
                        }
-                        acpi_ex_exit_interpreter();
                        status =
                            acpi_ev_initialize_region
                            (acpi_ns_get_attached_object(node), FALSE);
-                        acpi_ex_enter_interpreter();
                        if (ACPI_FAILURE(status)) {
                                /*
diff --git a/drivers/acpi/acpica/evrgnini.c b/drivers/acpi/acpica/evrgnini.c
index 3843f1fc5dbb..75ddd160a716 100644
--- a/drivers/acpi/acpica/evrgnini.c
+++ b/drivers/acpi/acpica/evrgnini.c
@@ -45,6 +45,7 @@
 #include "accommon.h"
 #include "acevents.h"
 #include "acnamesp.h"
+#include "acinterp.h"
 #define _COMPONENT          ACPI_EVENTS
 ACPI_MODULE_NAME("evrgnini")
@@ -597,9 +598,11 @@ acpi_ev_initialize_region(union acpi_operand_object *region_obj,
                                        }
                                }
+                                acpi_ex_exit_interpreter();
                                status =
                                    acpi_ev_execute_reg_method(region_obj,
                                                               ACPI_REG_CONNECT);
+                                acpi_ex_enter_interpreter();
                                if (acpi_ns_locked) {
                                        status =
diff --git a/drivers/acpi/acpica/nsload.c b/drivers/acpi/acpica/nsload.c
index 334d3c5ba617..d1f20143bb11 100644
--- a/drivers/acpi/acpica/nsload.c
+++ b/drivers/acpi/acpica/nsload.c
@@ -137,7 +137,9 @@ unlock:
        ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                          "**** Begin Table Object Initialization\n"));
+        acpi_ex_enter_interpreter();
        status = acpi_ds_initialize_objects(table_index, node);
+        acpi_ex_exit_interpreter();
        ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                          "**** Completed Table Object Initialization\n"));
diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c
index 046c4d0394ee..5fb838e592dc 100644
--- a/drivers/acpi/acpica/tbfadt.c
+++ b/drivers/acpi/acpica/tbfadt.c
@@ -480,19 +480,17 @@ static void acpi_tb_convert_fadt(void)
        u32 i;
        /*
-         * For ACPI 1.0 FADTs (revision 1), ensure that reserved fields which
+         * For ACPI 1.0 FADTs (revision 1 or 2), ensure that reserved fields which
         * should be zero are indeed zero. This will workaround BIOSs that
         * inadvertently place values in these fields.
         *
         * The ACPI 1.0 reserved fields that will be zeroed are the bytes located
         * at offset 45, 55, 95, and the word located at offset 109, 110.
         *
-         * Note: The FADT revision value is unreliable because of BIOS errors.
+         * Note: The FADT revision value is unreliable. Only the length can be
-         * The table length is instead used as the final word on the version.
+         * trusted.
-         *
-         * Note: FADT revision 3 is the ACPI 2.0 version of the FADT.
         */
-        if (acpi_gbl_FADT.header.length <= ACPI_FADT_V3_SIZE) {
+        if (acpi_gbl_FADT.header.length <= ACPI_FADT_V2_SIZE) {
                acpi_gbl_FADT.preferred_profile = 0;
                acpi_gbl_FADT.pstate_control = 0;
                acpi_gbl_FADT.cst_control = 0;
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index f0a029e68d3e..0d099a24f776 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -662,7 +662,7 @@ static int ghes_proc(struct ghes *ghes)
        ghes_do_proc(ghes, ghes->estatus);
 out:
        ghes_clear_estatus(ghes);
-        return 0;
+        return rc;
 }
 static void ghes_add_timer(struct ghes *ghes)
diff --git a/drivers/acpi/dptf/int340x_thermal.c b/drivers/acpi/dptf/int340x_thermal.c
index 33505c651f62..86364097e236 100644
--- a/drivers/acpi/dptf/int340x_thermal.c
+++ b/drivers/acpi/dptf/int340x_thermal.c
@@ -34,11 +34,11 @@ static int int340x_thermal_handler_attach(struct acpi_device *adev,
                                        const struct acpi_device_id *id)
 {
        if (IS_ENABLED(CONFIG_INT340X_THERMAL))
-                acpi_create_platform_device(adev);
+                acpi_create_platform_device(adev, NULL);
        /* Intel SoC DTS thermal driver needs INT3401 to set IRQ descriptor */
        else if (IS_ENABLED(CONFIG_INTEL_SOC_DTS_THERMAL) &&
                 id->driver_data == INT3401_DEVICE)
-                acpi_create_platform_device(adev);
+                acpi_create_platform_device(adev, NULL);
        return 1;
 }
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 71a7d07c28c9..312c4b4dc363 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -94,7 +94,7 @@ static struct acpi_device *to_acpi_dev(struct acpi_nfit_desc *acpi_desc)
        return to_acpi_device(acpi_desc->dev);
 }
-static int xlat_status(void *buf, unsigned int cmd, u32 status)
+static int xlat_bus_status(void *buf, unsigned int cmd, u32 status)
 {
        struct nd_cmd_clear_error *clear_err;
        struct nd_cmd_ars_status *ars_status;
@@ -113,7 +113,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
                flags = ND_ARS_PERSISTENT | ND_ARS_VOLATILE;
                if ((status >> 16 & flags) == 0)
                        return -ENOTTY;
-                break;
+                return 0;
        case ND_CMD_ARS_START:
                /* ARS is in progress */
                if ((status & 0xffff) == NFIT_ARS_START_BUSY)
@@ -122,7 +122,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
                /* Command failed */
                if (status & 0xffff)
                        return -EIO;
-                break;
+                return 0;
        case ND_CMD_ARS_STATUS:
                ars_status = buf;
                /* Command failed */
@@ -146,7 +146,8 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
                 * then just continue with the returned results.
                 */
                if (status == NFIT_ARS_STATUS_INTR) {
-                        if (ars_status->flags & NFIT_ARS_F_OVERFLOW)
+                        if (ars_status->out_length >= 40 && (ars_status->flags
+                                                & NFIT_ARS_F_OVERFLOW))
                                return -ENOSPC;
                        return 0;
                }
@@ -154,7 +155,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
                /* Unknown status */
                if (status >> 16)
                        return -EIO;
-                break;
+                return 0;
        case ND_CMD_CLEAR_ERROR:
                clear_err = buf;
                if (status & 0xffff)
@@ -163,7 +164,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
                        return -EIO;
                if (clear_err->length > clear_err->cleared)
                        return clear_err->cleared;
-                break;
+                return 0;
        default:
                break;
        }
@@ -174,9 +175,18 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
        return 0;
 }
-static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
+static int xlat_status(struct nvdimm *nvdimm, void *buf, unsigned int cmd,
-                struct nvdimm *nvdimm, unsigned int cmd, void *buf,
+                u32 status)
-                unsigned int buf_len, int *cmd_rc)
+{
+        if (!nvdimm)
+                return xlat_bus_status(buf, cmd, status);
+        if (status)
+                return -EIO;
+        return 0;
+}
+int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+                unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc)
 {
        struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
        union acpi_object in_obj, in_buf, *out_obj;
@@ -298,7 +308,8 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
        for (i = 0, offset = 0; i < desc->out_num; i++) {
                u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i, buf,
-                                (u32 *) out_obj->buffer.pointer);
+                                (u32 *) out_obj->buffer.pointer,
+                                out_obj->buffer.length - offset);
                if (offset + out_size > out_obj->buffer.length) {
                        dev_dbg(dev, "%s:%s output object underflow cmd: %s field: %d\n",
@@ -333,7 +344,8 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
                         */
                        rc = buf_len - offset - in_buf.buffer.length;
                        if (cmd_rc)
-                                *cmd_rc = xlat_status(buf, cmd, fw_status);
+                                *cmd_rc = xlat_status(nvdimm, buf, cmd,
+                                                fw_status);
                } else {
                        dev_err(dev, "%s:%s underrun cmd: %s buf_len: %d out_len: %d\n",
                                        __func__, dimm_name, cmd_name, buf_len,
@@ -343,7 +355,7 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
        } else {
                rc = 0;
                if (cmd_rc)
-                        *cmd_rc = xlat_status(buf, cmd, fw_status);
+                        *cmd_rc = xlat_status(nvdimm, buf, cmd, fw_status);
        }
 out:
@@ -351,6 +363,7 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
        return rc;
 }
+EXPORT_SYMBOL_GPL(acpi_nfit_ctl);
 static const char *spa_type_name(u16 type)
 {
@@ -2001,19 +2014,32 @@ static int ars_get_status(struct acpi_nfit_desc *acpi_desc)
        return cmd_rc;
 }
-static int ars_status_process_records(struct nvdimm_bus *nvdimm_bus,
+static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc,
                struct nd_cmd_ars_status *ars_status)
 {
+        struct nvdimm_bus *nvdimm_bus = acpi_desc->nvdimm_bus;
        int rc;
        u32 i;
+        /*
+         * First record starts at 44 byte offset from the start of the
+         * payload.
+         */
+        if (ars_status->out_length < 44)
+                return 0;
        for (i = 0; i < ars_status->num_records; i++) {
+                /* only process full records */
+                if (ars_status->out_length
+                                < 44 + sizeof(struct nd_ars_record) * (i + 1))
+                        break;
                rc = nvdimm_bus_add_poison(nvdimm_bus,
                                ars_status->records[i].err_address,
                                ars_status->records[i].length);
                if (rc)
                        return rc;
        }
+        if (i < ars_status->num_records)
+                dev_warn(acpi_desc->dev, "detected truncated ars results\n");
        return 0;
 }
@@ -2266,8 +2292,7 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc,
        if (rc < 0 && rc != -ENOSPC)
                return rc;
-        if (ars_status_process_records(acpi_desc->nvdimm_bus,
+        if (ars_status_process_records(acpi_desc, acpi_desc->ars_status))
-                                acpi_desc->ars_status))
                return -ENOMEM;
        return 0;
diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
index 14296f5267c8..fc29c2e9832e 100644
--- a/drivers/acpi/nfit/nfit.h
+++ b/drivers/acpi/nfit/nfit.h
@@ -240,5 +240,7 @@ const u8 *to_nfit_uuid(enum nfit_uuids id);
 int acpi_nfit_init(struct acpi_nfit_desc *acpi_desc, void *nfit, acpi_size sz);
 void __acpi_nfit_notify(struct device *dev, acpi_handle handle, u32 event);
 void __acpi_nvdimm_notify(struct device *dev, u32 event);
+int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+                unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc);
 void acpi_nfit_desc_init(struct acpi_nfit_desc *acpi_desc, struct device *dev);
 #endif /* __NFIT_H__ */
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index c983bf733ad3..bc3d914dfc3e 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -87,6 +87,7 @@ struct acpi_pci_link {
 static LIST_HEAD(acpi_link_list);
 static DEFINE_MUTEX(acpi_link_lock);
+static int sci_irq = -1, sci_penalty;
 /* --------------------------------------------------------------------------
                            PCI Link Device Management
@@ -496,25 +497,13 @@ static int acpi_irq_get_penalty(int irq)
 {
        int penalty = 0;
-        /*
+        if (irq == sci_irq)
-        * Penalize IRQ used by ACPI SCI. If ACPI SCI pin attributes conflict
+                penalty += sci_penalty;
-        * with PCI IRQ attributes, mark ACPI SCI as ISA_ALWAYS so it won't be
-        * use for PCI IRQs.
-        */
-        if (irq == acpi_gbl_FADT.sci_interrupt) {
-                u32 type = irq_get_trigger_type(irq) & IRQ_TYPE_SENSE_MASK;
-                if (type != IRQ_TYPE_LEVEL_LOW)
-                        penalty += PIRQ_PENALTY_ISA_ALWAYS;
-                else
-                        penalty += PIRQ_PENALTY_PCI_USING;
-        }
        if (irq < ACPI_MAX_ISA_IRQS)
                return penalty + acpi_isa_irq_penalty[irq];
-        penalty += acpi_irq_pci_sharing_penalty(irq);
+        return penalty + acpi_irq_pci_sharing_penalty(irq);
-        return penalty;
 }
 int __init acpi_irq_penalty_init(void)
@@ -619,6 +608,10 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
                            acpi_device_bid(link->device));
                return -ENODEV;
        } else {
+                if (link->irq.active < ACPI_MAX_ISA_IRQS)
+                        acpi_isa_irq_penalty[link->irq.active] +=
+                                PIRQ_PENALTY_PCI_USING;
                printk(KERN_WARNING PREFIX "%s [%s] enabled at IRQ %d\n",
                       acpi_device_name(link->device),
                       acpi_device_bid(link->device), link->irq.active);
@@ -849,7 +842,7 @@ static int __init acpi_irq_penalty_update(char *str, int used)
                        continue;
                if (used)
-                        new_penalty = acpi_irq_get_penalty(irq) +
+                        new_penalty = acpi_isa_irq_penalty[irq] +
                                        PIRQ_PENALTY_ISA_USED;
                else
                        new_penalty = 0;
@@ -871,7 +864,7 @@ static int __init acpi_irq_penalty_update(char *str, int used)
 void acpi_penalize_isa_irq(int irq, int active)
 {
        if ((irq >= 0) && (irq < ARRAY_SIZE(acpi_isa_irq_penalty)))
-                acpi_isa_irq_penalty[irq] = acpi_irq_get_penalty(irq) +
+                acpi_isa_irq_penalty[irq] +=
                  (active ? PIRQ_PENALTY_ISA_USED : PIRQ_PENALTY_PCI_USING);
 }
@@ -881,6 +874,17 @@ bool acpi_isa_irq_available(int irq)
                    acpi_irq_get_penalty(irq) < PIRQ_PENALTY_ISA_ALWAYS);
 }
+void acpi_penalize_sci_irq(int irq, int trigger, int polarity)
+{
+        sci_irq = irq;
+        if (trigger == ACPI_MADT_TRIGGER_LEVEL &&
+            polarity == ACPI_MADT_POLARITY_ACTIVE_LOW)
+                sci_penalty = PIRQ_PENALTY_PCI_USING;
+        else
+                sci_penalty = PIRQ_PENALTY_ISA_ALWAYS;
+}
 /*
 * Over-ride default table to reserve additional IRQs for use by ISA
 * e.g. acpi_irq_isa=5
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 035ac646d8db..3d1856f1f4d0 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1734,7 +1734,7 @@ static void acpi_default_enumeration(struct acpi_device *device)
                               &is_spi_i2c_slave);
        acpi_dev_free_resource_list(&resource_list);
        if (!is_spi_i2c_slave) {
-                acpi_create_platform_device(device);
+                acpi_create_platform_device(device, NULL);
                acpi_device_set_enumerated(device);
        } else {
                blocking_notifier_call_chain(&acpi_reconfig_chain,
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index deb0ff78eba8..54abb26b7366 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -47,32 +47,15 @@ static void acpi_sleep_tts_switch(u32 acpi_state)
        }
 }
-static void acpi_sleep_pts_switch(u32 acpi_state)
+static int tts_notify_reboot(struct notifier_block *this,
-{
-        acpi_status status;
-        status = acpi_execute_simple_method(NULL, "\\_PTS", acpi_state);
-        if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
-                /*
-                 * OS can't evaluate the _PTS object correctly. Some warning
-                 * message will be printed. But it won't break anything.
-                 */
-                printk(KERN_NOTICE "Failure in evaluating _PTS object\n");
-        }
-}
-static int sleep_notify_reboot(struct notifier_block *this,
                        unsigned long code, void *x)
 {
        acpi_sleep_tts_switch(ACPI_STATE_S5);
-        acpi_sleep_pts_switch(ACPI_STATE_S5);
        return NOTIFY_DONE;
 }
-static struct notifier_block sleep_notifier = {
+static struct notifier_block tts_notifier = {
-        .notifier_call  = sleep_notify_reboot,
+        .notifier_call  = tts_notify_reboot,
        .next           = NULL,
        .priority       = 0,
 };
@@ -916,9 +899,9 @@ int __init acpi_sleep_init(void)
        pr_info(PREFIX "(supports%s)\n", supported);
        /*
-         * Register the sleep_notifier to reboot notifier list so that the _TTS
+         * Register the tts_notifier to reboot notifier list so that the _TTS
-         * and _PTS object can also be evaluated when the system enters S5.
+         * object can also be evaluated when the system enters S5.
         */
-        register_reboot_notifier(&sleep_notifier);
+        register_reboot_notifier(&tts_notifier);
        return 0;
 }
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 562af94bec35..3c71b982bf2a 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1002,7 +1002,7 @@ static int binder_dec_node(struct binder_node *node, int strong, int internal)
 static struct binder_ref *binder_get_ref(struct binder_proc *proc,
-                                         uint32_t desc)
+                                         u32 desc, bool need_strong_ref)
 {
        struct rb_node *n = proc->refs_by_desc.rb_node;
        struct binder_ref *ref;
@@ -1010,12 +1010,16 @@ static struct binder_ref *binder_get_ref(struct binder_proc *proc,
        while (n) {
                ref = rb_entry(n, struct binder_ref, rb_node_desc);
-                if (desc < ref->desc)
+                if (desc < ref->desc) {
                        n = n->rb_left;
-                else if (desc > ref->desc)
+                } else if (desc > ref->desc) {
                        n = n->rb_right;
-                else
+                } else if (need_strong_ref && !ref->strong) {
+                        binder_user_error("tried to use weak ref as strong ref\n");
+                        return NULL;
+                } else {
                        return ref;
+                }
        }
        return NULL;
 }
@@ -1285,7 +1289,10 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                } break;
                case BINDER_TYPE_HANDLE:
                case BINDER_TYPE_WEAK_HANDLE: {
-                        struct binder_ref *ref = binder_get_ref(proc, fp->handle);
+                        struct binder_ref *ref;
+                        ref = binder_get_ref(proc, fp->handle,
+                                             fp->type == BINDER_TYPE_HANDLE);
                        if (ref == NULL) {
                                pr_err("transaction release %d bad handle %d\n",
@@ -1380,7 +1387,7 @@ static void binder_transaction(struct binder_proc *proc,
                if (tr->target.handle) {
                        struct binder_ref *ref;
-                        ref = binder_get_ref(proc, tr->target.handle);
+                        ref = binder_get_ref(proc, tr->target.handle, true);
                        if (ref == NULL) {
                                binder_user_error("%d:%d got transaction to invalid handle\n",
                                        proc->pid, thread->pid);
@@ -1577,7 +1584,9 @@ static void binder_transaction(struct binder_proc *proc,
                                fp->type = BINDER_TYPE_HANDLE;
                        else
                                fp->type = BINDER_TYPE_WEAK_HANDLE;
+                        fp->binder = 0;
                        fp->handle = ref->desc;
+                        fp->cookie = 0;
                        binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
                                       &thread->todo);
@@ -1589,7 +1598,10 @@ static void binder_transaction(struct binder_proc *proc,
                } break;
                case BINDER_TYPE_HANDLE:
                case BINDER_TYPE_WEAK_HANDLE: {
-                        struct binder_ref *ref = binder_get_ref(proc, fp->handle);
+                        struct binder_ref *ref;
+                        ref = binder_get_ref(proc, fp->handle,
+                                             fp->type == BINDER_TYPE_HANDLE);
                        if (ref == NULL) {
                                binder_user_error("%d:%d got transaction with invalid handle, %d\n",
@@ -1624,7 +1636,9 @@ static void binder_transaction(struct binder_proc *proc,
                                        return_error = BR_FAILED_REPLY;
                                        goto err_binder_get_ref_for_node_failed;
                                }
+                                fp->binder = 0;
                                fp->handle = new_ref->desc;
+                                fp->cookie = 0;
                                binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
                                trace_binder_transaction_ref_to_ref(t, ref,
                                                                    new_ref);
@@ -1678,6 +1692,7 @@ static void binder_transaction(struct binder_proc *proc,
                        binder_debug(BINDER_DEBUG_TRANSACTION,
                                     "        fd %d -> %d\n", fp->handle, target_fd);
                        /* TODO: fput? */
+                        fp->binder = 0;
                        fp->handle = target_fd;
                } break;
@@ -1800,7 +1815,9 @@ static int binder_thread_write(struct binder_proc *proc,
                                                ref->desc);
                                }
                        } else
-                                ref = binder_get_ref(proc, target);
+                                ref = binder_get_ref(proc, target,
+                                                     cmd == BC_ACQUIRE ||
+                                                     cmd == BC_RELEASE);
                        if (ref == NULL) {
                                binder_user_error("%d:%d refcount change on invalid ref %d\n",
                                        proc->pid, thread->pid, target);
@@ -1996,7 +2013,7 @@ static int binder_thread_write(struct binder_proc *proc,
                        if (get_user(cookie, (binder_uintptr_t __user *)ptr))
                                return -EFAULT;
                        ptr += sizeof(binder_uintptr_t);
-                        ref = binder_get_ref(proc, target);
+                        ref = binder_get_ref(proc, target, false);
                        if (ref == NULL) {
                                binder_user_error("%d:%d %s invalid ref %d\n",
                                        proc->pid, thread->pid,
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index ba5f11cebee2..74f4c662f776 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1418,31 +1418,27 @@ static int ahci_init_msi(struct pci_dev *pdev, unsigned int n_ports,
         * Message mode could be enforced. In this case assume that advantage
         * of multipe MSIs is negated and use single MSI mode instead.
         */
-        nvec = pci_alloc_irq_vectors(pdev, n_ports, INT_MAX,
+        if (n_ports > 1) {
-                        PCI_IRQ_MSIX | PCI_IRQ_MSI);
+                nvec = pci_alloc_irq_vectors(pdev, n_ports, INT_MAX,
-        if (nvec > 0) {
+                                PCI_IRQ_MSIX | PCI_IRQ_MSI);
-                if (!(readl(hpriv->mmio + HOST_CTL) & HOST_MRSM)) {
+                if (nvec > 0) {
-                        hpriv->get_irq_vector = ahci_get_irq_vector;
+                        if (!(readl(hpriv->mmio + HOST_CTL) & HOST_MRSM)) {
-                        hpriv->flags |= AHCI_HFLAG_MULTI_MSI;
+                                hpriv->get_irq_vector = ahci_get_irq_vector;
-                        return nvec;
+                                hpriv->flags |= AHCI_HFLAG_MULTI_MSI;
-                }
+                                return nvec;
+                        }
-                /*
+                        /*
-                 * Fallback to single MSI mode if the controller enforced MRSM
+                         * Fallback to single MSI mode if the controller
-                 * mode.
+                         * enforced MRSM mode.
-                 */
+                         */
-                printk(KERN_INFO "ahci: MRSM is on, fallback to single MSI\n");
+                        printk(KERN_INFO
-                pci_free_irq_vectors(pdev);
+                                "ahci: MRSM is on, fallback to single MSI\n");
+                        pci_free_irq_vectors(pdev);
+                }
        }
        /*
-         * -ENOSPC indicated we don't have enough vectors.  Don't bother trying
-         * a single vectors for any other error:
-         */
-        if (nvec < 0 && nvec != -ENOSPC)
-                return nvec;
-        /*
         * If the host is not capable of supporting per-port vectors, fall
         * back to single MSI before finally attempting single MSI-X.
         */
@@ -1617,7 +1613,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                /* legacy intx interrupts */
                pci_intx(pdev, 1);
        }
-        hpriv->irq = pdev->irq;
+        hpriv->irq = pci_irq_vector(pdev, 0);
        if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                host->flags |= ATA_HOST_PARALLEL_SCAN;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 9cceb4a875a5..8e575fbdf31d 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1088,7 +1088,7 @@ static void ata_gen_passthru_sense(struct ata_queued_cmd *qc)
                desc[1] = tf->command; /* status */
                desc[2] = tf->device;
                desc[3] = tf->nsect;
-                desc[0] = 0;
+                desc[7] = 0;
                if (tf->flags & ATA_TFLAG_LBA48)  {
                        desc[8] |= 0x80;
                        if (tf->hob_nsect)
@@ -1159,6 +1159,7 @@ static void ata_scsi_sdev_config(struct scsi_device *sdev)
 {
        sdev->use_10_for_rw = 1;
        sdev->use_10_for_ms = 1;
+        sdev->no_write_same = 1;
        /* Schedule policy is determined by ->qc_defer() callback and
         * it needs to see every deferred qc.  Set dev_blocked to 1 to
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index efc48bf89d51..823e938c9a78 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4090,7 +4090,20 @@ static int mv_platform_probe(struct platform_device *pdev)
        /* allocate host */
        if (pdev->dev.of_node) {
-                of_property_read_u32(pdev->dev.of_node, "nr-ports", &n_ports);
+                rc = of_property_read_u32(pdev->dev.of_node, "nr-ports",
+                                           &n_ports);
+                if (rc) {
+                        dev_err(&pdev->dev,
+                                "error parsing nr-ports property: %d\n", rc);
+                        return rc;
+                }
+                if (n_ports <= 0) {
+                        dev_err(&pdev->dev, "nr-ports must be positive: %d\n",
+                                n_ports);
+                        return -EINVAL;
+                }
                irq = irq_of_parse_and_map(pdev->dev.of_node, 0);
        } else {
                mv_platform_data = dev_get_platdata(&pdev->dev);
diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
index f2aaf9e32a36..40c2d561417b 100644
--- a/drivers/atm/eni.c
+++ b/drivers/atm/eni.c
@@ -1727,7 +1727,7 @@ static int eni_do_init(struct atm_dev *dev)
                printk("\n");
                printk(KERN_ERR DEV_LABEL "(itf %d): can't set up page "
                    "mapping\n",dev->number);
-                return error;
+                return -ENOMEM;
        }
        eni_dev->ioaddr = base;
        eni_dev->base_diff = real_base - (unsigned long) base;
diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
index ce43ae3e87b3..445505d9ea07 100644
--- a/drivers/atm/lanai.c
+++ b/drivers/atm/lanai.c
@@ -2143,6 +2143,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)
        lanai->base = (bus_addr_t) ioremap(raw_base, LANAI_MAPPING_SIZE);
        if (lanai->base == NULL) {
                printk(KERN_ERR DEV_LABEL ": couldn't remap I/O space\n");
+                result = -ENOMEM;
                goto error_pci;
        }
        /* 3.3: Reset lanai and PHY */
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index fdf44cac08e6..d02e7c0f5bfd 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -213,14 +213,16 @@ config DEBUG_DEVRES
          If you are unsure about this, Say N here.
 config DEBUG_TEST_DRIVER_REMOVE
-        bool "Test driver remove calls during probe"
+        bool "Test driver remove calls during probe (UNSTABLE)"
        depends on DEBUG_KERNEL
        help
          Say Y here if you want the Driver core to test driver remove functions
          by calling probe, remove, probe. This tests the remove path without
          having to unbind the driver or unload the driver module.
-          If you are unsure about this, say N here.
+          This option is expected to find errors and may render your system
+          unusable. You should say N here unless you are explicitly looking to
+          test this functionality.
 config SYS_HYPERVISOR
        bool
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index d22a7260f42b..d76cd97a98b6 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -324,7 +324,8 @@ static int really_probe(struct device *dev, struct device_driver *drv)
 {
        int ret = -EPROBE_DEFER;
        int local_trigger_count = atomic_read(&deferred_trigger_count);
-        bool test_remove = IS_ENABLED(CONFIG_DEBUG_TEST_DRIVER_REMOVE);
+        bool test_remove = IS_ENABLED(CONFIG_DEBUG_TEST_DRIVER_REMOVE) &&
+                           !drv->suppress_bind_attrs;
        if (defer_all_probes) {
                /*
@@ -383,7 +384,7 @@ re_probe:
        if (test_remove) {
                test_remove = false;
-                if (dev->bus && dev->bus->remove)
+                if (dev->bus->remove)
                        dev->bus->remove(dev);
                else if (drv->remove)
                        drv->remove(dev);
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index e44944f4be77..2932a5bd892f 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1027,6 +1027,8 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
        TRACE_DEVICE(dev);
        TRACE_SUSPEND(0);
+        dpm_wait_for_children(dev, async);
        if (async_error)
                goto Complete;
@@ -1038,8 +1040,6 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
        if (dev->power.syscore || dev->power.direct_complete)
                goto Complete;
-        dpm_wait_for_children(dev, async);
        if (dev->pm_domain) {
                info = "noirq power domain ";
                callback = pm_noirq_op(&dev->pm_domain->ops, state);
@@ -1174,6 +1174,8 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as
        __pm_runtime_disable(dev, false);
+        dpm_wait_for_children(dev, async);
        if (async_error)
                goto Complete;
@@ -1185,8 +1187,6 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as
        if (dev->power.syscore || dev->power.direct_complete)
                goto Complete;
-        dpm_wait_for_children(dev, async);
        if (dev->pm_domain) {
                info = "late power domain ";
                callback = pm_late_early_op(&dev->pm_domain->ops, state);
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 811e11c82f32..0809cda93cc0 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -2954,7 +2954,7 @@ DAC960_DetectController(struct pci_dev *PCI_Device,
        case DAC960_PD_Controller:
          if (!request_region(Controller->IO_Address, 0x80,
                              Controller->FullModelName)) {
-                DAC960_Error("IO port 0x%d busy for Controller at\n",
+                DAC960_Error("IO port 0x%lx busy for Controller at\n",
                             Controller, Controller->IO_Address);
                goto Failure;
          }
@@ -2990,7 +2990,7 @@ DAC960_DetectController(struct pci_dev *PCI_Device,
        case DAC960_P_Controller:
          if (!request_region(Controller->IO_Address, 0x80,
                              Controller->FullModelName)){
-                DAC960_Error("IO port 0x%d busy for Controller at\n",
+                DAC960_Error("IO port 0x%lx busy for Controller at\n",
                             Controller, Controller->IO_Address);
                goto Failure;
          }
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index ab19adb07a12..3c606c09fd5a 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -853,45 +853,6 @@ rqbiocnt(struct request *r)
        return n;
 }
-/* This can be removed if we are certain that no users of the block
- * layer will ever use zero-count pages in bios.  Otherwise we have to
- * protect against the put_page sometimes done by the network layer.
- *
- * See http://oss.sgi.com/archives/xfs/2007-01/msg00594.html for
- * discussion.
- *
- * We cannot use get_page in the workaround, because it insists on a
- * positive page count as a precondition.  So we use _refcount directly.
- */
-static void
-bio_pageinc(struct bio *bio)
-{
-        struct bio_vec bv;
-        struct page *page;
-        struct bvec_iter iter;
-        bio_for_each_segment(bv, bio, iter) {
-                /* Non-zero page count for non-head members of
-                 * compound pages is no longer allowed by the kernel.
-                 */
-                page = compound_head(bv.bv_page);
-                page_ref_inc(page);
-        }
-}
-static void
-bio_pagedec(struct bio *bio)
-{
-        struct page *page;
-        struct bio_vec bv;
-        struct bvec_iter iter;
-        bio_for_each_segment(bv, bio, iter) {
-                page = compound_head(bv.bv_page);
-                page_ref_dec(page);
-        }
-}
 static void
 bufinit(struct buf *buf, struct request *rq, struct bio *bio)
 {
@@ -899,7 +860,6 @@ bufinit(struct buf *buf, struct request *rq, struct bio *bio)
        buf->rq = rq;
        buf->bio = bio;
        buf->iter = bio->bi_iter;
-        bio_pageinc(bio);
 }
 static struct buf *
@@ -1127,7 +1087,6 @@ aoe_end_buf(struct aoedev *d, struct buf *buf)
        if (buf == d->ip.buf)
                d->ip.buf = NULL;
        rq = buf->rq;
-        bio_pagedec(buf->bio);
        mempool_free(buf, d->bufpool);
        n = (unsigned long) rq->special;
        rq->special = (void *) --n;
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 100be556e613..83482721bc01 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1871,7 +1871,7 @@ int drbd_send(struct drbd_connection *connection, struct socket *sock,
                drbd_update_congested(connection);
        }
        do {
-                rv = kernel_sendmsg(sock, &msg, &iov, 1, size);
+                rv = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
                if (rv == -EAGAIN) {
                        if (we_should_drop_the_connection(connection, sock))
                                break;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index ba405b55329f..7a1048755914 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -164,7 +164,7 @@ static void sock_shutdown(struct nbd_device *nbd)
        spin_lock(&nbd->sock_lock);
        if (!nbd->sock) {
-                spin_unlock_irq(&nbd->sock_lock);
+                spin_unlock(&nbd->sock_lock);
                return;
        }
@@ -599,7 +599,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                        return -EINVAL;
                sreq = blk_mq_alloc_request(bdev_get_queue(bdev), WRITE, 0);
-                if (!sreq)
+                if (IS_ERR(sreq))
                        return -ENOMEM;
                mutex_unlock(&nbd->tx_lock);
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index abb71628ab61..7b274ff4632c 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -415,15 +415,15 @@ struct rbd_device {
 };
 /*
- * Flag bits for rbd_dev->flags.  If atomicity is required,
+ * Flag bits for rbd_dev->flags:
- * rbd_dev->lock is used to protect access.
+ * - REMOVING (which is coupled with rbd_dev->open_count) is protected
- *
+ *   by rbd_dev->lock
- * Currently, only the "removing" flag (which is coupled with the
+ * - BLACKLISTED is protected by rbd_dev->lock_rwsem
- * "open_count" field) requires atomic access.
 */
 enum rbd_dev_flags {
        RBD_DEV_FLAG_EXISTS,    /* mapped snapshot has not been deleted */
        RBD_DEV_FLAG_REMOVING,  /* this mapping is being removed */
+        RBD_DEV_FLAG_BLACKLISTED, /* our ceph_client is blacklisted */
 };
 static DEFINE_MUTEX(client_mutex);      /* Serialize client creation */
@@ -3926,6 +3926,7 @@ static void rbd_reregister_watch(struct work_struct *work)
        struct rbd_device *rbd_dev = container_of(to_delayed_work(work),
                                            struct rbd_device, watch_dwork);
        bool was_lock_owner = false;
+        bool need_to_wake = false;
        int ret;
        dout("%s rbd_dev %p\n", __func__, rbd_dev);
@@ -3935,19 +3936,27 @@ static void rbd_reregister_watch(struct work_struct *work)
                was_lock_owner = rbd_release_lock(rbd_dev);
        mutex_lock(&rbd_dev->watch_mutex);
-        if (rbd_dev->watch_state != RBD_WATCH_STATE_ERROR)
+        if (rbd_dev->watch_state != RBD_WATCH_STATE_ERROR) {
-                goto fail_unlock;
+                mutex_unlock(&rbd_dev->watch_mutex);
+                goto out;
+        }
        ret = __rbd_register_watch(rbd_dev);
        if (ret) {
                rbd_warn(rbd_dev, "failed to reregister watch: %d", ret);
-                if (ret != -EBLACKLISTED)
+                if (ret == -EBLACKLISTED || ret == -ENOENT) {
+                        set_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags);
+                        need_to_wake = true;
+                } else {
                        queue_delayed_work(rbd_dev->task_wq,
                                           &rbd_dev->watch_dwork,
                                           RBD_RETRY_DELAY);
-                goto fail_unlock;
+                }
+                mutex_unlock(&rbd_dev->watch_mutex);
+                goto out;
        }
+        need_to_wake = true;
        rbd_dev->watch_state = RBD_WATCH_STATE_REGISTERED;
        rbd_dev->watch_cookie = rbd_dev->watch_handle->linger_id;
        mutex_unlock(&rbd_dev->watch_mutex);
@@ -3963,13 +3972,10 @@ static void rbd_reregister_watch(struct work_struct *work)
                                 ret);
        }
+out:
        up_write(&rbd_dev->lock_rwsem);
-        wake_requests(rbd_dev, true);
+        if (need_to_wake)
-        return;
+                wake_requests(rbd_dev, true);
-fail_unlock:
-        mutex_unlock(&rbd_dev->watch_mutex);
-        up_write(&rbd_dev->lock_rwsem);
 }
 /*
@@ -4074,7 +4080,9 @@ static void rbd_wait_state_locked(struct rbd_device *rbd_dev)
                up_read(&rbd_dev->lock_rwsem);
                schedule();
                down_read(&rbd_dev->lock_rwsem);
-        } while (rbd_dev->lock_state != RBD_LOCK_STATE_LOCKED);
+        } while (rbd_dev->lock_state != RBD_LOCK_STATE_LOCKED &&
+                 !test_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags));
        finish_wait(&rbd_dev->lock_waitq, &wait);
 }
@@ -4166,8 +4174,16 @@ static void rbd_queue_workfn(struct work_struct *work)
        if (must_be_locked) {
                down_read(&rbd_dev->lock_rwsem);
-                if (rbd_dev->lock_state != RBD_LOCK_STATE_LOCKED)
+                if (rbd_dev->lock_state != RBD_LOCK_STATE_LOCKED &&
+                    !test_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags))
                        rbd_wait_state_locked(rbd_dev);
+                WARN_ON((rbd_dev->lock_state == RBD_LOCK_STATE_LOCKED) ^
+                        !test_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags));
+                if (test_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags)) {
+                        result = -EBLACKLISTED;
+                        goto err_unlock;
+                }
        }
        img_request = rbd_img_request_create(rbd_dev, offset, length, op_type,
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 2dc5c96c186a..5545a679abd8 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -376,7 +376,7 @@ static void virtblk_config_changed(struct virtio_device *vdev)
 static int init_vq(struct virtio_blk *vblk)
 {
-        int err = 0;
+        int err;
        int i;
        vq_callback_t **callbacks;
        const char **names;
@@ -390,13 +390,13 @@ static int init_vq(struct virtio_blk *vblk)
        if (err)
                num_vqs = 1;
-        vblk->vqs = kmalloc(sizeof(*vblk->vqs) * num_vqs, GFP_KERNEL);
+        vblk->vqs = kmalloc_array(num_vqs, sizeof(*vblk->vqs), GFP_KERNEL);
        if (!vblk->vqs)
                return -ENOMEM;
-        names = kmalloc(sizeof(*names) * num_vqs, GFP_KERNEL);
+        names = kmalloc_array(num_vqs, sizeof(*names), GFP_KERNEL);
-        callbacks = kmalloc(sizeof(*callbacks) * num_vqs, GFP_KERNEL);
+        callbacks = kmalloc_array(num_vqs, sizeof(*callbacks), GFP_KERNEL);
-        vqs = kmalloc(sizeof(*vqs) * num_vqs, GFP_KERNEL);
+        vqs = kmalloc_array(num_vqs, sizeof(*vqs), GFP_KERNEL);
        if (!names || !callbacks || !vqs) {
                err = -ENOMEM;
                goto out;
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 04365b17ee67..5497f7fc44d0 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1403,7 +1403,8 @@ static ssize_t hot_remove_store(struct class *class,
        zram = idr_find(&zram_index_idr, dev_id);
        if (zram) {
                ret = zram_remove(zram);
-                idr_remove(&zram_index_idr, dev_id);
+                if (!ret)
+                        idr_remove(&zram_index_idr, dev_id);
        } else {
                ret = -ENODEV;
        }
@@ -1412,8 +1413,14 @@ static ssize_t hot_remove_store(struct class *class,
        return ret ? ret : count;
 }
+/*
+ * NOTE: hot_add attribute is not the usual read-only sysfs attribute. In a
+ * sense that reading from this file does alter the state of your system -- it
+ * creates a new un-initialized zram device and returns back this device's
+ * device_id (or an error code if it fails to create a new device).
+ */
 static struct class_attribute zram_control_class_attrs[] = {
-        __ATTR_RO(hot_add),
+        __ATTR(hot_add, 0400, hot_add_show, NULL),
        __ATTR_WO(hot_remove),
        __ATTR_NULL,
 };
diff --git a/drivers/bluetooth/btwilink.c b/drivers/bluetooth/btwilink.c
index ef51c9c864c5..b6bb58c41df5 100644
--- a/drivers/bluetooth/btwilink.c
+++ b/drivers/bluetooth/btwilink.c
@@ -310,7 +310,7 @@ static int bt_ti_probe(struct platform_device *pdev)
        BT_DBG("HCI device registered (hdev %p)", hdev);
        dev_set_drvdata(&pdev->dev, hst);
-        return err;
+        return 0;
 }
 static int bt_ti_remove(struct platform_device *pdev)
diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
index 5ccb90ef0146..8f6c23c20c52 100644
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -643,6 +643,14 @@ static const struct dmi_system_id bcm_wrong_irq_dmi_table[] = {
                },
                .driver_data = &acpi_active_low,
        },
+        {       /* Handle ThinkPad 8 tablets with BCM2E55 chipset ACPI ID */
+                .ident = "Lenovo ThinkPad 8",
+                .matches = {
+                        DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "ThinkPad 8"),
+                },
+                .driver_data = &acpi_active_low,
+        },
        { }
 };
diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
index 7010dcac9328..78751057164a 100644
--- a/drivers/bus/Kconfig
+++ b/drivers/bus/Kconfig
@@ -111,6 +111,7 @@ config OMAP_OCP2SCP
 config QCOM_EBI2
        bool "Qualcomm External Bus Interface 2 (EBI2)"
        depends on HAS_IOMEM
+        depends on ARCH_QCOM || COMPILE_TEST
        help
          Say y here to enable support for the Qualcomm External Bus
          Interface 2, which can be used to connect things like NAND Flash,
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 482794526e8c..d2d2c89de5b4 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -84,14 +84,14 @@ static size_t rng_buffer_size(void)
 static void add_early_randomness(struct hwrng *rng)
 {
-        unsigned char bytes[16];
        int bytes_read;
+        size_t size = min_t(size_t, 16, rng_buffer_size());
        mutex_lock(&reading_mutex);
-        bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
+        bytes_read = rng_get_data(rng, rng_buffer, size, 1);
        mutex_unlock(&reading_mutex);
        if (bytes_read > 0)
-                add_device_randomness(bytes, bytes_read);
+                add_device_randomness(rng_buffer, bytes_read);
 }
 static inline void cleanup_rng(struct kref *kref)
diff --git a/drivers/char/ipmi/Kconfig b/drivers/char/ipmi/Kconfig
index 5a9350b1069a..7f816655cbbf 100644
--- a/drivers/char/ipmi/Kconfig
+++ b/drivers/char/ipmi/Kconfig
@@ -76,3 +76,11 @@ config IPMI_POWEROFF
         the IPMI management controller is capable of this.
 endif # IPMI_HANDLER
+config ASPEED_BT_IPMI_BMC
+        depends on ARCH_ASPEED
+        tristate "BT IPMI bmc driver"
+        help
+          Provides a driver for the BT (Block Transfer) IPMI interface
+          found on Aspeed SOCs (AST2400 and AST2500). The driver
+          implements the BMC side of the BT interface.
diff --git a/drivers/char/ipmi/Makefile b/drivers/char/ipmi/Makefile
index f3ffde1f5f1f..0d98cd91def1 100644
--- a/drivers/char/ipmi/Makefile
+++ b/drivers/char/ipmi/Makefile
@@ -11,3 +11,4 @@ obj-$(CONFIG_IPMI_SSIF) += ipmi_ssif.o
 obj-$(CONFIG_IPMI_POWERNV) += ipmi_powernv.o
 obj-$(CONFIG_IPMI_WATCHDOG) += ipmi_watchdog.o
 obj-$(CONFIG_IPMI_POWEROFF) += ipmi_poweroff.o
+obj-$(CONFIG_ASPEED_BT_IPMI_BMC) += bt-bmc.o
diff --git a/drivers/char/ipmi/bt-bmc.c b/drivers/char/ipmi/bt-bmc.c
new file mode 100644
index 000000000000..fc9e8891eae3
--- /dev/null
+++ b/drivers/char/ipmi/bt-bmc.c
@@ -0,0 +1,505 @@
+/*
+ * Copyright (c) 2015-2016, IBM Corporation.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#include <linux/atomic.h>
+#include <linux/bt-bmc.h>
+#include <linux/errno.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/poll.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+/*
+ * This is a BMC device used to communicate to the host
+ */
+#define DEVICE_NAME     "ipmi-bt-host"
+#define BT_IO_BASE      0xe4
+#define BT_IRQ          10
+#define BT_CR0          0x0
+#define   BT_CR0_IO_BASE                16
+#define   BT_CR0_IRQ                    12
+#define   BT_CR0_EN_CLR_SLV_RDP         0x8
+#define   BT_CR0_EN_CLR_SLV_WRP         0x4
+#define   BT_CR0_ENABLE_IBT             0x1
+#define BT_CR1          0x4
+#define   BT_CR1_IRQ_H2B        0x01
+#define   BT_CR1_IRQ_HBUSY      0x40
+#define BT_CR2          0x8
+#define   BT_CR2_IRQ_H2B        0x01
+#define   BT_CR2_IRQ_HBUSY      0x40
+#define BT_CR3          0xc
+#define BT_CTRL         0x10
+#define   BT_CTRL_B_BUSY                0x80
+#define   BT_CTRL_H_BUSY                0x40
+#define   BT_CTRL_OEM0                  0x20
+#define   BT_CTRL_SMS_ATN               0x10
+#define   BT_CTRL_B2H_ATN               0x08
+#define   BT_CTRL_H2B_ATN               0x04
+#define   BT_CTRL_CLR_RD_PTR            0x02
+#define   BT_CTRL_CLR_WR_PTR            0x01
+#define BT_BMC2HOST     0x14
+#define BT_INTMASK      0x18
+#define   BT_INTMASK_B2H_IRQEN          0x01
+#define   BT_INTMASK_B2H_IRQ            0x02
+#define   BT_INTMASK_BMC_HWRST          0x80
+#define BT_BMC_BUFFER_SIZE 256
+struct bt_bmc {
+        struct device           dev;
+        struct miscdevice       miscdev;
+        void __iomem            *base;
+        int                     irq;
+        wait_queue_head_t       queue;
+        struct timer_list       poll_timer;
+        struct mutex            mutex;
+};
+static atomic_t open_count = ATOMIC_INIT(0);
+static u8 bt_inb(struct bt_bmc *bt_bmc, int reg)
+{
+        return ioread8(bt_bmc->base + reg);
+}
+static void bt_outb(struct bt_bmc *bt_bmc, u8 data, int reg)
+{
+        iowrite8(data, bt_bmc->base + reg);
+}
+static void clr_rd_ptr(struct bt_bmc *bt_bmc)
+{
+        bt_outb(bt_bmc, BT_CTRL_CLR_RD_PTR, BT_CTRL);
+}
+static void clr_wr_ptr(struct bt_bmc *bt_bmc)
+{
+        bt_outb(bt_bmc, BT_CTRL_CLR_WR_PTR, BT_CTRL);
+}
+static void clr_h2b_atn(struct bt_bmc *bt_bmc)
+{
+        bt_outb(bt_bmc, BT_CTRL_H2B_ATN, BT_CTRL);
+}
+static void set_b_busy(struct bt_bmc *bt_bmc)
+{
+        if (!(bt_inb(bt_bmc, BT_CTRL) & BT_CTRL_B_BUSY))
+                bt_outb(bt_bmc, BT_CTRL_B_BUSY, BT_CTRL);
+}
+static void clr_b_busy(struct bt_bmc *bt_bmc)
+{
+        if (bt_inb(bt_bmc, BT_CTRL) & BT_CTRL_B_BUSY)
+                bt_outb(bt_bmc, BT_CTRL_B_BUSY, BT_CTRL);
+}
+static void set_b2h_atn(struct bt_bmc *bt_bmc)
+{
+        bt_outb(bt_bmc, BT_CTRL_B2H_ATN, BT_CTRL);
+}
+static u8 bt_read(struct bt_bmc *bt_bmc)
+{
+        return bt_inb(bt_bmc, BT_BMC2HOST);
+}
+static ssize_t bt_readn(struct bt_bmc *bt_bmc, u8 *buf, size_t n)
+{
+        int i;
+        for (i = 0; i < n; i++)
+                buf[i] = bt_read(bt_bmc);
+        return n;
+}
+static void bt_write(struct bt_bmc *bt_bmc, u8 c)
+{
+        bt_outb(bt_bmc, c, BT_BMC2HOST);
+}
+static ssize_t bt_writen(struct bt_bmc *bt_bmc, u8 *buf, size_t n)
+{
+        int i;
+        for (i = 0; i < n; i++)
+                bt_write(bt_bmc, buf[i]);
+        return n;
+}
+static void set_sms_atn(struct bt_bmc *bt_bmc)
+{
+        bt_outb(bt_bmc, BT_CTRL_SMS_ATN, BT_CTRL);
+}
+static struct bt_bmc *file_bt_bmc(struct file *file)
+{
+        return container_of(file->private_data, struct bt_bmc, miscdev);
+}
+static int bt_bmc_open(struct inode *inode, struct file *file)
+{
+        struct bt_bmc *bt_bmc = file_bt_bmc(file);
+        if (atomic_inc_return(&open_count) == 1) {
+                clr_b_busy(bt_bmc);
+                return 0;
+        }
+        atomic_dec(&open_count);
+        return -EBUSY;
+}
+/*
+ * The BT (Block Transfer) interface means that entire messages are
+ * buffered by the host before a notification is sent to the BMC that
+ * there is data to be read. The first byte is the length and the
+ * message data follows. The read operation just tries to capture the
+ * whole before returning it to userspace.
+ *
+ * BT Message format :
+ *
+ *    Byte 1  Byte 2     Byte 3  Byte 4  Byte 5:N
+ *    Length  NetFn/LUN  Seq     Cmd     Data
+ *
+ */
+static ssize_t bt_bmc_read(struct file *file, char __user *buf,
+                           size_t count, loff_t *ppos)
+{
+        struct bt_bmc *bt_bmc = file_bt_bmc(file);
+        u8 len;
+        int len_byte = 1;
+        u8 kbuffer[BT_BMC_BUFFER_SIZE];
+        ssize_t ret = 0;
+        ssize_t nread;
+        if (!access_ok(VERIFY_WRITE, buf, count))
+                return -EFAULT;
+        WARN_ON(*ppos);
+        if (wait_event_interruptible(bt_bmc->queue,
+                                     bt_inb(bt_bmc, BT_CTRL) & BT_CTRL_H2B_ATN))
+                return -ERESTARTSYS;
+        mutex_lock(&bt_bmc->mutex);
+        if (unlikely(!(bt_inb(bt_bmc, BT_CTRL) & BT_CTRL_H2B_ATN))) {
+                ret = -EIO;
+                goto out_unlock;
+        }
+        set_b_busy(bt_bmc);
+        clr_h2b_atn(bt_bmc);
+        clr_rd_ptr(bt_bmc);
+        /*
+         * The BT frames start with the message length, which does not
+         * include the length byte.
+         */
+        kbuffer[0] = bt_read(bt_bmc);
+        len = kbuffer[0];
+        /* We pass the length back to userspace as well */
+        if (len + 1 > count)
+                len = count - 1;
+        while (len) {
+                nread = min_t(ssize_t, len, sizeof(kbuffer) - len_byte);
+                bt_readn(bt_bmc, kbuffer + len_byte, nread);
+                if (copy_to_user(buf, kbuffer, nread + len_byte)) {
+                        ret = -EFAULT;
+                        break;
+                }
+                len -= nread;
+                buf += nread + len_byte;
+                ret += nread + len_byte;
+                len_byte = 0;
+        }
+        clr_b_busy(bt_bmc);
+out_unlock:
+        mutex_unlock(&bt_bmc->mutex);
+        return ret;
+}
+/*
+ * BT Message response format :
+ *
+ *    Byte 1  Byte 2     Byte 3  Byte 4  Byte 5  Byte 6:N
+ *    Length  NetFn/LUN  Seq     Cmd     Code    Data
+ */
+static ssize_t bt_bmc_write(struct file *file, const char __user *buf,
+                            size_t count, loff_t *ppos)
+{
+        struct bt_bmc *bt_bmc = file_bt_bmc(file);
+        u8 kbuffer[BT_BMC_BUFFER_SIZE];
+        ssize_t ret = 0;
+        ssize_t nwritten;
+        /*
+         * send a minimum response size
+         */
+        if (count < 5)
+                return -EINVAL;
+        if (!access_ok(VERIFY_READ, buf, count))
+                return -EFAULT;
+        WARN_ON(*ppos);
+        /*
+         * There's no interrupt for clearing bmc busy so we have to
+         * poll
+         */
+        if (wait_event_interruptible(bt_bmc->queue,
+                                     !(bt_inb(bt_bmc, BT_CTRL) &
+                                       (BT_CTRL_H_BUSY | BT_CTRL_B2H_ATN))))
+                return -ERESTARTSYS;
+        mutex_lock(&bt_bmc->mutex);
+        if (unlikely(bt_inb(bt_bmc, BT_CTRL) &
+                     (BT_CTRL_H_BUSY | BT_CTRL_B2H_ATN))) {
+                ret = -EIO;
+                goto out_unlock;
+        }
+        clr_wr_ptr(bt_bmc);
+        while (count) {
+                nwritten = min_t(ssize_t, count, sizeof(kbuffer));
+                if (copy_from_user(&kbuffer, buf, nwritten)) {
+                        ret = -EFAULT;
+                        break;
+                }
+                bt_writen(bt_bmc, kbuffer, nwritten);
+                count -= nwritten;
+                buf += nwritten;
+                ret += nwritten;
+        }
+        set_b2h_atn(bt_bmc);
+out_unlock:
+        mutex_unlock(&bt_bmc->mutex);
+        return ret;
+}
+static long bt_bmc_ioctl(struct file *file, unsigned int cmd,
+                         unsigned long param)
+{
+        struct bt_bmc *bt_bmc = file_bt_bmc(file);
+        switch (cmd) {
+        case BT_BMC_IOCTL_SMS_ATN:
+                set_sms_atn(bt_bmc);
+                return 0;
+        }
+        return -EINVAL;
+}
+static int bt_bmc_release(struct inode *inode, struct file *file)
+{
+        struct bt_bmc *bt_bmc = file_bt_bmc(file);
+        atomic_dec(&open_count);
+        set_b_busy(bt_bmc);
+        return 0;
+}
+static unsigned int bt_bmc_poll(struct file *file, poll_table *wait)
+{
+        struct bt_bmc *bt_bmc = file_bt_bmc(file);
+        unsigned int mask = 0;
+        u8 ctrl;
+        poll_wait(file, &bt_bmc->queue, wait);
+        ctrl = bt_inb(bt_bmc, BT_CTRL);
+        if (ctrl & BT_CTRL_H2B_ATN)
+                mask |= POLLIN;
+        if (!(ctrl & (BT_CTRL_H_BUSY | BT_CTRL_B2H_ATN)))
+                mask |= POLLOUT;
+        return mask;
+}
+static const struct file_operations bt_bmc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = bt_bmc_open,
+        .read           = bt_bmc_read,
+        .write          = bt_bmc_write,
+        .release        = bt_bmc_release,
+        .poll           = bt_bmc_poll,
+        .unlocked_ioctl = bt_bmc_ioctl,
+};
+static void poll_timer(unsigned long data)
+{
+        struct bt_bmc *bt_bmc = (void *)data;
+        bt_bmc->poll_timer.expires += msecs_to_jiffies(500);
+        wake_up(&bt_bmc->queue);
+        add_timer(&bt_bmc->poll_timer);
+}
+static irqreturn_t bt_bmc_irq(int irq, void *arg)
+{
+        struct bt_bmc *bt_bmc = arg;
+        u32 reg;
+        reg = ioread32(bt_bmc->base + BT_CR2);
+        reg &= BT_CR2_IRQ_H2B | BT_CR2_IRQ_HBUSY;
+        if (!reg)
+                return IRQ_NONE;
+        /* ack pending IRQs */
+        iowrite32(reg, bt_bmc->base + BT_CR2);
+        wake_up(&bt_bmc->queue);
+        return IRQ_HANDLED;
+}
+static int bt_bmc_config_irq(struct bt_bmc *bt_bmc,
+                             struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        u32 reg;
+        int rc;
+        bt_bmc->irq = platform_get_irq(pdev, 0);
+        if (!bt_bmc->irq)
+                return -ENODEV;
+        rc = devm_request_irq(dev, bt_bmc->irq, bt_bmc_irq, IRQF_SHARED,
+                              DEVICE_NAME, bt_bmc);
+        if (rc < 0) {
+                dev_warn(dev, "Unable to request IRQ %d\n", bt_bmc->irq);
+                bt_bmc->irq = 0;
+                return rc;
+        }
+        /*
+         * Configure IRQs on the bmc clearing the H2B and HBUSY bits;
+         * H2B will be asserted when the bmc has data for us; HBUSY
+         * will be cleared (along with B2H) when we can write the next
+         * message to the BT buffer
+         */
+        reg = ioread32(bt_bmc->base + BT_CR1);
+        reg |= BT_CR1_IRQ_H2B | BT_CR1_IRQ_HBUSY;
+        iowrite32(reg, bt_bmc->base + BT_CR1);
+        return 0;
+}
+static int bt_bmc_probe(struct platform_device *pdev)
+{
+        struct bt_bmc *bt_bmc;
+        struct device *dev;
+        struct resource *res;
+        int rc;
+        if (!pdev || !pdev->dev.of_node)
+                return -ENODEV;
+        dev = &pdev->dev;
+        dev_info(dev, "Found bt bmc device\n");
+        bt_bmc = devm_kzalloc(dev, sizeof(*bt_bmc), GFP_KERNEL);
+        if (!bt_bmc)
+                return -ENOMEM;
+        dev_set_drvdata(&pdev->dev, bt_bmc);
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        bt_bmc->base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(bt_bmc->base))
+                return PTR_ERR(bt_bmc->base);
+        mutex_init(&bt_bmc->mutex);
+        init_waitqueue_head(&bt_bmc->queue);
+        bt_bmc->miscdev.minor   = MISC_DYNAMIC_MINOR,
+                bt_bmc->miscdev.name    = DEVICE_NAME,
+                bt_bmc->miscdev.fops    = &bt_bmc_fops,
+                bt_bmc->miscdev.parent = dev;
+        rc = misc_register(&bt_bmc->miscdev);
+        if (rc) {
+                dev_err(dev, "Unable to register misc device\n");
+                return rc;
+        }
+        bt_bmc_config_irq(bt_bmc, pdev);
+        if (bt_bmc->irq) {
+                dev_info(dev, "Using IRQ %d\n", bt_bmc->irq);
+        } else {
+                dev_info(dev, "No IRQ; using timer\n");
+                setup_timer(&bt_bmc->poll_timer, poll_timer,
+                            (unsigned long)bt_bmc);
+                bt_bmc->poll_timer.expires = jiffies + msecs_to_jiffies(10);
+                add_timer(&bt_bmc->poll_timer);
+        }
+        iowrite32((BT_IO_BASE << BT_CR0_IO_BASE) |
+                  (BT_IRQ << BT_CR0_IRQ) |
+                  BT_CR0_EN_CLR_SLV_RDP |
+                  BT_CR0_EN_CLR_SLV_WRP |
+                  BT_CR0_ENABLE_IBT,
+                  bt_bmc->base + BT_CR0);
+        clr_b_busy(bt_bmc);
+        return 0;
+}
+static int bt_bmc_remove(struct platform_device *pdev)
+{
+        struct bt_bmc *bt_bmc = dev_get_drvdata(&pdev->dev);
+        misc_deregister(&bt_bmc->miscdev);
+        if (!bt_bmc->irq)
+                del_timer_sync(&bt_bmc->poll_timer);
+        return 0;
+}
+static const struct of_device_id bt_bmc_match[] = {
+        { .compatible = "aspeed,ast2400-ibt-bmc" },
+        { },
+};
+static struct platform_driver bt_bmc_driver = {
+        .driver = {
+                .name           = DEVICE_NAME,
+                .of_match_table = bt_bmc_match,
+        },
+        .probe = bt_bmc_probe,
+        .remove = bt_bmc_remove,
+};
+module_platform_driver(bt_bmc_driver);
+MODULE_DEVICE_TABLE(of, bt_bmc_match);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Alistair Popple <alistair@popple.id.au>");
+MODULE_DESCRIPTION("Linux device interface to the IPMI BT interface");
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index d8619998cfb5..fcdd886819f5 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -2891,11 +2891,11 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
                intf->curr_channel = IPMI_MAX_CHANNELS;
        }
+        rv = ipmi_bmc_register(intf, i);
        if (rv == 0)
                rv = add_proc_entries(intf, i);
-        rv = ipmi_bmc_register(intf, i);
 out:
        if (rv) {
                if (intf->proc_dir)
@@ -2982,8 +2982,6 @@ int ipmi_unregister_smi(ipmi_smi_t intf)
        int intf_num = intf->intf_num;
        ipmi_user_t user;
-        ipmi_bmc_unregister(intf);
        mutex_lock(&smi_watchers_mutex);
        mutex_lock(&ipmi_interfaces_mutex);
        intf->intf_num = -1;
@@ -3007,6 +3005,7 @@ int ipmi_unregister_smi(ipmi_smi_t intf)
        mutex_unlock(&ipmi_interfaces_mutex);
        remove_proc_entries(intf);
+        ipmi_bmc_unregister(intf);
        /*
         * Call all the watcher interfaces to tell them that
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index d23368874710..6af1ce04b3da 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -748,10 +748,7 @@ static int pp_release(struct inode *inode, struct file *file)
        }
        if (pp->pdev) {
-                const char *name = pp->pdev->name;
                parport_unregister_device(pp->pdev);
-                kfree(name);
                pp->pdev = NULL;
                pr_debug(CHRDEV "%x: unregistered pardevice\n", minor);
        }
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 8de61876f633..3a9149cf0110 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -813,9 +813,6 @@ int tpm_do_selftest(struct tpm_chip *chip)
                        continue;
                }
-                if (rc < TPM_HEADER_SIZE)
-                        return -EFAULT;
                if (rc == TPM_ERR_DISABLED || rc == TPM_ERR_DEACTIVATED) {
                        dev_info(&chip->dev,
                                 "TPM is disabled/deactivated (0x%X)\n", rc);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index d433b1db1fdd..5649234b7316 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1539,19 +1539,29 @@ static void remove_port_data(struct port *port)
        spin_lock_irq(&port->inbuf_lock);
        /* Remove unused data this port might have received. */
        discard_port_data(port);
+        spin_unlock_irq(&port->inbuf_lock);
        /* Remove buffers we queued up for the Host to send us data in. */
-        while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
+        do {
-                free_buf(buf, true);
+                spin_lock_irq(&port->inbuf_lock);
-        spin_unlock_irq(&port->inbuf_lock);
+                buf = virtqueue_detach_unused_buf(port->in_vq);
+                spin_unlock_irq(&port->inbuf_lock);
+                if (buf)
+                        free_buf(buf, true);
+        } while (buf);
        spin_lock_irq(&port->outvq_lock);
        reclaim_consumed_buffers(port);
+        spin_unlock_irq(&port->outvq_lock);
        /* Free pending buffers from the out-queue. */
-        while ((buf = virtqueue_detach_unused_buf(port->out_vq)))
+        do {
-                free_buf(buf, true);
+                spin_lock_irq(&port->outvq_lock);
-        spin_unlock_irq(&port->outvq_lock);
+                buf = virtqueue_detach_unused_buf(port->out_vq);
+                spin_unlock_irq(&port->outvq_lock);
+                if (buf)
+                        free_buf(buf, true);
+        } while (buf);
 }
 /*
diff --git a/drivers/clk/at91/clk-programmable.c b/drivers/clk/at91/clk-programmable.c
index 190122e64a3a..85a449cf61e3 100644
--- a/drivers/clk/at91/clk-programmable.c
+++ b/drivers/clk/at91/clk-programmable.c
@@ -203,7 +203,7 @@ at91_clk_register_programmable(struct regmap *regmap,
        ret = clk_hw_register(NULL, &prog->hw);
        if (ret) {
                kfree(prog);
-                hw = &prog->hw;
+                hw = ERR_PTR(ret);
        }
        return hw;
diff --git a/drivers/clk/bcm/Kconfig b/drivers/clk/bcm/Kconfig
index f21e9b7afd1a..e3eed5a78404 100644
--- a/drivers/clk/bcm/Kconfig
+++ b/drivers/clk/bcm/Kconfig
@@ -20,7 +20,7 @@ config CLK_BCM_KONA
 config COMMON_CLK_IPROC
        bool "Broadcom iProc clock support"
-        depends on ARCH_BCM_IPROC || COMPILE_TEST
+        depends on ARCH_BCM_IPROC || ARCH_BCM_63XX || COMPILE_TEST
        depends on COMMON_CLK
        default ARCH_BCM_IPROC
        help
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index b68bf573dcfb..8c7763fd9efc 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -502,8 +502,12 @@ static long bcm2835_pll_rate_from_divisors(unsigned long parent_rate,
 static long bcm2835_pll_round_rate(struct clk_hw *hw, unsigned long rate,
                                   unsigned long *parent_rate)
 {
+        struct bcm2835_pll *pll = container_of(hw, struct bcm2835_pll, hw);
+        const struct bcm2835_pll_data *data = pll->data;
        u32 ndiv, fdiv;
+        rate = clamp(rate, data->min_rate, data->max_rate);
        bcm2835_pll_choose_ndiv_and_fdiv(rate, *parent_rate, &ndiv, &fdiv);
        return bcm2835_pll_rate_from_divisors(*parent_rate, ndiv, fdiv, 1);
@@ -608,13 +612,6 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
        u32 ana[4];
        int i;
-        if (rate < data->min_rate || rate > data->max_rate) {
-                dev_err(cprman->dev, "%s: rate out of spec: %lu vs (%lu, %lu)\n",
-                        clk_hw_get_name(hw), rate,
-                        data->min_rate, data->max_rate);
-                return -EINVAL;
-        }
        if (rate > data->max_fb_rate) {
                use_fb_prediv = true;
                rate /= 2;
diff --git a/drivers/clk/berlin/bg2.c b/drivers/clk/berlin/bg2.c
index edf3b96b3b73..1d99292e2039 100644
--- a/drivers/clk/berlin/bg2.c
+++ b/drivers/clk/berlin/bg2.c
@@ -685,7 +685,7 @@ static void __init berlin2_clock_setup(struct device_node *np)
        }
        /* register clk-provider */
-        of_clk_add_hw_provider(np, of_clk_hw_onecell_get, &clk_data);
+        of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_data);
        return;
diff --git a/drivers/clk/berlin/bg2q.c b/drivers/clk/berlin/bg2q.c
index 0718e831475f..3b784b593afd 100644
--- a/drivers/clk/berlin/bg2q.c
+++ b/drivers/clk/berlin/bg2q.c
@@ -382,7 +382,7 @@ static void __init berlin2q_clock_setup(struct device_node *np)
        }
        /* register clk-provider */
-        of_clk_add_hw_provider(np, of_clk_hw_onecell_get, &clk_data);
+        of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_data);
        return;
diff --git a/drivers/clk/clk-efm32gg.c b/drivers/clk/clk-efm32gg.c
index 8802a2dd56ac..f674778fb3ac 100644
--- a/drivers/clk/clk-efm32gg.c
+++ b/drivers/clk/clk-efm32gg.c
@@ -82,6 +82,6 @@ static void __init efm32gg_cmu_init(struct device_node *np)
        hws[clk_HFPERCLKDAC0] = clk_hw_register_gate(NULL, "HFPERCLK.DAC0",
                        "HFXO", 0, base + CMU_HFPERCLKEN0, 17, 0, NULL);
-        of_clk_add_hw_provider(np, of_clk_hw_onecell_get, &clk_data);
+        of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_data);
 }
 CLK_OF_DECLARE(efm32ggcmu, "efm32gg,cmu", efm32gg_cmu_init);
diff --git a/drivers/clk/clk-max77686.c b/drivers/clk/clk-max77686.c
index b637f5979023..eb953d3b0b69 100644
--- a/drivers/clk/clk-max77686.c
+++ b/drivers/clk/clk-max77686.c
@@ -216,6 +216,7 @@ static int max77686_clk_probe(struct platform_device *pdev)
                return -EINVAL;
        }
+        drv_data->num_clks = num_clks;
        drv_data->max_clk_data = devm_kcalloc(dev, num_clks,
                                              sizeof(*drv_data->max_clk_data),
                                              GFP_KERNEL);
diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
index 20b105584f82..80ae2a51452d 100644
--- a/drivers/clk/clk-qoriq.c
+++ b/drivers/clk/clk-qoriq.c
@@ -700,6 +700,7 @@ static struct clk * __init create_mux_common(struct clockgen *cg,
                                             struct mux_hwclock *hwc,
                                             const struct clk_ops *ops,
                                             unsigned long min_rate,
+                                             unsigned long max_rate,
                                             unsigned long pct80_rate,
                                             const char *fmt, int idx)
 {
@@ -728,6 +729,8 @@ static struct clk * __init create_mux_common(struct clockgen *cg,
                        continue;
                if (rate < min_rate)
                        continue;
+                if (rate > max_rate)
+                        continue;
                parent_names[j] = div->name;
                hwc->parent_to_clksel[j] = i;
@@ -759,7 +762,7 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx)
        struct mux_hwclock *hwc;
        const struct clockgen_pll_div *div;
        unsigned long plat_rate, min_rate;
-        u64 pct80_rate;
+        u64 max_rate, pct80_rate;
        u32 clksel;
        hwc = kzalloc(sizeof(*hwc), GFP_KERNEL);
@@ -787,8 +790,8 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx)
                return NULL;
        }
-        pct80_rate = clk_get_rate(div->clk);
+        max_rate = clk_get_rate(div->clk);
-        pct80_rate *= 8;
+        pct80_rate = max_rate * 8;
        do_div(pct80_rate, 10);
        plat_rate = clk_get_rate(cg->pll[PLATFORM_PLL].div[PLL_DIV1].clk);
@@ -798,7 +801,7 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx)
        else
                min_rate = plat_rate / 2;
-        return create_mux_common(cg, hwc, &cmux_ops, min_rate,
+        return create_mux_common(cg, hwc, &cmux_ops, min_rate, max_rate,
                                 pct80_rate, "cg-cmux%d", idx);
 }
@@ -813,7 +816,7 @@ static struct clk * __init create_one_hwaccel(struct clockgen *cg, int idx)
        hwc->reg = cg->regs + 0x20 * idx + 0x10;
        hwc->info = cg->info.hwaccel[idx];
-        return create_mux_common(cg, hwc, &hwaccel_ops, 0, 0,
+        return create_mux_common(cg, hwc, &hwaccel_ops, 0, ULONG_MAX, 0,
                                 "cg-hwaccel%d", idx);
 }
diff --git a/drivers/clk/clk-xgene.c b/drivers/clk/clk-xgene.c
index 5daddf5ecc4b..bc37030e38ba 100644
--- a/drivers/clk/clk-xgene.c
+++ b/drivers/clk/clk-xgene.c
@@ -463,22 +463,20 @@ static int xgene_clk_enable(struct clk_hw *hw)
        struct xgene_clk *pclk = to_xgene_clk(hw);
        unsigned long flags = 0;
        u32 data;
-        phys_addr_t reg;
        if (pclk->lock)
                spin_lock_irqsave(pclk->lock, flags);
        if (pclk->param.csr_reg != NULL) {
                pr_debug("%s clock enabled\n", clk_hw_get_name(hw));
-                reg = __pa(pclk->param.csr_reg);
                /* First enable the clock */
                data = xgene_clk_read(pclk->param.csr_reg +
                                        pclk->param.reg_clk_offset);
                data |= pclk->param.reg_clk_mask;
                xgene_clk_write(data, pclk->param.csr_reg +
                                        pclk->param.reg_clk_offset);
-                pr_debug("%s clock PADDR base %pa clk offset 0x%08X mask 0x%08X value 0x%08X\n",
+                pr_debug("%s clk offset 0x%08X mask 0x%08X value 0x%08X\n",
-                        clk_hw_get_name(hw), &reg,
+                        clk_hw_get_name(hw),
                        pclk->param.reg_clk_offset, pclk->param.reg_clk_mask,
                        data);
@@ -488,8 +486,8 @@ static int xgene_clk_enable(struct clk_hw *hw)
                data &= ~pclk->param.reg_csr_mask;
                xgene_clk_write(data, pclk->param.csr_reg +
                                        pclk->param.reg_csr_offset);
-                pr_debug("%s CSR RESET PADDR base %pa csr offset 0x%08X mask 0x%08X value 0x%08X\n",
+                pr_debug("%s csr offset 0x%08X mask 0x%08X value 0x%08X\n",
-                        clk_hw_get_name(hw), &reg,
+                        clk_hw_get_name(hw),
                        pclk->param.reg_csr_offset, pclk->param.reg_csr_mask,
                        data);
        }
diff --git a/drivers/clk/hisilicon/clk-hi6220.c b/drivers/clk/hisilicon/clk-hi6220.c
index fe364e63f8de..c0e8e1f196aa 100644
--- a/drivers/clk/hisilicon/clk-hi6220.c
+++ b/drivers/clk/hisilicon/clk-hi6220.c
@@ -195,7 +195,7 @@ static void __init hi6220_clk_sys_init(struct device_node *np)
        hi6220_clk_register_divider(hi6220_div_clks_sys,
                        ARRAY_SIZE(hi6220_div_clks_sys), clk_data);
 }
-CLK_OF_DECLARE(hi6220_clk_sys, "hisilicon,hi6220-sysctrl", hi6220_clk_sys_init);
+CLK_OF_DECLARE_DRIVER(hi6220_clk_sys, "hisilicon,hi6220-sysctrl", hi6220_clk_sys_init);
 /* clocks in media controller */
@@ -252,7 +252,7 @@ static void __init hi6220_clk_media_init(struct device_node *np)
        hi6220_clk_register_divider(hi6220_div_clks_media,
                                ARRAY_SIZE(hi6220_div_clks_media), clk_data);
 }
-CLK_OF_DECLARE(hi6220_clk_media, "hisilicon,hi6220-mediactrl", hi6220_clk_media_init);
+CLK_OF_DECLARE_DRIVER(hi6220_clk_media, "hisilicon,hi6220-mediactrl", hi6220_clk_media_init);
 /* clocks in pmctrl */
diff --git a/drivers/clk/imx/clk-pllv3.c b/drivers/clk/imx/clk-pllv3.c
index 19f9b622981a..7a6acc3e4a92 100644
--- a/drivers/clk/imx/clk-pllv3.c
+++ b/drivers/clk/imx/clk-pllv3.c
@@ -223,7 +223,7 @@ static unsigned long clk_pllv3_av_recalc_rate(struct clk_hw *hw,
        temp64 *= mfn;
        do_div(temp64, mfd);
-        return (parent_rate * div) + (u32)temp64;
+        return parent_rate * div + (unsigned long)temp64;
 }
 static long clk_pllv3_av_round_rate(struct clk_hw *hw, unsigned long rate,
@@ -247,7 +247,11 @@ static long clk_pllv3_av_round_rate(struct clk_hw *hw, unsigned long rate,
        do_div(temp64, parent_rate);
        mfn = temp64;
-        return parent_rate * div + parent_rate * mfn / mfd;
+        temp64 = (u64)parent_rate;
+        temp64 *= mfn;
+        do_div(temp64, mfd);
+        return parent_rate * div + (unsigned long)temp64;
 }
 static int clk_pllv3_av_set_rate(struct clk_hw *hw, unsigned long rate,
diff --git a/drivers/clk/mediatek/Kconfig b/drivers/clk/mediatek/Kconfig
index 380c372d528e..f042bd2a6a99 100644
--- a/drivers/clk/mediatek/Kconfig
+++ b/drivers/clk/mediatek/Kconfig
@@ -8,6 +8,7 @@ config COMMON_CLK_MEDIATEK
 config COMMON_CLK_MT8135
        bool "Clock driver for Mediatek MT8135"
+        depends on ARCH_MEDIATEK || COMPILE_TEST
        select COMMON_CLK_MEDIATEK
        default ARCH_MEDIATEK
        ---help---
@@ -15,6 +16,7 @@ config COMMON_CLK_MT8135
 config COMMON_CLK_MT8173
        bool "Clock driver for Mediatek MT8173"
+        depends on ARCH_MEDIATEK || COMPILE_TEST
        select COMMON_CLK_MEDIATEK
        default ARCH_MEDIATEK
        ---help---
diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
index 3a51fff1b0e7..9adaf48aea23 100644
--- a/drivers/clk/mmp/clk-of-mmp2.c
+++ b/drivers/clk/mmp/clk-of-mmp2.c
@@ -313,7 +313,7 @@ static void __init mmp2_clk_init(struct device_node *np)
        }
        pxa_unit->apmu_base = of_iomap(np, 1);
-        if (!pxa_unit->mpmu_base) {
+        if (!pxa_unit->apmu_base) {
                pr_err("failed to map apmu registers\n");
                return;
        }
diff --git a/drivers/clk/mmp/clk-of-pxa168.c b/drivers/clk/mmp/clk-of-pxa168.c
index 87f2317b2a00..f110c02e83cb 100644
--- a/drivers/clk/mmp/clk-of-pxa168.c
+++ b/drivers/clk/mmp/clk-of-pxa168.c
@@ -262,7 +262,7 @@ static void __init pxa168_clk_init(struct device_node *np)
        }
        pxa_unit->apmu_base = of_iomap(np, 1);
-        if (!pxa_unit->mpmu_base) {
+        if (!pxa_unit->apmu_base) {
                pr_err("failed to map apmu registers\n");
                return;
        }
diff --git a/drivers/clk/mmp/clk-of-pxa910.c b/drivers/clk/mmp/clk-of-pxa910.c
index e22a67f76d93..64d1ef49caeb 100644
--- a/drivers/clk/mmp/clk-of-pxa910.c
+++ b/drivers/clk/mmp/clk-of-pxa910.c
@@ -282,7 +282,7 @@ static void __init pxa910_clk_init(struct device_node *np)
        }
        pxa_unit->apmu_base = of_iomap(np, 1);
-        if (!pxa_unit->mpmu_base) {
+        if (!pxa_unit->apmu_base) {
                pr_err("failed to map apmu registers\n");
                return;
        }
@@ -294,7 +294,7 @@ static void __init pxa910_clk_init(struct device_node *np)
        }
        pxa_unit->apbcp_base = of_iomap(np, 3);
-        if (!pxa_unit->mpmu_base) {
+        if (!pxa_unit->apbcp_base) {
                pr_err("failed to map apbcp registers\n");
                return;
        }
diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
index 45905fc0d75b..cecb0fdfaef6 100644
--- a/drivers/clk/mvebu/armada-37xx-periph.c
+++ b/drivers/clk/mvebu/armada-37xx-periph.c
@@ -305,7 +305,7 @@ static const struct of_device_id armada_3700_periph_clock_of_match[] = {
 };
 static int armada_3700_add_composite_clk(const struct clk_periph_data *data,
                                         void __iomem *reg, spinlock_t *lock,
-                                         struct device *dev, struct clk_hw *hw)
+                                         struct device *dev, struct clk_hw **hw)
 {
        const struct clk_ops *mux_ops = NULL, *gate_ops = NULL,
                *rate_ops = NULL;
@@ -329,6 +329,7 @@ static int armada_3700_add_composite_clk(const struct clk_periph_data *data,
                gate->lock = lock;
                gate_ops = gate_hw->init->ops;
                gate->reg = reg + (u64)gate->reg;
+                gate->flags = CLK_GATE_SET_TO_DISABLE;
        }
        if (data->rate_hw) {
@@ -353,13 +354,13 @@ static int armada_3700_add_composite_clk(const struct clk_periph_data *data,
                }
        }
-        hw = clk_hw_register_composite(dev, data->name, data->parent_names,
+        *hw = clk_hw_register_composite(dev, data->name, data->parent_names,
                                       data->num_parents, mux_hw,
                                       mux_ops, rate_hw, rate_ops,
                                       gate_hw, gate_ops, CLK_IGNORE_UNUSED);
-        if (IS_ERR(hw))
+        if (IS_ERR(*hw))
-                return PTR_ERR(hw);
+                return PTR_ERR(*hw);
        return 0;
 }
@@ -400,7 +401,7 @@ static int armada_3700_periph_clock_probe(struct platform_device *pdev)
        spin_lock_init(&driver_data->lock);
        for (i = 0; i < num_periph; i++) {
-                struct clk_hw *hw = driver_data->hw_data->hws[i];
+                struct clk_hw **hw = &driver_data->hw_data->hws[i];
                if (armada_3700_add_composite_clk(&data[i], reg,
                                                  &driver_data->lock, dev, hw))
diff --git a/drivers/clk/rockchip/clk-ddr.c b/drivers/clk/rockchip/clk-ddr.c
index 8feba93672c5..e8075359366b 100644
--- a/drivers/clk/rockchip/clk-ddr.c
+++ b/drivers/clk/rockchip/clk-ddr.c
@@ -144,11 +144,8 @@ struct clk *rockchip_clk_register_ddrclk(const char *name, int flags,
        ddrclk->ddr_flag = ddr_flag;
        clk = clk_register(NULL, &ddrclk->hw);
-        if (IS_ERR(clk)) {
+        if (IS_ERR(clk))
-                pr_err("%s: could not register ddrclk %s\n", __func__,  name);
                kfree(ddrclk);
-                return NULL;
-        }
        return clk;
 }
diff --git a/drivers/clk/samsung/clk-exynos-audss.c b/drivers/clk/samsung/clk-exynos-audss.c
index 51d152f735cc..17e68a724945 100644
--- a/drivers/clk/samsung/clk-exynos-audss.c
+++ b/drivers/clk/samsung/clk-exynos-audss.c
@@ -106,6 +106,7 @@ static const struct of_device_id exynos_audss_clk_of_match[] = {
        },
        { },
 };
+MODULE_DEVICE_TABLE(of, exynos_audss_clk_of_match);
 static void exynos_audss_clk_teardown(void)
 {
diff --git a/drivers/clk/samsung/clk-exynos-clkout.c b/drivers/clk/samsung/clk-exynos-clkout.c
index 96fab6cfb202..6c6afb87b4ce 100644
--- a/drivers/clk/samsung/clk-exynos-clkout.c
+++ b/drivers/clk/samsung/clk-exynos-clkout.c
@@ -132,28 +132,34 @@ free_clkout:
        pr_err("%s: failed to register clkout clock\n", __func__);
 }
+/*
+ * We use CLK_OF_DECLARE_DRIVER initialization method to avoid setting
+ * the OF_POPULATED flag on the pmu device tree node, so later the
+ * Exynos PMU platform device can be properly probed with PMU driver.
+ */
 static void __init exynos4_clkout_init(struct device_node *node)
 {
        exynos_clkout_init(node, EXYNOS4_CLKOUT_MUX_MASK);
 }
-CLK_OF_DECLARE(exynos4210_clkout, "samsung,exynos4210-pmu",
+CLK_OF_DECLARE_DRIVER(exynos4210_clkout, "samsung,exynos4210-pmu",
                exynos4_clkout_init);
-CLK_OF_DECLARE(exynos4212_clkout, "samsung,exynos4212-pmu",
+CLK_OF_DECLARE_DRIVER(exynos4212_clkout, "samsung,exynos4212-pmu",
                exynos4_clkout_init);
-CLK_OF_DECLARE(exynos4412_clkout, "samsung,exynos4412-pmu",
+CLK_OF_DECLARE_DRIVER(exynos4412_clkout, "samsung,exynos4412-pmu",
                exynos4_clkout_init);
-CLK_OF_DECLARE(exynos3250_clkout, "samsung,exynos3250-pmu",
+CLK_OF_DECLARE_DRIVER(exynos3250_clkout, "samsung,exynos3250-pmu",
                exynos4_clkout_init);
 static void __init exynos5_clkout_init(struct device_node *node)
 {
        exynos_clkout_init(node, EXYNOS5_CLKOUT_MUX_MASK);
 }
-CLK_OF_DECLARE(exynos5250_clkout, "samsung,exynos5250-pmu",
+CLK_OF_DECLARE_DRIVER(exynos5250_clkout, "samsung,exynos5250-pmu",
                exynos5_clkout_init);
-CLK_OF_DECLARE(exynos5410_clkout, "samsung,exynos5410-pmu",
+CLK_OF_DECLARE_DRIVER(exynos5410_clkout, "samsung,exynos5410-pmu",
                exynos5_clkout_init);
-CLK_OF_DECLARE(exynos5420_clkout, "samsung,exynos5420-pmu",
+CLK_OF_DECLARE_DRIVER(exynos5420_clkout, "samsung,exynos5420-pmu",
                exynos5_clkout_init);
-CLK_OF_DECLARE(exynos5433_clkout, "samsung,exynos5433-pmu",
+CLK_OF_DECLARE_DRIVER(exynos5433_clkout, "samsung,exynos5433-pmu",
                exynos5_clkout_init);
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 79596463e0d9..fc75a335a7ce 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -143,7 +143,7 @@ static SUNXI_CCU_NKM_WITH_MUX_GATE_LOCK(pll_mipi_clk, "pll-mipi",
                                        4, 2,   /* K */
                                        0, 4,   /* M */
                                        21, 0,  /* mux */
-                                        BIT(31),        /* gate */
+                                        BIT(31) | BIT(23) | BIT(22), /* gate */
                                        BIT(28),        /* lock */
                                        CLK_SET_RATE_UNGATE);
@@ -191,6 +191,8 @@ static struct clk_div_table axi_div_table[] = {
 static SUNXI_CCU_DIV_TABLE(axi_clk, "axi", "cpu",
                           0x050, 0, 3, axi_div_table, 0);
+#define SUN6I_A31_AHB1_REG  0x054
 static const char * const ahb1_parents[] = { "osc32k", "osc24M",
                                             "axi", "pll-periph" };
@@ -1230,6 +1232,16 @@ static void __init sun6i_a31_ccu_setup(struct device_node *node)
        val &= BIT(16);
        writel(val, reg + SUN6I_A31_PLL_MIPI_REG);
+        /* Force AHB1 to PLL6 / 3 */
+        val = readl(reg + SUN6I_A31_AHB1_REG);
+        /* set PLL6 pre-div = 3 */
+        val &= ~GENMASK(7, 6);
+        val |= 0x2 << 6;
+        /* select PLL6 / pre-div */
+        val &= ~GENMASK(13, 12);
+        val |= 0x3 << 12;
+        writel(val, reg + SUN6I_A31_AHB1_REG);
        sunxi_ccu_probe(node, reg, &sun6i_a31_ccu_desc);
        ccu_mux_notifier_register(pll_cpu_clk.common.hw.clk,
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
index 96b40ca57697..9bd1f78a0547 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
@@ -131,7 +131,7 @@ static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_mipi_clk, "pll-mipi",
                                    8, 4,               /* N */
                                    4, 2,               /* K */
                                    0, 4,               /* M */
-                                    BIT(31),            /* gate */
+                                    BIT(31) | BIT(23) | BIT(22), /* gate */
                                    BIT(28),            /* lock */
                                    CLK_SET_RATE_UNGATE);
diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
index 838b22aa8b67..f2c9274b8bd5 100644
--- a/drivers/clk/sunxi/clk-sunxi.c
+++ b/drivers/clk/sunxi/clk-sunxi.c
@@ -373,7 +373,7 @@ static void sun4i_get_apb1_factors(struct factors_request *req)
        else
                calcp = 3;
-        calcm = (req->parent_rate >> calcp) - 1;
+        calcm = (div >> calcp) - 1;
        req->rate = (req->parent_rate >> calcp) / (calcm + 1);
        req->m = calcm;
diff --git a/drivers/clk/uniphier/clk-uniphier-core.c b/drivers/clk/uniphier/clk-uniphier-core.c
index 5ffb898d0839..26c53f7963a4 100644
--- a/drivers/clk/uniphier/clk-uniphier-core.c
+++ b/drivers/clk/uniphier/clk-uniphier-core.c
@@ -79,7 +79,7 @@ static int uniphier_clk_probe(struct platform_device *pdev)
        hw_data->num = clk_num;
        /* avoid returning NULL for unused idx */
-        for (; clk_num >= 0; clk_num--)
+        while (--clk_num >= 0)
                hw_data->hws[clk_num] = ERR_PTR(-EINVAL);
        for (p = data; p->name; p++) {
@@ -111,6 +111,10 @@ static int uniphier_clk_remove(struct platform_device *pdev)
 static const struct of_device_id uniphier_clk_match[] = {
        /* System clock */
        {
+                .compatible = "socionext,uniphier-sld3-clock",
+                .data = uniphier_sld3_sys_clk_data,
+        },
+        {
                .compatible = "socionext,uniphier-ld4-clock",
                .data = uniphier_ld4_sys_clk_data,
        },
@@ -138,7 +142,7 @@ static const struct of_device_id uniphier_clk_match[] = {
                .compatible = "socionext,uniphier-ld20-clock",
                .data = uniphier_ld20_sys_clk_data,
        },
-        /* Media I/O clock */
+        /* Media I/O clock, SD clock */
        {
                .compatible = "socionext,uniphier-sld3-mio-clock",
                .data = uniphier_sld3_mio_clk_data,
@@ -156,20 +160,20 @@ static const struct of_device_id uniphier_clk_match[] = {
                .data = uniphier_sld3_mio_clk_data,
        },
        {
-                .compatible = "socionext,uniphier-pro5-mio-clock",
+                .compatible = "socionext,uniphier-pro5-sd-clock",
-                .data = uniphier_pro5_mio_clk_data,
+                .data = uniphier_pro5_sd_clk_data,
        },
        {
-                .compatible = "socionext,uniphier-pxs2-mio-clock",
+                .compatible = "socionext,uniphier-pxs2-sd-clock",
-                .data = uniphier_pro5_mio_clk_data,
+                .data = uniphier_pro5_sd_clk_data,
        },
        {
                .compatible = "socionext,uniphier-ld11-mio-clock",
                .data = uniphier_sld3_mio_clk_data,
        },
        {
-                .compatible = "socionext,uniphier-ld20-mio-clock",
+                .compatible = "socionext,uniphier-ld20-sd-clock",
-                .data = uniphier_pro5_mio_clk_data,
+                .data = uniphier_pro5_sd_clk_data,
        },
        /* Peripheral clock */
        {
diff --git a/drivers/clk/uniphier/clk-uniphier-mio.c b/drivers/clk/uniphier/clk-uniphier-mio.c
index 6aa7ec768d0b..218d20f099ce 100644
--- a/drivers/clk/uniphier/clk-uniphier-mio.c
+++ b/drivers/clk/uniphier/clk-uniphier-mio.c
@@ -93,7 +93,7 @@ const struct uniphier_clk_data uniphier_sld3_mio_clk_data[] = {
        { /* sentinel */ }
 };
-const struct uniphier_clk_data uniphier_pro5_mio_clk_data[] = {
+const struct uniphier_clk_data uniphier_pro5_sd_clk_data[] = {
        UNIPHIER_MIO_CLK_SD_FIXED,
        UNIPHIER_MIO_CLK_SD(0, 0),
        UNIPHIER_MIO_CLK_SD(1, 1),
diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c b/drivers/clk/uniphier/clk-uniphier-mux.c
index 15a2f2cbe0d9..2c243a894f3b 100644
--- a/drivers/clk/uniphier/clk-uniphier-mux.c
+++ b/drivers/clk/uniphier/clk-uniphier-mux.c
@@ -42,7 +42,7 @@ static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw)
        struct uniphier_clk_mux *mux = to_uniphier_clk_mux(hw);
        int num_parents = clk_hw_get_num_parents(hw);
        int ret;
-        u32 val;
+        unsigned int val;
        u8 i;
        ret = regmap_read(mux->regmap, mux->reg, &val);
diff --git a/drivers/clk/uniphier/clk-uniphier.h b/drivers/clk/uniphier/clk-uniphier.h
index 3ae184062388..0244dba1f4cf 100644
--- a/drivers/clk/uniphier/clk-uniphier.h
+++ b/drivers/clk/uniphier/clk-uniphier.h
@@ -115,7 +115,7 @@ extern const struct uniphier_clk_data uniphier_pxs2_sys_clk_data[];
 extern const struct uniphier_clk_data uniphier_ld11_sys_clk_data[];
 extern const struct uniphier_clk_data uniphier_ld20_sys_clk_data[];
 extern const struct uniphier_clk_data uniphier_sld3_mio_clk_data[];
-extern const struct uniphier_clk_data uniphier_pro5_mio_clk_data[];
+extern const struct uniphier_clk_data uniphier_pro5_sd_clk_data[];
 extern const struct uniphier_clk_data uniphier_ld4_peri_clk_data[];
 extern const struct uniphier_clk_data uniphier_pro4_peri_clk_data[];
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 245190839359..e2c6e43cf8ca 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -417,6 +417,16 @@ config SYS_SUPPORTS_SH_TMU
 config SYS_SUPPORTS_EM_STI
        bool
+config CLKSRC_JCORE_PIT
+        bool "J-Core PIT timer driver" if COMPILE_TEST
+        depends on OF
+        depends on GENERIC_CLOCKEVENTS
+        depends on HAS_IOMEM
+        select CLKSRC_MMIO
+        help
+          This enables build of clocksource and clockevent driver for
+          the integrated PIT in the J-Core synthesizable, open source SoC.
 config SH_TIMER_CMT
        bool "Renesas CMT timer driver" if COMPILE_TEST
        depends on GENERIC_CLOCKEVENTS
diff --git a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
index fd9d6df0bbc0..cf87f407f1ad 100644
--- a/drivers/clocksource/Makefile
+++ b/drivers/clocksource/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_ATMEL_TCB_CLKSRC)	+= tcb_clksrc.o
 obj-$(CONFIG_X86_PM_TIMER)      += acpi_pm.o
 obj-$(CONFIG_SCx200HR_TIMER)    += scx200_hrt.o
 obj-$(CONFIG_CS5535_CLOCK_EVENT_SRC)    += cs5535-clockevt.o
+obj-$(CONFIG_CLKSRC_JCORE_PIT)          += jcore-pit.o
 obj-$(CONFIG_SH_TIMER_CMT)      += sh_cmt.o
 obj-$(CONFIG_SH_TIMER_MTU2)     += sh_mtu2.o
 obj-$(CONFIG_SH_TIMER_TMU)      += sh_tmu.o
diff --git a/drivers/clocksource/jcore-pit.c b/drivers/clocksource/jcore-pit.c
new file mode 100644
index 000000000000..54e1665aa03c
--- /dev/null
+++ b/drivers/clocksource/jcore-pit.c
@@ -0,0 +1,249 @@
+/*
+ * J-Core SoC PIT/clocksource driver
+ *
+ * Copyright (C) 2015-2016 Smart Energy Instruments, Inc.
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ */
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/clockchips.h>
+#include <linux/clocksource.h>
+#include <linux/sched_clock.h>
+#include <linux/cpu.h>
+#include <linux/cpuhotplug.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#define PIT_IRQ_SHIFT           12
+#define PIT_PRIO_SHIFT          20
+#define PIT_ENABLE_SHIFT        26
+#define PIT_PRIO_MASK           0xf
+#define REG_PITEN               0x00
+#define REG_THROT               0x10
+#define REG_COUNT               0x14
+#define REG_BUSPD               0x18
+#define REG_SECHI               0x20
+#define REG_SECLO               0x24
+#define REG_NSEC                0x28
+struct jcore_pit {
+        struct clock_event_device       ced;
+        void __iomem                    *base;
+        unsigned long                   periodic_delta;
+        u32                             enable_val;
+};
+static void __iomem *jcore_pit_base;
+static struct jcore_pit __percpu *jcore_pit_percpu;
+static notrace u64 jcore_sched_clock_read(void)
+{
+        u32 seclo, nsec, seclo0;
+        __iomem void *base = jcore_pit_base;
+        seclo = readl(base + REG_SECLO);
+        do {
+                seclo0 = seclo;
+                nsec  = readl(base + REG_NSEC);
+                seclo = readl(base + REG_SECLO);
+        } while (seclo0 != seclo);
+        return seclo * NSEC_PER_SEC + nsec;
+}
+static cycle_t jcore_clocksource_read(struct clocksource *cs)
+{
+        return jcore_sched_clock_read();
+}
+static int jcore_pit_disable(struct jcore_pit *pit)
+{
+        writel(0, pit->base + REG_PITEN);
+        return 0;
+}
+static int jcore_pit_set(unsigned long delta, struct jcore_pit *pit)
+{
+        jcore_pit_disable(pit);
+        writel(delta, pit->base + REG_THROT);
+        writel(pit->enable_val, pit->base + REG_PITEN);
+        return 0;
+}
+static int jcore_pit_set_state_shutdown(struct clock_event_device *ced)
+{
+        struct jcore_pit *pit = container_of(ced, struct jcore_pit, ced);
+        return jcore_pit_disable(pit);
+}
+static int jcore_pit_set_state_oneshot(struct clock_event_device *ced)
+{
+        struct jcore_pit *pit = container_of(ced, struct jcore_pit, ced);
+        return jcore_pit_disable(pit);
+}
+static int jcore_pit_set_state_periodic(struct clock_event_device *ced)
+{
+        struct jcore_pit *pit = container_of(ced, struct jcore_pit, ced);
+        return jcore_pit_set(pit->periodic_delta, pit);
+}
+static int jcore_pit_set_next_event(unsigned long delta,
+                                    struct clock_event_device *ced)
+{
+        struct jcore_pit *pit = container_of(ced, struct jcore_pit, ced);
+        return jcore_pit_set(delta, pit);
+}
+static int jcore_pit_local_init(unsigned cpu)
+{
+        struct jcore_pit *pit = this_cpu_ptr(jcore_pit_percpu);
+        unsigned buspd, freq;
+        pr_info("Local J-Core PIT init on cpu %u\n", cpu);
+        buspd = readl(pit->base + REG_BUSPD);
+        freq = DIV_ROUND_CLOSEST(NSEC_PER_SEC, buspd);
+        pit->periodic_delta = DIV_ROUND_CLOSEST(NSEC_PER_SEC, HZ * buspd);
+        clockevents_config_and_register(&pit->ced, freq, 1, ULONG_MAX);
+        return 0;
+}
+static irqreturn_t jcore_timer_interrupt(int irq, void *dev_id)
+{
+        struct jcore_pit *pit = this_cpu_ptr(dev_id);
+        if (clockevent_state_oneshot(&pit->ced))
+                jcore_pit_disable(pit);
+        pit->ced.event_handler(&pit->ced);
+        return IRQ_HANDLED;
+}
+static int __init jcore_pit_init(struct device_node *node)
+{
+        int err;
+        unsigned pit_irq, cpu;
+        unsigned long hwirq;
+        u32 irqprio, enable_val;
+        jcore_pit_base = of_iomap(node, 0);
+        if (!jcore_pit_base) {
+                pr_err("Error: Cannot map base address for J-Core PIT\n");
+                return -ENXIO;
+        }
+        pit_irq = irq_of_parse_and_map(node, 0);
+        if (!pit_irq) {
+                pr_err("Error: J-Core PIT has no IRQ\n");
+                return -ENXIO;
+        }
+        pr_info("Initializing J-Core PIT at %p IRQ %d\n",
+                jcore_pit_base, pit_irq);
+        err = clocksource_mmio_init(jcore_pit_base, "jcore_pit_cs",
+                                    NSEC_PER_SEC, 400, 32,
+                                    jcore_clocksource_read);
+        if (err) {
+                pr_err("Error registering clocksource device: %d\n", err);
+                return err;
+        }
+        sched_clock_register(jcore_sched_clock_read, 32, NSEC_PER_SEC);
+        jcore_pit_percpu = alloc_percpu(struct jcore_pit);
+        if (!jcore_pit_percpu) {
+                pr_err("Failed to allocate memory for clock event device\n");
+                return -ENOMEM;
+        }
+        err = request_irq(pit_irq, jcore_timer_interrupt,
+                          IRQF_TIMER | IRQF_PERCPU,
+                          "jcore_pit", jcore_pit_percpu);
+        if (err) {
+                pr_err("pit irq request failed: %d\n", err);
+                free_percpu(jcore_pit_percpu);
+                return err;
+        }
+        /*
+         * The J-Core PIT is not hard-wired to a particular IRQ, but
+         * integrated with the interrupt controller such that the IRQ it
+         * generates is programmable, as follows:
+         *
+         * The bit layout of the PIT enable register is:
+         *
+         *      .....e..ppppiiiiiiii............
+         *
+         * where the .'s indicate unrelated/unused bits, e is enable,
+         * p is priority, and i is hard irq number.
+         *
+         * For the PIT included in AIC1 (obsolete but still in use),
+         * any hard irq (trap number) can be programmed via the 8
+         * iiiiiiii bits, and a priority (0-15) is programmable
+         * separately in the pppp bits.
+         *
+         * For the PIT included in AIC2 (current), the programming
+         * interface is equivalent modulo interrupt mapping. This is
+         * why a different compatible tag was not used. However only
+         * traps 64-127 (the ones actually intended to be used for
+         * interrupts, rather than syscalls/exceptions/etc.) can be
+         * programmed (the high 2 bits of i are ignored) and the
+         * priority pppp is <<2'd and or'd onto the irq number. This
+         * choice seems to have been made on the hardware engineering
+         * side under an assumption that preserving old AIC1 priority
+         * mappings was important. Future models will likely ignore
+         * the pppp field.
+         */
+        hwirq = irq_get_irq_data(pit_irq)->hwirq;
+        irqprio = (hwirq >> 2) & PIT_PRIO_MASK;
+        enable_val = (1U << PIT_ENABLE_SHIFT)
+                   | (hwirq << PIT_IRQ_SHIFT)
+                   | (irqprio << PIT_PRIO_SHIFT);
+        for_each_present_cpu(cpu) {
+                struct jcore_pit *pit = per_cpu_ptr(jcore_pit_percpu, cpu);
+                pit->base = of_iomap(node, cpu);
+                if (!pit->base) {
+                        pr_err("Unable to map PIT for cpu %u\n", cpu);
+                        continue;
+                }
+                pit->ced.name = "jcore_pit";
+                pit->ced.features = CLOCK_EVT_FEAT_PERIODIC
+                                  | CLOCK_EVT_FEAT_ONESHOT
+                                  | CLOCK_EVT_FEAT_PERCPU;
+                pit->ced.cpumask = cpumask_of(cpu);
+                pit->ced.rating = 400;
+                pit->ced.irq = pit_irq;
+                pit->ced.set_state_shutdown = jcore_pit_set_state_shutdown;
+                pit->ced.set_state_periodic = jcore_pit_set_state_periodic;
+                pit->ced.set_state_oneshot = jcore_pit_set_state_oneshot;
+                pit->ced.set_next_event = jcore_pit_set_next_event;
+                pit->enable_val = enable_val;
+        }
+        cpuhp_setup_state(CPUHP_AP_JCORE_TIMER_STARTING,
+                          "AP_JCORE_TIMER_STARTING",
+                          jcore_pit_local_init, NULL);
+        return 0;
+}
+CLOCKSOURCE_OF_DECLARE(jcore_pit, "jcore,pit", jcore_pit_init);
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index c184eb84101e..4f87f3e76d83 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -152,6 +152,13 @@ static irqreturn_t sun5i_timer_interrupt(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
+static cycle_t sun5i_clksrc_read(struct clocksource *clksrc)
+{
+        struct sun5i_timer_clksrc *cs = to_sun5i_timer_clksrc(clksrc);
+        return ~readl(cs->timer.base + TIMER_CNTVAL_LO_REG(1));
+}
 static int sun5i_rate_cb_clksrc(struct notifier_block *nb,
                                unsigned long event, void *data)
 {
@@ -210,8 +217,13 @@ static int __init sun5i_setup_clocksource(struct device_node *node,
        writel(TIMER_CTL_ENABLE | TIMER_CTL_RELOAD,
               base + TIMER_CTL_REG(1));
-        ret = clocksource_mmio_init(base + TIMER_CNTVAL_LO_REG(1), node->name,
+        cs->clksrc.name = node->name;
-                                    rate, 340, 32, clocksource_mmio_readl_down);
+        cs->clksrc.rating = 340;
+        cs->clksrc.read = sun5i_clksrc_read;
+        cs->clksrc.mask = CLOCKSOURCE_MASK(32);
+        cs->clksrc.flags = CLOCK_SOURCE_IS_CONTINUOUS;
+        ret = clocksource_register_hz(&cs->clksrc, rate);
        if (ret) {
                pr_err("Couldn't register clock source.\n");
                goto err_remove_notifier;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index f535f8123258..4737520ec823 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -179,6 +179,7 @@ struct _pid {
 /**
 * struct cpudata -     Per CPU instance data storage
 * @cpu:                CPU number for this instance data
+ * @policy:             CPUFreq policy value
 * @update_util:        CPUFreq utility callback information
 * @update_util_set:    CPUFreq utility callback is set
 * @iowait_boost:       iowait-related boost fraction
@@ -201,6 +202,7 @@ struct _pid {
 struct cpudata {
        int cpu;
+        unsigned int policy;
        struct update_util_data update_util;
        bool   update_util_set;
@@ -1142,10 +1144,8 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
        *min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf);
 }
-static void intel_pstate_set_min_pstate(struct cpudata *cpu)
+static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
 {
-        int pstate = cpu->pstate.min_pstate;
        trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu);
        cpu->pstate.current_pstate = pstate;
        /*
@@ -1157,6 +1157,20 @@ static void intel_pstate_set_min_pstate(struct cpudata *cpu)
                      pstate_funcs.get_val(cpu, pstate));
 }
+static void intel_pstate_set_min_pstate(struct cpudata *cpu)
+{
+        intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
+}
+static void intel_pstate_max_within_limits(struct cpudata *cpu)
+{
+        int min_pstate, max_pstate;
+        update_turbo_state();
+        intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate);
+        intel_pstate_set_pstate(cpu, max_pstate);
+}
 static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
 {
        cpu->pstate.min_pstate = pstate_funcs.get_min();
@@ -1325,7 +1339,8 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
        from = cpu->pstate.current_pstate;
-        target_pstate = pstate_funcs.get_target_pstate(cpu);
+        target_pstate = cpu->policy == CPUFREQ_POLICY_PERFORMANCE ?
+                cpu->pstate.turbo_pstate : pstate_funcs.get_target_pstate(cpu);
        intel_pstate_update_pstate(cpu, target_pstate);
@@ -1491,7 +1506,9 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
        pr_debug("set_policy cpuinfo.max %u policy->max %u\n",
                 policy->cpuinfo.max_freq, policy->max);
-        cpu = all_cpu_data[0];
+        cpu = all_cpu_data[policy->cpu];
+        cpu->policy = policy->policy;
        if (cpu->pstate.max_pstate_physical > cpu->pstate.max_pstate &&
            policy->max < policy->cpuinfo.max_freq &&
            policy->max > cpu->pstate.max_pstate * cpu->pstate.scaling) {
@@ -1499,7 +1516,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
                policy->max = policy->cpuinfo.max_freq;
        }
-        if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) {
+        if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) {
                limits = &performance_limits;
                if (policy->max >= policy->cpuinfo.max_freq) {
                        pr_debug("set performance\n");
@@ -1535,6 +1552,15 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
        limits->max_perf = round_up(limits->max_perf, FRAC_BITS);
 out:
+        if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) {
+                /*
+                 * NOHZ_FULL CPUs need this as the governor callback may not
+                 * be invoked on them.
+                 */
+                intel_pstate_clear_update_util_hook(policy->cpu);
+                intel_pstate_max_within_limits(cpu);
+        }
        intel_pstate_set_update_util_hook(policy->cpu);
        intel_pstate_hwp_set_policy(policy);
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 156aad167cd6..954a64c7757b 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -137,7 +137,7 @@ static void dbg_dump_sg(const char *level, const char *prefix_str,
                }
                buf = it_page + it->offset;
-                len = min(tlen, it->length);
+                len = min_t(size_t, tlen, it->length);
                print_hex_dump(level, prefix_str, prefix_type, rowsize,
                               groupsize, buf, len, ascii);
                tlen -= len;
@@ -4583,6 +4583,15 @@ static int __init caam_algapi_init(void)
                if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES))
                                continue;
+                /*
+                 * Check support for AES modes not available
+                 * on LP devices.
+                 */
+                if ((cha_vid & CHA_ID_LS_AES_MASK) == CHA_ID_LS_AES_LP)
+                        if ((alg->class1_alg_type & OP_ALG_AAI_MASK) ==
+                             OP_ALG_AAI_XTS)
+                                continue;
                t_alg = caam_alg_alloc(alg);
                if (IS_ERR(t_alg)) {
                        err = PTR_ERR(t_alg);
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index 72ff19658985..e483b78c6343 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -558,8 +558,9 @@ static int caam_probe(struct platform_device *pdev)
         * Enable DECO watchdogs and, if this is a PHYS_ADDR_T_64BIT kernel,
         * long pointers in master configuration register
         */
-        clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK, MCFGR_AWCACHE_CACH |
+        clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK | MCFGR_LONG_PTR,
-                      MCFGR_AWCACHE_BUFF | MCFGR_WDENABLE | MCFGR_LARGE_BURST |
+                      MCFGR_AWCACHE_CACH | MCFGR_AWCACHE_BUFF |
+                      MCFGR_WDENABLE | MCFGR_LARGE_BURST |
                      (sizeof(dma_addr_t) == sizeof(u64) ? MCFGR_LONG_PTR : 0));
        /*
diff --git a/drivers/crypto/chelsio/chcr_algo.h b/drivers/crypto/chelsio/chcr_algo.h
index ec64fbcdeb49..199b0bb69b89 100644
--- a/drivers/crypto/chelsio/chcr_algo.h
+++ b/drivers/crypto/chelsio/chcr_algo.h
@@ -422,7 +422,7 @@ static inline void get_aes_decrypt_key(unsigned char *dec_key,
 {
        u32 temp;
        u32 w_ring[MAX_NK];
-        int i, j, k = 0;
+        int i, j, k;
        u8  nr, nk;
        switch (keylength) {
@@ -460,6 +460,7 @@ static inline void get_aes_decrypt_key(unsigned char *dec_key,
                temp = w_ring[i % nk];
                i++;
        }
+        i--;
        for (k = 0, j = i % nk; k < nk; k++) {
                *((u32 *)dec_key + k) = htonl(w_ring[j]);
                j--;
diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
index 9f284682c091..77712b375b84 100644
--- a/drivers/crypto/marvell/hash.c
+++ b/drivers/crypto/marvell/hash.c
@@ -168,12 +168,11 @@ static void mv_cesa_ahash_std_step(struct ahash_request *req)
        mv_cesa_adjust_op(engine, &creq->op_tmpl);
        memcpy_toio(engine->sram, &creq->op_tmpl, sizeof(creq->op_tmpl));
-        digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(req));
+        if (!sreq->offset) {
-        for (i = 0; i < digsize / 4; i++)
+                digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(req));
-                writel_relaxed(creq->state[i], engine->regs + CESA_IVDIG(i));
+                for (i = 0; i < digsize / 4; i++)
+                        writel_relaxed(creq->state[i], engine->regs + CESA_IVDIG(i));
-        mv_cesa_adjust_op(engine, &creq->op_tmpl);
+        }
-        memcpy_toio(engine->sram, &creq->op_tmpl, sizeof(creq->op_tmpl));
        if (creq->cache_ptr)
                memcpy_toio(engine->sram + CESA_SA_DATA_SRAM_OFFSET,
diff --git a/drivers/dax/Kconfig b/drivers/dax/Kconfig
index daadd20aa936..3e2ab3b14eea 100644
--- a/drivers/dax/Kconfig
+++ b/drivers/dax/Kconfig
@@ -14,7 +14,7 @@ if DEV_DAX
 config DEV_DAX_PMEM
        tristate "PMEM DAX: direct access to persistent memory"
-        depends on NVDIMM_DAX
+        depends on LIBNVDIMM && NVDIMM_DAX
        default DEV_DAX
        help
          Support raw access to persistent memory.  Note that this
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 0e499bfca41c..286447a83dab 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -270,8 +270,8 @@ static int check_vma(struct dax_dev *dax_dev, struct vm_area_struct *vma,
        if (!dax_dev->alive)
                return -ENXIO;
-        /* prevent private / writable mappings from being established */
+        /* prevent private mappings from being established */
-        if ((vma->vm_flags & (VM_NORESERVE|VM_SHARED|VM_WRITE)) == VM_WRITE) {
+        if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) {
                dev_info(dev, "%s: %s: fail, attempted private mapping\n",
                                current->comm, func);
                return -EINVAL;
diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
index 9630d8837ba9..73c6ce93a0d9 100644
--- a/drivers/dax/pmem.c
+++ b/drivers/dax/pmem.c
@@ -44,7 +44,6 @@ static void dax_pmem_percpu_exit(void *data)
        dev_dbg(dax_pmem->dev, "%s\n", __func__);
        percpu_ref_exit(ref);
-        wait_for_completion(&dax_pmem->cmp);
 }
 static void dax_pmem_percpu_kill(void *data)
@@ -54,6 +53,7 @@ static void dax_pmem_percpu_kill(void *data)
        dev_dbg(dax_pmem->dev, "%s\n", __func__);
        percpu_ref_kill(ref);
+        wait_for_completion(&dax_pmem->cmp);
 }
 static int dax_pmem_probe(struct device *dev)
@@ -78,7 +78,9 @@ static int dax_pmem_probe(struct device *dev)
        nsio = to_nd_namespace_io(&ndns->dev);
        /* parse the 'pfn' info block via ->rw_bytes */
-        devm_nsio_enable(dev, nsio);
+        rc = devm_nsio_enable(dev, nsio);
+        if (rc)
+                return rc;
        altmap = nvdimm_setup_pfn(nd_pfn, &res, &__altmap);
        if (IS_ERR(altmap))
                return PTR_ERR(altmap);
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index af63a6bcf564..141aefbe37ec 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -306,6 +306,7 @@ config MMP_TDMA
        depends on ARCH_MMP || COMPILE_TEST
        select DMA_ENGINE
        select MMP_SRAM if ARCH_MMP
+        select GENERIC_ALLOCATOR
        help
          Support the MMP Two-Channel DMA engine.
          This engine used for MMP Audio DMA and pxa910 SQU.
diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
index bac5f023013b..d5ba43a87a68 100644
--- a/drivers/dma/cppi41.c
+++ b/drivers/dma/cppi41.c
@@ -317,6 +317,12 @@ static irqreturn_t cppi41_irq(int irq, void *data)
                while (val) {
                        u32 desc, len;
+                        int error;
+                        error = pm_runtime_get(cdd->ddev.dev);
+                        if (error < 0)
+                                dev_err(cdd->ddev.dev, "%s pm runtime get: %i\n",
+                                        __func__, error);
                        q_num = __fls(val);
                        val &= ~(1 << q_num);
@@ -338,7 +344,6 @@ static irqreturn_t cppi41_irq(int irq, void *data)
                        dma_cookie_complete(&c->txd);
                        dmaengine_desc_get_callback_invoke(&c->txd, NULL);
-                        /* Paired with cppi41_dma_issue_pending */
                        pm_runtime_mark_last_busy(cdd->ddev.dev);
                        pm_runtime_put_autosuspend(cdd->ddev.dev);
                }
@@ -362,8 +367,13 @@ static int cppi41_dma_alloc_chan_resources(struct dma_chan *chan)
        int error;
        error = pm_runtime_get_sync(cdd->ddev.dev);
-        if (error < 0)
+        if (error < 0) {
+                dev_err(cdd->ddev.dev, "%s pm runtime get: %i\n",
+                        __func__, error);
+                pm_runtime_put_noidle(cdd->ddev.dev);
                return error;
+        }
        dma_cookie_init(chan);
        dma_async_tx_descriptor_init(&c->txd, chan);
@@ -385,8 +395,11 @@ static void cppi41_dma_free_chan_resources(struct dma_chan *chan)
        int error;
        error = pm_runtime_get_sync(cdd->ddev.dev);
-        if (error < 0)
+        if (error < 0) {
+                pm_runtime_put_noidle(cdd->ddev.dev);
                return;
+        }
        WARN_ON(!list_empty(&cdd->pending));
@@ -460,9 +473,9 @@ static void cppi41_dma_issue_pending(struct dma_chan *chan)
        struct cppi41_dd *cdd = c->cdd;
        int error;
-        /* PM runtime paired with dmaengine_desc_get_callback_invoke */
        error = pm_runtime_get(cdd->ddev.dev);
        if ((error != -EINPROGRESS) && error < 0) {
+                pm_runtime_put_noidle(cdd->ddev.dev);
                dev_err(cdd->ddev.dev, "Failed to pm_runtime_get: %i\n",
                        error);
@@ -473,6 +486,9 @@ static void cppi41_dma_issue_pending(struct dma_chan *chan)
                push_desc_queue(c);
        else
                pending_desc(c);
+        pm_runtime_mark_last_busy(cdd->ddev.dev);
+        pm_runtime_put_autosuspend(cdd->ddev.dev);
 }
 static u32 get_host_pd0(u32 length)
@@ -1059,8 +1075,8 @@ err_chans:
        deinit_cppi41(dev, cdd);
 err_init_cppi:
        pm_runtime_dont_use_autosuspend(dev);
-        pm_runtime_put_sync(dev);
 err_get_sync:
+        pm_runtime_put_sync(dev);
        pm_runtime_disable(dev);
        iounmap(cdd->usbss_mem);
        iounmap(cdd->ctrl_mem);
@@ -1072,7 +1088,12 @@ err_get_sync:
 static int cppi41_dma_remove(struct platform_device *pdev)
 {
        struct cppi41_dd *cdd = platform_get_drvdata(pdev);
+        int error;
+        error = pm_runtime_get_sync(&pdev->dev);
+        if (error < 0)
+                dev_err(&pdev->dev, "%s could not pm_runtime_get: %i\n",
+                        __func__, error);
        of_dma_controller_free(pdev->dev.of_node);
        dma_async_device_unregister(&cdd->ddev);
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index e18a58068bca..77242b37ef87 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -1628,6 +1628,7 @@ static int edma_alloc_chan_resources(struct dma_chan *chan)
        if (echan->slot[0] < 0) {
                dev_err(dev, "Entry slot allocation failed for channel %u\n",
                        EDMA_CHAN_SLOT(echan->ch_num));
+                ret = echan->slot[0];
                goto err_slot;
        }
diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
index 83461994e418..a2358780ab2c 100644
--- a/drivers/dma/sun6i-dma.c
+++ b/drivers/dma/sun6i-dma.c
@@ -578,7 +578,7 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
        burst = convert_burst(8);
        width = convert_buswidth(DMA_SLAVE_BUSWIDTH_4_BYTES);
-        v_lli->cfg |= DMA_CHAN_CFG_SRC_DRQ(DRQ_SDRAM) |
+        v_lli->cfg = DMA_CHAN_CFG_SRC_DRQ(DRQ_SDRAM) |
                DMA_CHAN_CFG_DST_DRQ(DRQ_SDRAM) |
                DMA_CHAN_CFG_DST_LINEAR_MODE |
                DMA_CHAN_CFG_SRC_LINEAR_MODE |
diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
index 56e6c4c7c60d..d836d4ce5ee4 100644
--- a/drivers/extcon/extcon-arizona.c
+++ b/drivers/extcon/extcon-arizona.c
@@ -274,9 +274,10 @@ static void arizona_extcon_pulse_micbias(struct arizona_extcon_info *info)
        struct arizona *arizona = info->arizona;
        const char *widget = arizona_extcon_get_micbias(info);
        struct snd_soc_dapm_context *dapm = arizona->dapm;
+        struct snd_soc_component *component = snd_soc_dapm_to_component(dapm);
        int ret;
-        ret = snd_soc_dapm_force_enable_pin(dapm, widget);
+        ret = snd_soc_component_force_enable_pin(component, widget);
        if (ret != 0)
                dev_warn(arizona->dev, "Failed to enable %s: %d\n",
                         widget, ret);
@@ -284,7 +285,7 @@ static void arizona_extcon_pulse_micbias(struct arizona_extcon_info *info)
        snd_soc_dapm_sync(dapm);
        if (!arizona->pdata.micd_force_micbias) {
-                ret = snd_soc_dapm_disable_pin(arizona->dapm, widget);
+                ret = snd_soc_component_disable_pin(component, widget);
                if (ret != 0)
                        dev_warn(arizona->dev, "Failed to disable %s: %d\n",
                                 widget, ret);
@@ -349,6 +350,7 @@ static void arizona_stop_mic(struct arizona_extcon_info *info)
        struct arizona *arizona = info->arizona;
        const char *widget = arizona_extcon_get_micbias(info);
        struct snd_soc_dapm_context *dapm = arizona->dapm;
+        struct snd_soc_component *component = snd_soc_dapm_to_component(dapm);
        bool change;
        int ret;
@@ -356,7 +358,7 @@ static void arizona_stop_mic(struct arizona_extcon_info *info)
                                 ARIZONA_MICD_ENA, 0,
                                 &change);
-        ret = snd_soc_dapm_disable_pin(dapm, widget);
+        ret = snd_soc_component_disable_pin(component, widget);
        if (ret != 0)
                dev_warn(arizona->dev,
                         "Failed to disable %s: %d\n",
diff --git a/drivers/extcon/extcon-qcom-spmi-misc.c b/drivers/extcon/extcon-qcom-spmi-misc.c
index ca957a5f4291..b8cde096a808 100644
--- a/drivers/extcon/extcon-qcom-spmi-misc.c
+++ b/drivers/extcon/extcon-qcom-spmi-misc.c
@@ -51,7 +51,7 @@ static void qcom_usb_extcon_detect_cable(struct work_struct *work)
        if (ret)
                return;
-        extcon_set_state(info->edev, EXTCON_USB_HOST, !id);
+        extcon_set_state_sync(info->edev, EXTCON_USB_HOST, !id);
 }
 static irqreturn_t qcom_usb_irq_handler(int irq, void *dev_id)
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 309311b1faae..15475892af0c 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -73,13 +73,13 @@ struct rfc2734_header {
 #define fwnet_get_hdr_lf(h)             (((h)->w0 & 0xc0000000) >> 30)
 #define fwnet_get_hdr_ether_type(h)     (((h)->w0 & 0x0000ffff))
-#define fwnet_get_hdr_dg_size(h)        (((h)->w0 & 0x0fff0000) >> 16)
+#define fwnet_get_hdr_dg_size(h)        ((((h)->w0 & 0x0fff0000) >> 16) + 1)
 #define fwnet_get_hdr_fg_off(h)         (((h)->w0 & 0x00000fff))
 #define fwnet_get_hdr_dgl(h)            (((h)->w1 & 0xffff0000) >> 16)
-#define fwnet_set_hdr_lf(lf)            ((lf)  << 30)
+#define fwnet_set_hdr_lf(lf)            ((lf) << 30)
 #define fwnet_set_hdr_ether_type(et)    (et)
-#define fwnet_set_hdr_dg_size(dgs)      ((dgs) << 16)
+#define fwnet_set_hdr_dg_size(dgs)      (((dgs) - 1) << 16)
 #define fwnet_set_hdr_fg_off(fgo)       (fgo)
 #define fwnet_set_hdr_dgl(dgl)          ((dgl) << 16)
@@ -578,6 +578,9 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
        int retval;
        u16 ether_type;
+        if (len <= RFC2374_UNFRAG_HDR_SIZE)
+                return 0;
        hdr.w0 = be32_to_cpu(buf[0]);
        lf = fwnet_get_hdr_lf(&hdr);
        if (lf == RFC2374_HDR_UNFRAG) {
@@ -602,7 +605,12 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
                return fwnet_finish_incoming_packet(net, skb, source_node_id,
                                                    is_broadcast, ether_type);
        }
        /* A datagram fragment has been received, now the fun begins. */
+        if (len <= RFC2374_FRAG_HDR_SIZE)
+                return 0;
        hdr.w1 = ntohl(buf[1]);
        buf += 2;
        len -= RFC2374_FRAG_HDR_SIZE;
@@ -614,7 +622,10 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
                fg_off = fwnet_get_hdr_fg_off(&hdr);
        }
        datagram_label = fwnet_get_hdr_dgl(&hdr);
-        dg_size = fwnet_get_hdr_dg_size(&hdr); /* ??? + 1 */
+        dg_size = fwnet_get_hdr_dg_size(&hdr);
+        if (fg_off + len > dg_size)
+                return 0;
        spin_lock_irqsave(&dev->lock, flags);
@@ -722,6 +733,22 @@ static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r,
        fw_send_response(card, r, rcode);
 }
+static int gasp_source_id(__be32 *p)
+{
+        return be32_to_cpu(p[0]) >> 16;
+}
+static u32 gasp_specifier_id(__be32 *p)
+{
+        return (be32_to_cpu(p[0]) & 0xffff) << 8 |
+               (be32_to_cpu(p[1]) & 0xff000000) >> 24;
+}
+static u32 gasp_version(__be32 *p)
+{
+        return be32_to_cpu(p[1]) & 0xffffff;
+}
 static void fwnet_receive_broadcast(struct fw_iso_context *context,
                u32 cycle, size_t header_length, void *header, void *data)
 {
@@ -731,9 +758,6 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
        __be32 *buf_ptr;
        int retval;
        u32 length;
-        u16 source_node_id;
-        u32 specifier_id;
-        u32 ver;
        unsigned long offset;
        unsigned long flags;
@@ -750,22 +774,17 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
        spin_unlock_irqrestore(&dev->lock, flags);
-        specifier_id =    (be32_to_cpu(buf_ptr[0]) & 0xffff) << 8
+        if (length > IEEE1394_GASP_HDR_SIZE &&
-                        | (be32_to_cpu(buf_ptr[1]) & 0xff000000) >> 24;
+            gasp_specifier_id(buf_ptr) == IANA_SPECIFIER_ID &&
-        ver = be32_to_cpu(buf_ptr[1]) & 0xffffff;
+            (gasp_version(buf_ptr) == RFC2734_SW_VERSION
-        source_node_id = be32_to_cpu(buf_ptr[0]) >> 16;
-        if (specifier_id == IANA_SPECIFIER_ID &&
-            (ver == RFC2734_SW_VERSION
 #if IS_ENABLED(CONFIG_IPV6)
-             || ver == RFC3146_SW_VERSION
+             || gasp_version(buf_ptr) == RFC3146_SW_VERSION
 #endif
-            )) {
+            ))
-                buf_ptr += 2;
+                fwnet_incoming_packet(dev, buf_ptr + 2,
-                length -= IEEE1394_GASP_HDR_SIZE;
+                                      length - IEEE1394_GASP_HDR_SIZE,
-                fwnet_incoming_packet(dev, buf_ptr, length, source_node_id,
+                                      gasp_source_id(buf_ptr),
                                      context->card->generation, true);
-        }
        packet.payload_length = dev->rcv_buffer_size;
        packet.interrupt = 1;
diff --git a/drivers/firewire/nosy.c b/drivers/firewire/nosy.c
index 631c977b0da5..180f0a96528c 100644
--- a/drivers/firewire/nosy.c
+++ b/drivers/firewire/nosy.c
@@ -566,6 +566,11 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused)
        lynx->registers = ioremap_nocache(pci_resource_start(dev, 0),
                                          PCILYNX_MAX_REGISTER);
+        if (lynx->registers == NULL) {
+                dev_err(&dev->dev, "Failed to map registers\n");
+                ret = -ENOMEM;
+                goto fail_deallocate_lynx;
+        }
        lynx->rcv_start_pcl = pci_alloc_consistent(lynx->pci_device,
                                sizeof(struct pcl), &lynx->rcv_start_pcl_bus);
@@ -578,7 +583,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused)
            lynx->rcv_buffer == NULL) {
                dev_err(&dev->dev, "Failed to allocate receive buffer\n");
                ret = -ENOMEM;
-                goto fail_deallocate;
+                goto fail_deallocate_buffers;
        }
        lynx->rcv_start_pcl->next       = cpu_to_le32(lynx->rcv_pcl_bus);
        lynx->rcv_pcl->next             = cpu_to_le32(PCL_NEXT_INVALID);
@@ -641,7 +646,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused)
                dev_err(&dev->dev,
                        "Failed to allocate shared interrupt %d\n", dev->irq);
                ret = -EIO;
-                goto fail_deallocate;
+                goto fail_deallocate_buffers;
        }
        lynx->misc.parent = &dev->dev;
@@ -668,7 +673,7 @@ fail_free_irq:
        reg_write(lynx, PCI_INT_ENABLE, 0);
        free_irq(lynx->pci_device->irq, lynx);
-fail_deallocate:
+fail_deallocate_buffers:
        if (lynx->rcv_start_pcl)
                pci_free_consistent(lynx->pci_device, sizeof(struct pcl),
                                lynx->rcv_start_pcl, lynx->rcv_start_pcl_bus);
@@ -679,6 +684,8 @@ fail_deallocate:
                pci_free_consistent(lynx->pci_device, PAGE_SIZE,
                                lynx->rcv_buffer, lynx->rcv_buffer_bus);
        iounmap(lynx->registers);
+fail_deallocate_lynx:
        kfree(lynx);
 fail_disable:
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index c06945160a41..5e23e2d305e7 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -11,7 +11,7 @@ cflags-$(CONFIG_X86)		+= -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2 \
                                   -mno-mmx -mno-sse
 cflags-$(CONFIG_ARM64)          := $(subst -pg,,$(KBUILD_CFLAGS))
-cflags-$(CONFIG_ARM)            := $(subst -pg,,$(KBUILD_CFLAGS)) \
+cflags-$(CONFIG_ARM)            := $(subst -pg,,$(KBUILD_CFLAGS)) -g0 \
                                   -fno-builtin -fpic -mno-single-pic-base
 cflags-$(CONFIG_EFI_ARMSTUB)    += -I$(srctree)/scripts/dtc/libfdt
@@ -79,5 +79,6 @@ quiet_cmd_stubcopy = STUBCPY $@
 # decompressor. So move our .data to .data.efistub, which is preserved
 # explicitly by the decompressor linker script.
 #
-STUBCOPY_FLAGS-$(CONFIG_ARM)    += --rename-section .data=.data.efistub
+STUBCOPY_FLAGS-$(CONFIG_ARM)    += --rename-section .data=.data.efistub \
+                                   -R ___ksymtab+sort -R ___kcrctab+sort
 STUBCOPY_RELOC-$(CONFIG_ARM)    := R_ARM_ABS
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 26ee00f6bd58..ed37e5908b91 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -22,10 +22,6 @@ menuconfig GPIOLIB
 if GPIOLIB
-config GPIO_DEVRES
-        def_bool y
-        depends on HAS_IOMEM
 config OF_GPIO
        def_bool y
        depends on OF
@@ -284,7 +280,7 @@ config GPIO_MM_LANTIQ
 config GPIO_MOCKUP
        tristate "GPIO Testing Driver"
-        depends on GPIOLIB
+        depends on GPIOLIB && SYSFS
        select GPIO_SYSFS
        help
          This enables GPIO Testing driver, which provides a way to test GPIO
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index ab28a2daeacc..d074c2299393 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -2,7 +2,7 @@
 ccflags-$(CONFIG_DEBUG_GPIO)    += -DDEBUG
-obj-$(CONFIG_GPIO_DEVRES)       += devres.o
+obj-$(CONFIG_GPIOLIB)           += devres.o
 obj-$(CONFIG_GPIOLIB)           += gpiolib.o
 obj-$(CONFIG_GPIOLIB)           += gpiolib-legacy.o
 obj-$(CONFIG_OF_GPIO)           += gpiolib-of.o
diff --git a/drivers/gpio/gpio-ath79.c b/drivers/gpio/gpio-ath79.c
index 9457e2022bf6..dc37dbe4b46d 100644
--- a/drivers/gpio/gpio-ath79.c
+++ b/drivers/gpio/gpio-ath79.c
@@ -219,6 +219,7 @@ static const struct of_device_id ath79_gpio_of_match[] = {
        { .compatible = "qca,ar9340-gpio" },
        {},
 };
+MODULE_DEVICE_TABLE(of, ath79_gpio_of_match);
 static int ath79_gpio_probe(struct platform_device *pdev)
 {
diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index 425501c39527..793518a30afe 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -239,7 +239,7 @@ static int mpc8xxx_gpio_irq_map(struct irq_domain *h, unsigned int irq,
                                irq_hw_number_t hwirq)
 {
        irq_set_chip_data(irq, h->host_data);
-        irq_set_chip_and_handler(irq, &mpc8xxx_irq_chip, handle_level_irq);
+        irq_set_chip_and_handler(irq, &mpc8xxx_irq_chip, handle_edge_irq);
        return 0;
 }
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index cd5dc27320a2..1ed6132b993c 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -293,10 +293,10 @@ static void mvebu_gpio_irq_ack(struct irq_data *d)
 {
        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
        struct mvebu_gpio_chip *mvchip = gc->private;
-        u32 mask = ~(1 << (d->irq - gc->irq_base));
+        u32 mask = d->mask;
        irq_gc_lock(gc);
-        writel_relaxed(mask, mvebu_gpioreg_edge_cause(mvchip));
+        writel_relaxed(~mask, mvebu_gpioreg_edge_cause(mvchip));
        irq_gc_unlock(gc);
 }
@@ -305,7 +305,7 @@ static void mvebu_gpio_edge_irq_mask(struct irq_data *d)
        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
        struct mvebu_gpio_chip *mvchip = gc->private;
        struct irq_chip_type *ct = irq_data_get_chip_type(d);
-        u32 mask = 1 << (d->irq - gc->irq_base);
+        u32 mask = d->mask;
        irq_gc_lock(gc);
        ct->mask_cache_priv &= ~mask;
@@ -319,8 +319,7 @@ static void mvebu_gpio_edge_irq_unmask(struct irq_data *d)
        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
        struct mvebu_gpio_chip *mvchip = gc->private;
        struct irq_chip_type *ct = irq_data_get_chip_type(d);
+        u32 mask = d->mask;
-        u32 mask = 1 << (d->irq - gc->irq_base);
        irq_gc_lock(gc);
        ct->mask_cache_priv |= mask;
@@ -333,8 +332,7 @@ static void mvebu_gpio_level_irq_mask(struct irq_data *d)
        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
        struct mvebu_gpio_chip *mvchip = gc->private;
        struct irq_chip_type *ct = irq_data_get_chip_type(d);
+        u32 mask = d->mask;
-        u32 mask = 1 << (d->irq - gc->irq_base);
        irq_gc_lock(gc);
        ct->mask_cache_priv &= ~mask;
@@ -347,8 +345,7 @@ static void mvebu_gpio_level_irq_unmask(struct irq_data *d)
        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
        struct mvebu_gpio_chip *mvchip = gc->private;
        struct irq_chip_type *ct = irq_data_get_chip_type(d);
+        u32 mask = d->mask;
-        u32 mask = 1 << (d->irq - gc->irq_base);
        irq_gc_lock(gc);
        ct->mask_cache_priv |= mask;
@@ -462,7 +459,7 @@ static void mvebu_gpio_irq_handler(struct irq_desc *desc)
        for (i = 0; i < mvchip->chip.ngpio; i++) {
                int irq;
-                irq = mvchip->irqbase + i;
+                irq = irq_find_mapping(mvchip->domain, i);
                if (!(cause & (1 << i)))
                        continue;
@@ -655,6 +652,7 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
        struct irq_chip_type *ct;
        struct clk *clk;
        unsigned int ngpios;
+        bool have_irqs;
        int soc_variant;
        int i, cpu, id;
        int err;
@@ -665,6 +663,9 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
        else
                soc_variant = MVEBU_GPIO_SOC_VARIANT_ORION;
+        /* Some gpio controllers do not provide irq support */
+        have_irqs = of_irq_count(np) != 0;
        mvchip = devm_kzalloc(&pdev->dev, sizeof(struct mvebu_gpio_chip),
                              GFP_KERNEL);
        if (!mvchip)
@@ -697,7 +698,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
        mvchip->chip.get = mvebu_gpio_get;
        mvchip->chip.direction_output = mvebu_gpio_direction_output;
        mvchip->chip.set = mvebu_gpio_set;
-        mvchip->chip.to_irq = mvebu_gpio_to_irq;
+        if (have_irqs)
+                mvchip->chip.to_irq = mvebu_gpio_to_irq;
        mvchip->chip.base = id * MVEBU_MAX_GPIO_PER_BANK;
        mvchip->chip.ngpio = ngpios;
        mvchip->chip.can_sleep = false;
@@ -758,34 +760,30 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
        devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
        /* Some gpio controllers do not provide irq support */
-        if (!of_irq_count(np))
+        if (!have_irqs)
                return 0;
-        /* Setup the interrupt handlers. Each chip can have up to 4
+        mvchip->domain =
-         * interrupt handlers, with each handler dealing with 8 GPIO
+            irq_domain_add_linear(np, ngpios, &irq_generic_chip_ops, NULL);
-         * pins. */
+        if (!mvchip->domain) {
-        for (i = 0; i < 4; i++) {
+                dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
-                int irq = platform_get_irq(pdev, i);
+                        mvchip->chip.label);
+                return -ENODEV;
-                if (irq < 0)
-                        continue;
-                irq_set_chained_handler_and_data(irq, mvebu_gpio_irq_handler,
-                                                 mvchip);
-        }
-        mvchip->irqbase = irq_alloc_descs(-1, 0, ngpios, -1);
-        if (mvchip->irqbase < 0) {
-                dev_err(&pdev->dev, "no irqs\n");
-                return mvchip->irqbase;
        }
-        gc = irq_alloc_generic_chip("mvebu_gpio_irq", 2, mvchip->irqbase,
+        err = irq_alloc_domain_generic_chips(
-                                    mvchip->membase, handle_level_irq);
+            mvchip->domain, ngpios, 2, np->name, handle_level_irq,
-        if (!gc) {
+            IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_LEVEL, 0, 0);
-                dev_err(&pdev->dev, "Cannot allocate generic irq_chip\n");
+        if (err) {
-                return -ENOMEM;
+                dev_err(&pdev->dev, "couldn't allocate irq chips %s (DT).\n",
+                        mvchip->chip.label);
+                goto err_domain;
        }
+        /* NOTE: The common accessors cannot be used because of the percpu
+         * access to the mask registers
+         */
+        gc = irq_get_domain_generic_chip(mvchip->domain, 0);
        gc->private = mvchip;
        ct = &gc->chip_types[0];
        ct->type = IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_LEVEL_LOW;
@@ -803,27 +801,23 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
        ct->handler = handle_edge_irq;
        ct->chip.name = mvchip->chip.label;
-        irq_setup_generic_chip(gc, IRQ_MSK(ngpios), 0,
+        /* Setup the interrupt handlers. Each chip can have up to 4
-                               IRQ_NOREQUEST, IRQ_LEVEL | IRQ_NOPROBE);
+         * interrupt handlers, with each handler dealing with 8 GPIO
+         * pins.
+         */
+        for (i = 0; i < 4; i++) {
+                int irq = platform_get_irq(pdev, i);
-        /* Setup irq domain on top of the generic chip. */
+                if (irq < 0)
-        mvchip->domain = irq_domain_add_simple(np, mvchip->chip.ngpio,
+                        continue;
-                                               mvchip->irqbase,
+                irq_set_chained_handler_and_data(irq, mvebu_gpio_irq_handler,
-                                               &irq_domain_simple_ops,
+                                                 mvchip);
-                                               mvchip);
-        if (!mvchip->domain) {
-                dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
-                        mvchip->chip.label);
-                err = -ENODEV;
-                goto err_generic_chip;
        }
        return 0;
-err_generic_chip:
+err_domain:
-        irq_remove_generic_chip(gc, IRQ_MSK(ngpios), IRQ_NOREQUEST,
+        irq_domain_remove(mvchip->domain);
-                                IRQ_LEVEL | IRQ_NOPROBE);
-        kfree(gc);
        return err;
 }
diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c
index b9daa0bf32a4..ee1724806f46 100644
--- a/drivers/gpio/gpio-mxs.c
+++ b/drivers/gpio/gpio-mxs.c
@@ -308,8 +308,10 @@ static int mxs_gpio_probe(struct platform_device *pdev)
        writel(~0U, port->base + PINCTRL_IRQSTAT(port) + MXS_CLR);
        irq_base = irq_alloc_descs(-1, 0, 32, numa_node_id());
-        if (irq_base < 0)
+        if (irq_base < 0) {
-                return irq_base;
+                err = irq_base;
+                goto out_iounmap;
+        }
        port->domain = irq_domain_add_legacy(np, 32, irq_base, 0,
                                             &irq_domain_simple_ops, NULL);
@@ -349,6 +351,8 @@ out_irqdomain_remove:
        irq_domain_remove(port->domain);
 out_irqdesc_free:
        irq_free_descs(irq_base, 32);
+out_iounmap:
+        iounmap(port->base);
        return err;
 }
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index e422568e14ad..fe731f094257 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -372,14 +372,15 @@ static void pca953x_gpio_set_multiple(struct gpio_chip *gc,
        bank_shift = fls((chip->gpio_chip.ngpio - 1) / BANK_SZ);
-        memcpy(reg_val, chip->reg_output, NBANK(chip));
        mutex_lock(&chip->i2c_lock);
+        memcpy(reg_val, chip->reg_output, NBANK(chip));
        for (bank = 0; bank < NBANK(chip); bank++) {
                bank_mask = mask[bank / sizeof(*mask)] >>
                           ((bank % sizeof(*mask)) * 8);
                if (bank_mask) {
                        bank_val = bits[bank / sizeof(*bits)] >>
                                  ((bank % sizeof(*bits)) * 8);
+                        bank_val &= bank_mask;
                        reg_val[bank] = (reg_val[bank] & ~bank_mask) | bank_val;
                }
        }
@@ -607,7 +608,6 @@ static int pca953x_irq_setup(struct pca953x_chip *chip,
        if (client->irq && irq_base != -1
                        && (chip->driver_data & PCA_INT)) {
                ret = pca953x_read_regs(chip,
                                        chip->regs->input, chip->irq_stat);
                if (ret)
diff --git a/drivers/gpio/gpio-stmpe.c b/drivers/gpio/gpio-stmpe.c
index e7d422a6b90b..5b0042776ec7 100644
--- a/drivers/gpio/gpio-stmpe.c
+++ b/drivers/gpio/gpio-stmpe.c
@@ -409,7 +409,7 @@ static irqreturn_t stmpe_gpio_irq(int irq, void *dev)
                 * 801/1801/1600, bits are cleared when read.
                 * Edge detect register is not present on 801/1600/1801
                 */
-                if (stmpe->partnum != STMPE801 || stmpe->partnum != STMPE1600 ||
+                if (stmpe->partnum != STMPE801 && stmpe->partnum != STMPE1600 &&
                    stmpe->partnum != STMPE1801) {
                        stmpe_reg_write(stmpe, statmsbreg + i, status[i]);
                        stmpe_reg_write(stmpe,
diff --git a/drivers/gpio/gpio-tc3589x.c b/drivers/gpio/gpio-tc3589x.c
index 5a5a6cb00eea..d6e21f1a70a9 100644
--- a/drivers/gpio/gpio-tc3589x.c
+++ b/drivers/gpio/gpio-tc3589x.c
@@ -97,7 +97,7 @@ static int tc3589x_gpio_get_direction(struct gpio_chip *chip,
        if (ret < 0)
                return ret;
-        return !!(ret & BIT(pos));
+        return !(ret & BIT(pos));
 }
 static int tc3589x_gpio_set_single_ended(struct gpio_chip *chip,
diff --git a/drivers/gpio/gpio-ts4800.c b/drivers/gpio/gpio-ts4800.c
index 99256115bea5..c2a80b4cbf32 100644
--- a/drivers/gpio/gpio-ts4800.c
+++ b/drivers/gpio/gpio-ts4800.c
@@ -66,6 +66,7 @@ static const struct of_device_id ts4800_gpio_of_match[] = {
        { .compatible = "technologic,ts4800-gpio", },
        {},
 };
+MODULE_DEVICE_TABLE(of, ts4800_gpio_of_match);
 static struct platform_driver ts4800_gpio_driver = {
        .driver = {
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 58ece201b8e6..72a4b326fd0d 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -653,14 +653,17 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index)
 {
        int idx, i;
        unsigned int irq_flags;
+        int ret = -ENOENT;
        for (i = 0, idx = 0; idx <= index; i++) {
                struct acpi_gpio_info info;
                struct gpio_desc *desc;
                desc = acpi_get_gpiod_by_index(adev, NULL, i, &info);
-                if (IS_ERR(desc))
+                if (IS_ERR(desc)) {
+                        ret = PTR_ERR(desc);
                        break;
+                }
                if (info.gpioint && idx++ == index) {
                        int irq = gpiod_to_irq(desc);
@@ -679,7 +682,7 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index)
                }
        }
-        return -ENOENT;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(acpi_dev_gpio_irq_get);
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index ecad3f0e3b77..193f15d50bba 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -26,14 +26,18 @@
 #include "gpiolib.h"
-static int of_gpiochip_match_node(struct gpio_chip *chip, void *data)
+static int of_gpiochip_match_node_and_xlate(struct gpio_chip *chip, void *data)
 {
-        return chip->gpiodev->dev.of_node == data;
+        struct of_phandle_args *gpiospec = data;
+        return chip->gpiodev->dev.of_node == gpiospec->np &&
+                                chip->of_xlate(chip, gpiospec, NULL) >= 0;
 }
-static struct gpio_chip *of_find_gpiochip_by_node(struct device_node *np)
+static struct gpio_chip *of_find_gpiochip_by_xlate(
+                                        struct of_phandle_args *gpiospec)
 {
-        return gpiochip_find(np, of_gpiochip_match_node);
+        return gpiochip_find(gpiospec, of_gpiochip_match_node_and_xlate);
 }
 static struct gpio_desc *of_xlate_and_get_gpiod_flags(struct gpio_chip *chip,
@@ -79,7 +83,7 @@ struct gpio_desc *of_get_named_gpiod_flags(struct device_node *np,
                return ERR_PTR(ret);
        }
-        chip = of_find_gpiochip_by_node(gpiospec.np);
+        chip = of_find_gpiochip_by_xlate(&gpiospec);
        if (!chip) {
                desc = ERR_PTR(-EPROBE_DEFER);
                goto out;
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index f0fc3a0d37c8..868128a676ba 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -21,6 +21,7 @@
 #include <linux/uaccess.h>
 #include <linux/compat.h>
 #include <linux/anon_inodes.h>
+#include <linux/file.h>
 #include <linux/kfifo.h>
 #include <linux/poll.h>
 #include <linux/timekeeping.h>
@@ -333,6 +334,13 @@ struct linehandle_state {
        u32 numdescs;
 };
+#define GPIOHANDLE_REQUEST_VALID_FLAGS \
+        (GPIOHANDLE_REQUEST_INPUT | \
+        GPIOHANDLE_REQUEST_OUTPUT | \
+        GPIOHANDLE_REQUEST_ACTIVE_LOW | \
+        GPIOHANDLE_REQUEST_OPEN_DRAIN | \
+        GPIOHANDLE_REQUEST_OPEN_SOURCE)
 static long linehandle_ioctl(struct file *filep, unsigned int cmd,
                             unsigned long arg)
 {
@@ -344,6 +352,8 @@ static long linehandle_ioctl(struct file *filep, unsigned int cmd,
        if (cmd == GPIOHANDLE_GET_LINE_VALUES_IOCTL) {
                int val;
+                memset(&ghd, 0, sizeof(ghd));
                /* TODO: check if descriptors are really input */
                for (i = 0; i < lh->numdescs; i++) {
                        val = gpiod_get_value_cansleep(lh->descs[i]);
@@ -414,6 +424,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
 {
        struct gpiohandle_request handlereq;
        struct linehandle_state *lh;
+        struct file *file;
        int fd, i, ret;
        if (copy_from_user(&handlereq, ip, sizeof(handlereq)))
@@ -444,6 +455,17 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
                u32 lflags = handlereq.flags;
                struct gpio_desc *desc;
+                if (offset >= gdev->ngpio) {
+                        ret = -EINVAL;
+                        goto out_free_descs;
+                }
+                /* Return an error if a unknown flag is set */
+                if (lflags & ~GPIOHANDLE_REQUEST_VALID_FLAGS) {
+                        ret = -EINVAL;
+                        goto out_free_descs;
+                }
                desc = &gdev->descs[offset];
                ret = gpiod_request(desc, lh->label);
                if (ret)
@@ -479,26 +501,41 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
        i--;
        lh->numdescs = handlereq.lines;
-        fd = anon_inode_getfd("gpio-linehandle",
+        fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
-                              &linehandle_fileops,
-                              lh,
-                              O_RDONLY | O_CLOEXEC);
        if (fd < 0) {
                ret = fd;
                goto out_free_descs;
        }
+        file = anon_inode_getfile("gpio-linehandle",
+                                  &linehandle_fileops,
+                                  lh,
+                                  O_RDONLY | O_CLOEXEC);
+        if (IS_ERR(file)) {
+                ret = PTR_ERR(file);
+                goto out_put_unused_fd;
+        }
        handlereq.fd = fd;
        if (copy_to_user(ip, &handlereq, sizeof(handlereq))) {
-                ret = -EFAULT;
+                /*
-                goto out_free_descs;
+                 * fput() will trigger the release() callback, so do not go onto
+                 * the regular error cleanup path here.
+                 */
+                fput(file);
+                put_unused_fd(fd);
+                return -EFAULT;
        }
+        fd_install(fd, file);
        dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
                lh->numdescs);
        return 0;
+out_put_unused_fd:
+        put_unused_fd(fd);
 out_free_descs:
        for (; i >= 0; i--)
                gpiod_free(lh->descs[i]);
@@ -536,6 +573,10 @@ struct lineevent_state {
        struct mutex read_lock;
 };
+#define GPIOEVENT_REQUEST_VALID_FLAGS \
+        (GPIOEVENT_REQUEST_RISING_EDGE | \
+        GPIOEVENT_REQUEST_FALLING_EDGE)
 static unsigned int lineevent_poll(struct file *filep,
                                   struct poll_table_struct *wait)
 {
@@ -623,6 +664,8 @@ static long lineevent_ioctl(struct file *filep, unsigned int cmd,
        if (cmd == GPIOHANDLE_GET_LINE_VALUES_IOCTL) {
                int val;
+                memset(&ghd, 0, sizeof(ghd));
                val = gpiod_get_value_cansleep(le->desc);
                if (val < 0)
                        return val;
@@ -695,6 +738,7 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
        struct gpioevent_request eventreq;
        struct lineevent_state *le;
        struct gpio_desc *desc;
+        struct file *file;
        u32 offset;
        u32 lflags;
        u32 eflags;
@@ -726,6 +770,18 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
        lflags = eventreq.handleflags;
        eflags = eventreq.eventflags;
+        if (offset >= gdev->ngpio) {
+                ret = -EINVAL;
+                goto out_free_label;
+        }
+        /* Return an error if a unknown flag is set */
+        if ((lflags & ~GPIOHANDLE_REQUEST_VALID_FLAGS) ||
+            (eflags & ~GPIOEVENT_REQUEST_VALID_FLAGS)) {
+                ret = -EINVAL;
+                goto out_free_label;
+        }
        /* This is just wrong: we don't look for events on output lines */
        if (lflags & GPIOHANDLE_REQUEST_OUTPUT) {
                ret = -EINVAL;
@@ -777,23 +833,38 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
        if (ret)
                goto out_free_desc;
-        fd = anon_inode_getfd("gpio-event",
+        fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
-                              &lineevent_fileops,
-                              le,
-                              O_RDONLY | O_CLOEXEC);
        if (fd < 0) {
                ret = fd;
                goto out_free_irq;
        }
+        file = anon_inode_getfile("gpio-event",
+                                  &lineevent_fileops,
+                                  le,
+                                  O_RDONLY | O_CLOEXEC);
+        if (IS_ERR(file)) {
+                ret = PTR_ERR(file);
+                goto out_put_unused_fd;
+        }
        eventreq.fd = fd;
        if (copy_to_user(ip, &eventreq, sizeof(eventreq))) {
-                ret = -EFAULT;
+                /*
-                goto out_free_irq;
+                 * fput() will trigger the release() callback, so do not go onto
+                 * the regular error cleanup path here.
+                 */
+                fput(file);
+                put_unused_fd(fd);
+                return -EFAULT;
        }
+        fd_install(fd, file);
        return 0;
+out_put_unused_fd:
+        put_unused_fd(fd);
 out_free_irq:
        free_irq(le->irq, le);
 out_free_desc:
@@ -823,6 +894,8 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        if (cmd == GPIO_GET_CHIPINFO_IOCTL) {
                struct gpiochip_info chipinfo;
+                memset(&chipinfo, 0, sizeof(chipinfo));
                strncpy(chipinfo.name, dev_name(&gdev->dev),
                        sizeof(chipinfo.name));
                chipinfo.name[sizeof(chipinfo.name)-1] = '\0';
@@ -839,7 +912,7 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                if (copy_from_user(&lineinfo, ip, sizeof(lineinfo)))
                        return -EFAULT;
-                if (lineinfo.line_offset > gdev->ngpio)
+                if (lineinfo.line_offset >= gdev->ngpio)
                        return -EINVAL;
                desc = &gdev->descs[lineinfo.line_offset];
@@ -2664,8 +2737,11 @@ int gpiochip_lock_as_irq(struct gpio_chip *chip, unsigned int offset)
        if (IS_ERR(desc))
                return PTR_ERR(desc);
-        /* Flush direction if something changed behind our back */
+        /*
-        if (chip->get_direction) {
+         * If it's fast: flush the direction setting if something changed
+         * behind our back
+         */
+        if (!chip->can_sleep && chip->get_direction) {
                int dir = chip->get_direction(chip, offset);
                if (dir)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 039b57e4644c..05c2850c04b0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -459,6 +459,7 @@ struct amdgpu_bo {
        u64                             metadata_flags;
        void                            *metadata;
        u32                             metadata_size;
+        unsigned                        prime_shared_count;
        /* list of all virtual address to which this bo
         * is associated to
         */
@@ -2471,6 +2472,7 @@ void amdgpu_driver_postclose_kms(struct drm_device *dev,
                                 struct drm_file *file_priv);
 void amdgpu_driver_preclose_kms(struct drm_device *dev,
                                struct drm_file *file_priv);
+int amdgpu_suspend(struct amdgpu_device *adev);
 int amdgpu_device_suspend(struct drm_device *dev, bool suspend, bool fbcon);
 int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon);
 u32 amdgpu_get_vblank_counter_kms(struct drm_device *dev, unsigned int pipe);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
index 892d60fb225b..2057683f7b59 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
@@ -395,9 +395,12 @@ static int acp_hw_fini(void *handle)
 {
        int i, ret;
        struct device *dev;
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        /* return early if no ACP */
+        if (!adev->acp.acp_genpd)
+                return 0;
        for (i = 0; i < ACP_DEVS ; i++) {
                dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i);
                ret = pm_genpd_remove_device(&adev->acp.acp_genpd->gpd, dev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index dae35a96a694..6c343a933182 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -34,6 +34,7 @@ struct amdgpu_atpx {
 static struct amdgpu_atpx_priv {
        bool atpx_detected;
+        bool bridge_pm_usable;
        /* handle for device - and atpx */
        acpi_handle dhandle;
        acpi_handle other_handle;
@@ -205,7 +206,11 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
        atpx->is_hybrid = false;
        if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
                printk("ATPX Hybrid Graphics\n");
-                atpx->functions.power_cntl = false;
+                /*
+                 * Disable legacy PM methods only when pcie port PM is usable,
+                 * otherwise the device might fail to power off or power on.
+                 */
+                atpx->functions.power_cntl = !amdgpu_atpx_priv.bridge_pm_usable;
                atpx->is_hybrid = true;
        }
@@ -555,17 +560,25 @@ static bool amdgpu_atpx_detect(void)
        struct pci_dev *pdev = NULL;
        bool has_atpx = false;
        int vga_count = 0;
+        bool d3_supported = false;
+        struct pci_dev *parent_pdev;
        while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
                vga_count++;
                has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true);
+                parent_pdev = pci_upstream_bridge(pdev);
+                d3_supported |= parent_pdev && parent_pdev->bridge_d3;
        }
        while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
                vga_count++;
                has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true);
+                parent_pdev = pci_upstream_bridge(pdev);
+                d3_supported |= parent_pdev && parent_pdev->bridge_d3;
        }
        if (has_atpx && vga_count == 2) {
@@ -573,6 +586,7 @@ static bool amdgpu_atpx_detect(void)
                printk(KERN_INFO "vga_switcheroo: detected switching method %s handle\n",
                       acpi_method_name);
                amdgpu_atpx_priv.atpx_detected = true;
+                amdgpu_atpx_priv.bridge_pm_usable = d3_supported;
                amdgpu_atpx_init();
                return true;
        }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
index 651115dcce12..c02db01f6583 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
@@ -132,7 +132,7 @@ static int amdgpu_bo_list_set(struct amdgpu_device *adev,
                entry->priority = min(info[i].bo_priority,
                                      AMDGPU_BO_LIST_MAX_PRIORITY);
                entry->tv.bo = &entry->robj->tbo;
-                entry->tv.shared = true;
+                entry->tv.shared = !entry->robj->prime_shared_count;
                if (entry->robj->prefered_domains == AMDGPU_GEM_DOMAIN_GDS)
                        gds_obj = entry->robj;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index 7a8bfa34682f..662976292535 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -795,10 +795,19 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                if (!adev->pm.fw) {
                        switch (adev->asic_type) {
                        case CHIP_TOPAZ:
-                                strcpy(fw_name, "amdgpu/topaz_smc.bin");
+                                if (((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0x81)) ||
+                                    ((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0x83)) ||
+                                    ((adev->pdev->device == 0x6907) && (adev->pdev->revision == 0x87)))
+                                        strcpy(fw_name, "amdgpu/topaz_k_smc.bin");
+                                else
+                                        strcpy(fw_name, "amdgpu/topaz_smc.bin");
                                break;
                        case CHIP_TONGA:
-                                strcpy(fw_name, "amdgpu/tonga_smc.bin");
+                                if (((adev->pdev->device == 0x6939) && (adev->pdev->revision == 0xf1)) ||
+                                    ((adev->pdev->device == 0x6938) && (adev->pdev->revision == 0xf1)))
+                                        strcpy(fw_name, "amdgpu/tonga_k_smc.bin");
+                                else
+                                        strcpy(fw_name, "amdgpu/tonga_smc.bin");
                                break;
                        case CHIP_FIJI:
                                strcpy(fw_name, "amdgpu/fiji_smc.bin");
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index 2e3a0543760d..086aa5c9c634 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -765,14 +765,20 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)
        return ret;
 }
-static void amdgpu_connector_destroy(struct drm_connector *connector)
+static void amdgpu_connector_unregister(struct drm_connector *connector)
 {
        struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
-        if (amdgpu_connector->ddc_bus->has_aux) {
+        if (amdgpu_connector->ddc_bus && amdgpu_connector->ddc_bus->has_aux) {
                drm_dp_aux_unregister(&amdgpu_connector->ddc_bus->aux);
                amdgpu_connector->ddc_bus->has_aux = false;
        }
+}
+static void amdgpu_connector_destroy(struct drm_connector *connector)
+{
+        struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
        amdgpu_connector_free_edid(connector);
        kfree(amdgpu_connector->con_priv);
        drm_connector_unregister(connector);
@@ -826,6 +832,7 @@ static const struct drm_connector_funcs amdgpu_connector_lvds_funcs = {
        .dpms = drm_helper_connector_dpms,
        .detect = amdgpu_connector_lvds_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
+        .early_unregister = amdgpu_connector_unregister,
        .destroy = amdgpu_connector_destroy,
        .set_property = amdgpu_connector_set_lcd_property,
 };
@@ -936,6 +943,7 @@ static const struct drm_connector_funcs amdgpu_connector_vga_funcs = {
        .dpms = drm_helper_connector_dpms,
        .detect = amdgpu_connector_vga_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
+        .early_unregister = amdgpu_connector_unregister,
        .destroy = amdgpu_connector_destroy,
        .set_property = amdgpu_connector_set_property,
 };
@@ -1203,6 +1211,7 @@ static const struct drm_connector_funcs amdgpu_connector_dvi_funcs = {
        .detect = amdgpu_connector_dvi_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .set_property = amdgpu_connector_set_property,
+        .early_unregister = amdgpu_connector_unregister,
        .destroy = amdgpu_connector_destroy,
        .force = amdgpu_connector_dvi_force,
 };
@@ -1493,6 +1502,7 @@ static const struct drm_connector_funcs amdgpu_connector_dp_funcs = {
        .detect = amdgpu_connector_dp_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .set_property = amdgpu_connector_set_property,
+        .early_unregister = amdgpu_connector_unregister,
        .destroy = amdgpu_connector_destroy,
        .force = amdgpu_connector_dvi_force,
 };
@@ -1502,6 +1512,7 @@ static const struct drm_connector_funcs amdgpu_connector_edp_funcs = {
        .detect = amdgpu_connector_dp_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .set_property = amdgpu_connector_set_lcd_property,
+        .early_unregister = amdgpu_connector_unregister,
        .destroy = amdgpu_connector_destroy,
        .force = amdgpu_connector_dvi_force,
 };
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index b0f6e6957536..82dc8d20e28a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -519,7 +519,8 @@ static int amdgpu_cs_parser_bos(struct amdgpu_cs_parser *p,
                r = ttm_eu_reserve_buffers(&p->ticket, &p->validated, true,
                                           &duplicates);
                if (unlikely(r != 0)) {
-                        DRM_ERROR("ttm_eu_reserve_buffers failed.\n");
+                        if (r != -ERESTARTSYS)
+                                DRM_ERROR("ttm_eu_reserve_buffers failed.\n");
                        goto error_free_pages;
                }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index e203e5561107..a5e2fcbef0f0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -43,6 +43,9 @@ static int amdgpu_ctx_init(struct amdgpu_device *adev, struct amdgpu_ctx *ctx)
                ctx->rings[i].sequence = 1;
                ctx->rings[i].fences = &ctx->fences[amdgpu_sched_jobs * i];
        }
+        ctx->reset_counter = atomic_read(&adev->gpu_reset_counter);
        /* create context entity for each ring */
        for (i = 0; i < adev->num_rings; i++) {
                struct amdgpu_ring *ring = adev->rings[i];
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 7dbe85d67d26..e41d4baebf86 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -658,12 +658,10 @@ static bool amdgpu_vpost_needed(struct amdgpu_device *adev)
                return false;
        if (amdgpu_passthrough(adev)) {
-                /* for FIJI: In whole GPU pass-through virtualization case
+                /* for FIJI: In whole GPU pass-through virtualization case, after VM reboot
-                 * old smc fw won't clear some registers (e.g. MEM_SIZE, BIOS_SCRATCH)
+                 * some old smc fw still need driver do vPost otherwise gpu hang, while
-                 * so amdgpu_card_posted return false and driver will incorrectly skip vPost.
+                 * those smc fw version above 22.15 doesn't have this flaw, so we force
-                 * but if we force vPost do in pass-through case, the driver reload will hang.
+                 * vpost executed for smc version below 22.15
-                 * whether doing vPost depends on amdgpu_card_posted if smc version is above
-                 * 00160e00 for FIJI.
                 */
                if (adev->asic_type == CHIP_FIJI) {
                        int err;
@@ -674,22 +672,11 @@ static bool amdgpu_vpost_needed(struct amdgpu_device *adev)
                                return true;
                        fw_ver = *((uint32_t *)adev->pm.fw->data + 69);
-                        if (fw_ver >= 0x00160e00)
+                        if (fw_ver < 0x00160e00)
-                                return !amdgpu_card_posted(adev);
+                                return true;
                }
-        } else {
-                /* in bare-metal case, amdgpu_card_posted return false
-                 * after system reboot/boot, and return true if driver
-                 * reloaded.
-                 * we shouldn't do vPost after driver reload otherwise GPU
-                 * could hang.
-                 */
-                if (amdgpu_card_posted(adev))
-                        return false;
        }
+        return !amdgpu_card_posted(adev);
-        /* we assume vPost is neede for all other cases */
-        return true;
 }
 /**
@@ -1408,16 +1395,6 @@ static int amdgpu_late_init(struct amdgpu_device *adev)
        for (i = 0; i < adev->num_ip_blocks; i++) {
                if (!adev->ip_block_status[i].valid)
                        continue;
-                if (adev->ip_blocks[i].type == AMD_IP_BLOCK_TYPE_UVD ||
-                        adev->ip_blocks[i].type == AMD_IP_BLOCK_TYPE_VCE)
-                        continue;
-                /* enable clockgating to save power */
-                r = adev->ip_blocks[i].funcs->set_clockgating_state((void *)adev,
-                                                                    AMD_CG_STATE_GATE);
-                if (r) {
-                        DRM_ERROR("set_clockgating_state(gate) of IP block <%s> failed %d\n", adev->ip_blocks[i].funcs->name, r);
-                        return r;
-                }
                if (adev->ip_blocks[i].funcs->late_init) {
                        r = adev->ip_blocks[i].funcs->late_init((void *)adev);
                        if (r) {
@@ -1426,6 +1403,18 @@ static int amdgpu_late_init(struct amdgpu_device *adev)
                        }
                        adev->ip_block_status[i].late_initialized = true;
                }
+                /* skip CG for VCE/UVD, it's handled specially */
+                if (adev->ip_blocks[i].type != AMD_IP_BLOCK_TYPE_UVD &&
+                    adev->ip_blocks[i].type != AMD_IP_BLOCK_TYPE_VCE) {
+                        /* enable clockgating to save power */
+                        r = adev->ip_blocks[i].funcs->set_clockgating_state((void *)adev,
+                                                                            AMD_CG_STATE_GATE);
+                        if (r) {
+                                DRM_ERROR("set_clockgating_state(gate) of IP block <%s> failed %d\n",
+                                          adev->ip_blocks[i].funcs->name, r);
+                                return r;
+                        }
+                }
        }
        return 0;
@@ -1435,6 +1424,30 @@ static int amdgpu_fini(struct amdgpu_device *adev)
 {
        int i, r;
+        /* need to disable SMC first */
+        for (i = 0; i < adev->num_ip_blocks; i++) {
+                if (!adev->ip_block_status[i].hw)
+                        continue;
+                if (adev->ip_blocks[i].type == AMD_IP_BLOCK_TYPE_SMC) {
+                        /* ungate blocks before hw fini so that we can shutdown the blocks safely */
+                        r = adev->ip_blocks[i].funcs->set_clockgating_state((void *)adev,
+                                                                            AMD_CG_STATE_UNGATE);
+                        if (r) {
+                                DRM_ERROR("set_clockgating_state(ungate) of IP block <%s> failed %d\n",
+                                          adev->ip_blocks[i].funcs->name, r);
+                                return r;
+                        }
+                        r = adev->ip_blocks[i].funcs->hw_fini((void *)adev);
+                        /* XXX handle errors */
+                        if (r) {
+                                DRM_DEBUG("hw_fini of IP block <%s> failed %d\n",
+                                          adev->ip_blocks[i].funcs->name, r);
+                        }
+                        adev->ip_block_status[i].hw = false;
+                        break;
+                }
+        }
        for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
                if (!adev->ip_block_status[i].hw)
                        continue;
@@ -1480,7 +1493,7 @@ static int amdgpu_fini(struct amdgpu_device *adev)
        return 0;
 }
-static int amdgpu_suspend(struct amdgpu_device *adev)
+int amdgpu_suspend(struct amdgpu_device *adev)
 {
        int i, r;
@@ -1933,6 +1946,7 @@ int amdgpu_device_suspend(struct drm_device *dev, bool suspend, bool fbcon)
        /* evict remaining vram memory */
        amdgpu_bo_evict_vram(adev);
+        amdgpu_atombios_scratch_regs_save(adev);
        pci_save_state(dev->pdev);
        if (suspend) {
                /* Shut down the device */
@@ -1984,6 +1998,7 @@ int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon)
                        return r;
                }
        }
+        amdgpu_atombios_scratch_regs_restore(adev);
        /* post card */
        if (!amdgpu_card_posted(adev) || !resume) {
@@ -2073,7 +2088,8 @@ static bool amdgpu_check_soft_reset(struct amdgpu_device *adev)
                if (!adev->ip_block_status[i].valid)
                        continue;
                if (adev->ip_blocks[i].funcs->check_soft_reset)
-                        adev->ip_blocks[i].funcs->check_soft_reset(adev);
+                        adev->ip_block_status[i].hang =
+                                adev->ip_blocks[i].funcs->check_soft_reset(adev);
                if (adev->ip_block_status[i].hang) {
                        DRM_INFO("IP block:%d is hang!\n", i);
                        asic_hang = true;
@@ -2102,12 +2118,20 @@ static int amdgpu_pre_soft_reset(struct amdgpu_device *adev)
 static bool amdgpu_need_full_reset(struct amdgpu_device *adev)
 {
-        if (adev->ip_block_status[AMD_IP_BLOCK_TYPE_GMC].hang ||
+        int i;
-            adev->ip_block_status[AMD_IP_BLOCK_TYPE_SMC].hang ||
-            adev->ip_block_status[AMD_IP_BLOCK_TYPE_ACP].hang ||
+        for (i = 0; i < adev->num_ip_blocks; i++) {
-            adev->ip_block_status[AMD_IP_BLOCK_TYPE_DCE].hang) {
+                if (!adev->ip_block_status[i].valid)
-                DRM_INFO("Some block need full reset!\n");
+                        continue;
-                return true;
+                if ((adev->ip_blocks[i].type == AMD_IP_BLOCK_TYPE_GMC) ||
+                    (adev->ip_blocks[i].type == AMD_IP_BLOCK_TYPE_SMC) ||
+                    (adev->ip_blocks[i].type == AMD_IP_BLOCK_TYPE_ACP) ||
+                    (adev->ip_blocks[i].type == AMD_IP_BLOCK_TYPE_DCE)) {
+                        if (adev->ip_block_status[i].hang) {
+                                DRM_INFO("Some block need full reset!\n");
+                                return true;
+                        }
+                }
        }
        return false;
 }
@@ -2233,8 +2257,6 @@ int amdgpu_gpu_reset(struct amdgpu_device *adev)
        }
        if (need_full_reset) {
-                /* save scratch */
-                amdgpu_atombios_scratch_regs_save(adev);
                r = amdgpu_suspend(adev);
 retry:
@@ -2244,8 +2266,9 @@ retry:
                        amdgpu_display_stop_mc_access(adev, &save);
                        amdgpu_wait_for_idle(adev, AMD_IP_BLOCK_TYPE_GMC);
                }
+                amdgpu_atombios_scratch_regs_save(adev);
                r = amdgpu_asic_reset(adev);
+                amdgpu_atombios_scratch_regs_restore(adev);
                /* post card */
                amdgpu_atom_asic_init(adev->mode_info.atom_context);
@@ -2253,8 +2276,6 @@ retry:
                        dev_info(adev->dev, "GPU reset succeeded, trying to resume\n");
                        r = amdgpu_resume(adev);
                }
-                /* restore scratch */
-                amdgpu_atombios_scratch_regs_restore(adev);
        }
        if (!r) {
                amdgpu_irq_gpu_reset_resume_helper(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
index fe36caf1b7d7..14f57d9915e3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
@@ -113,24 +113,26 @@ void amdgpu_dpm_print_ps_status(struct amdgpu_device *adev,
        printk("\n");
 }
 u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
 {
        struct drm_device *dev = adev->ddev;
        struct drm_crtc *crtc;
        struct amdgpu_crtc *amdgpu_crtc;
-        u32 line_time_us, vblank_lines;
+        u32 vblank_in_pixels;
        u32 vblank_time_us = 0xffffffff; /* if the displays are off, vblank time is max */
        if (adev->mode_info.num_crtc && adev->mode_info.mode_config_initialized) {
                list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                        amdgpu_crtc = to_amdgpu_crtc(crtc);
                        if (crtc->enabled && amdgpu_crtc->enabled && amdgpu_crtc->hw_mode.clock) {
-                                line_time_us = (amdgpu_crtc->hw_mode.crtc_htotal * 1000) /
+                                vblank_in_pixels =
-                                        amdgpu_crtc->hw_mode.clock;
+                                        amdgpu_crtc->hw_mode.crtc_htotal *
-                                vblank_lines = amdgpu_crtc->hw_mode.crtc_vblank_end -
+                                        (amdgpu_crtc->hw_mode.crtc_vblank_end -
                                        amdgpu_crtc->hw_mode.crtc_vdisplay +
-                                        (amdgpu_crtc->v_border * 2);
+                                        (amdgpu_crtc->v_border * 2));
-                                vblank_time_us = vblank_lines * line_time_us;
+                                vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
                                break;
                        }
                }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 71ed27eb3dde..e0890deccb2f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -479,12 +479,15 @@ amdgpu_pci_remove(struct pci_dev *pdev)
 static void
 amdgpu_pci_shutdown(struct pci_dev *pdev)
 {
+        struct drm_device *dev = pci_get_drvdata(pdev);
+        struct amdgpu_device *adev = dev->dev_private;
        /* if we are running in a VM, make sure the device
         * torn down properly on reboot/shutdown.
         * unfortunately we can't detect certain
         * hypervisors so just do this all the time.
         */
-        amdgpu_pci_remove(pdev);
+        amdgpu_suspend(adev);
 }
 static int amdgpu_pmops_suspend(struct device *dev)
@@ -735,8 +738,20 @@ static struct pci_driver amdgpu_kms_pci_driver = {
 static int __init amdgpu_init(void)
 {
-        amdgpu_sync_init();
+        int r;
-        amdgpu_fence_slab_init();
+        r = amdgpu_sync_init();
+        if (r)
+                goto error_sync;
+        r = amdgpu_fence_slab_init();
+        if (r)
+                goto error_fence;
+        r = amd_sched_fence_slab_init();
+        if (r)
+                goto error_sched;
        if (vgacon_text_force()) {
                DRM_ERROR("VGACON disables amdgpu kernel modesetting.\n");
                return -EINVAL;
@@ -748,6 +763,15 @@ static int __init amdgpu_init(void)
        amdgpu_register_atpx_handler();
        /* let modprobe override vga console setting */
        return drm_pci_init(driver, pdriver);
+error_sched:
+        amdgpu_fence_slab_fini();
+error_fence:
+        amdgpu_sync_fini();
+error_sync:
+        return r;
 }
 static void __exit amdgpu_exit(void)
@@ -756,6 +780,7 @@ static void __exit amdgpu_exit(void)
        drm_pci_exit(driver, pdriver);
        amdgpu_unregister_atpx_handler();
        amdgpu_sync_fini();
+        amd_sched_fence_slab_fini();
        amdgpu_fence_slab_fini();
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
index 3a2e42f4b897..77b34ec92632 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
@@ -68,6 +68,7 @@ int amdgpu_fence_slab_init(void)
 void amdgpu_fence_slab_fini(void)
 {
+        rcu_barrier();
        kmem_cache_destroy(amdgpu_fence_slab);
 }
 /*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
index 278708f5a744..9fa809876339 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
@@ -239,6 +239,7 @@ int amdgpu_irq_init(struct amdgpu_device *adev)
        if (r) {
                adev->irq.installed = false;
                flush_work(&adev->hotplug_work);
+                cancel_work_sync(&adev->reset_work);
                return r;
        }
@@ -264,6 +265,7 @@ void amdgpu_irq_fini(struct amdgpu_device *adev)
                if (adev->irq.msi_enabled)
                        pci_disable_msi(adev->pdev);
                flush_work(&adev->hotplug_work);
+                cancel_work_sync(&adev->reset_work);
        }
        for (i = 0; i < AMDGPU_MAX_IRQ_SRC_ID; ++i) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index c2c7fb140338..3938fca1ea8e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -99,6 +99,8 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags)
        if ((amdgpu_runtime_pm != 0) &&
            amdgpu_has_atpx() &&
+            (amdgpu_is_atpx_hybrid() ||
+             amdgpu_has_atpx_dgpu_power_cntl()) &&
            ((flags & AMD_IS_APU) == 0))
                flags |= AMD_IS_PX;
@@ -459,10 +461,8 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                /* return all clocks in KHz */
                dev_info.gpu_counter_freq = amdgpu_asic_get_xclk(adev) * 10;
                if (adev->pm.dpm_enabled) {
-                        dev_info.max_engine_clock =
+                        dev_info.max_engine_clock = amdgpu_dpm_get_sclk(adev, false) * 10;
-                                adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.sclk * 10;
+                        dev_info.max_memory_clock = amdgpu_dpm_get_mclk(adev, false) * 10;
-                        dev_info.max_memory_clock =
-                                adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.mclk * 10;
                } else {
                        dev_info.max_engine_clock = adev->pm.default_sclk * 10;
                        dev_info.max_memory_clock = adev->pm.default_mclk * 10;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index aa074fac0c7f..f3efb1c5dae9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -754,6 +754,10 @@ static const char *amdgpu_vram_names[] = {
 int amdgpu_bo_init(struct amdgpu_device *adev)
 {
+        /* reserve PAT memory space to WC for VRAM */
+        arch_io_reserve_memtype_wc(adev->mc.aper_base,
+                                   adev->mc.aper_size);
        /* Add an MTRR for the VRAM */
        adev->mc.vram_mtrr = arch_phys_wc_add(adev->mc.aper_base,
                                              adev->mc.aper_size);
@@ -769,6 +773,7 @@ void amdgpu_bo_fini(struct amdgpu_device *adev)
 {
        amdgpu_ttm_fini(adev);
        arch_phys_wc_del(adev->mc.vram_mtrr);
+        arch_io_free_memtype_wc(adev->mc.aper_base, adev->mc.aper_size);
 }
 int amdgpu_bo_fbdev_mmap(struct amdgpu_bo *bo,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
index 7700dc22f243..3826d5aea0a6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
@@ -74,20 +74,36 @@ amdgpu_gem_prime_import_sg_table(struct drm_device *dev,
        if (ret)
                return ERR_PTR(ret);
+        bo->prime_shared_count = 1;
        return &bo->gem_base;
 }
 int amdgpu_gem_prime_pin(struct drm_gem_object *obj)
 {
        struct amdgpu_bo *bo = gem_to_amdgpu_bo(obj);
-        int ret = 0;
+        long ret = 0;
        ret = amdgpu_bo_reserve(bo, false);
        if (unlikely(ret != 0))
                return ret;
+        /*
+         * Wait for all shared fences to complete before we switch to future
+         * use of exclusive fence on this prime shared bo.
+         */
+        ret = reservation_object_wait_timeout_rcu(bo->tbo.resv, true, false,
+                                                  MAX_SCHEDULE_TIMEOUT);
+        if (unlikely(ret < 0)) {
+                DRM_DEBUG_PRIME("Fence wait failed: %li\n", ret);
+                amdgpu_bo_unreserve(bo);
+                return ret;
+        }
        /* pin buffer into GTT */
        ret = amdgpu_bo_pin(bo, AMDGPU_GEM_DOMAIN_GTT, NULL);
+        if (likely(ret == 0))
+                bo->prime_shared_count++;
        amdgpu_bo_unreserve(bo);
        return ret;
 }
@@ -102,6 +118,8 @@ void amdgpu_gem_prime_unpin(struct drm_gem_object *obj)
                return;
        amdgpu_bo_unpin(bo);
+        if (bo->prime_shared_count)
+                bo->prime_shared_count--;
        amdgpu_bo_unreserve(bo);
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index e1fa8731d1e2..3cb5e903cd62 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -345,8 +345,8 @@ static int amdgpu_debugfs_ring_init(struct amdgpu_device *adev,
        ent = debugfs_create_file(name,
                                  S_IFREG | S_IRUGO, root,
                                  ring, &amdgpu_debugfs_ring_fops);
-        if (IS_ERR(ent))
+        if (!ent)
-                return PTR_ERR(ent);
+                return -ENOMEM;
        i_size_write(ent->d_inode, ring->ring_size + 12);
        ring->ent = ent;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 887483b8b818..dcaf691f56b5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -555,10 +555,13 @@ struct amdgpu_ttm_tt {
 int amdgpu_ttm_tt_get_user_pages(struct ttm_tt *ttm, struct page **pages)
 {
        struct amdgpu_ttm_tt *gtt = (void *)ttm;
-        int write = !(gtt->userflags & AMDGPU_GEM_USERPTR_READONLY);
+        unsigned int flags = 0;
        unsigned pinned = 0;
        int r;
+        if (!(gtt->userflags & AMDGPU_GEM_USERPTR_READONLY))
+                flags |= FOLL_WRITE;
        if (gtt->userflags & AMDGPU_GEM_USERPTR_ANONONLY) {
                /* check that we only use anonymous memory
                   to prevent problems with writeback */
@@ -581,7 +584,7 @@ int amdgpu_ttm_tt_get_user_pages(struct ttm_tt *ttm, struct page **pages)
                list_add(&guptask.list, &gtt->guptasks);
                spin_unlock(&gtt->guptasklock);
-                r = get_user_pages(userptr, num_pages, write, 0, p, NULL);
+                r = get_user_pages(userptr, num_pages, flags, p, NULL);
                spin_lock(&gtt->guptasklock);
                list_del(&guptask.list);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 06f24322e7c3..968c4260d7a7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1758,5 +1758,6 @@ void amdgpu_vm_manager_fini(struct amdgpu_device *adev)
                fence_put(adev->vm_manager.ids[i].first);
                amdgpu_sync_free(&adev->vm_manager.ids[i].active);
                fence_put(id->flushed_updates);
+                fence_put(id->last_flush);
        }
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 1d8c375a3561..5be788b269e2 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -4075,7 +4075,7 @@ static int ci_enable_uvd_dpm(struct amdgpu_device *adev, bool enable)
                                                          pi->dpm_level_enable_mask.mclk_dpm_enable_mask);
                }
        } else {
-                if (pi->last_mclk_dpm_enable_mask & 0x1) {
+                if (pi->uvd_enabled) {
                        pi->uvd_enabled = false;
                        pi->dpm_level_enable_mask.mclk_dpm_enable_mask |= 1;
                        amdgpu_ci_send_msg_to_smc_with_parameter(adev,
@@ -6236,6 +6236,8 @@ static int ci_dpm_sw_fini(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        flush_work(&adev->pm.dpm.thermal.work);
        mutex_lock(&adev->pm.mutex);
        amdgpu_pm_sysfs_fini(adev);
        ci_dpm_fini(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
index f80a0834e889..3c082e143730 100644
--- a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
@@ -1514,14 +1514,16 @@ static int cz_dpm_set_powergating_state(void *handle,
        return 0;
 }
-/* borrowed from KV, need future unify */
 static int cz_dpm_get_temperature(struct amdgpu_device *adev)
 {
        int actual_temp = 0;
-        uint32_t temp = RREG32_SMC(0xC0300E0C);
+        uint32_t val = RREG32_SMC(ixTHM_TCON_CUR_TMP);
+        uint32_t temp = REG_GET_FIELD(val, THM_TCON_CUR_TMP, CUR_TEMP);
-        if (temp)
+        if (REG_GET_FIELD(val, THM_TCON_CUR_TMP, CUR_TEMP_RANGE_SEL))
                actual_temp = 1000 * ((temp / 8) - 49);
+        else
+                actual_temp = 1000 * (temp / 8);
        return actual_temp;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index 613ebb7ed50f..9260caef74fa 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -3151,10 +3151,6 @@ static int dce_v10_0_hw_fini(void *handle)
 static int dce_v10_0_suspend(void *handle)
 {
-        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        amdgpu_atombios_scratch_regs_save(adev);
        return dce_v10_0_hw_fini(handle);
 }
@@ -3165,8 +3161,6 @@ static int dce_v10_0_resume(void *handle)
        ret = dce_v10_0_hw_init(handle);
-        amdgpu_atombios_scratch_regs_restore(adev);
        /* turn on the BL */
        if (adev->mode_info.bl_encoder) {
                u8 bl_level = amdgpu_display_backlight_get_level(adev,
@@ -3188,16 +3182,11 @@ static int dce_v10_0_wait_for_idle(void *handle)
        return 0;
 }
-static int dce_v10_0_check_soft_reset(void *handle)
+static bool dce_v10_0_check_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        if (dce_v10_0_is_display_hung(adev))
+        return dce_v10_0_is_display_hung(adev);
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_DCE].hang = true;
-        else
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_DCE].hang = false;
-        return 0;
 }
 static int dce_v10_0_soft_reset(void *handle)
@@ -3205,9 +3194,6 @@ static int dce_v10_0_soft_reset(void *handle)
        u32 srbm_soft_reset = 0, tmp;
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_DCE].hang)
-                return 0;
        if (dce_v10_0_is_display_hung(adev))
                srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_DC_MASK;
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index f264b8f17ad1..367739bd1927 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -3215,10 +3215,6 @@ static int dce_v11_0_hw_fini(void *handle)
 static int dce_v11_0_suspend(void *handle)
 {
-        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        amdgpu_atombios_scratch_regs_save(adev);
        return dce_v11_0_hw_fini(handle);
 }
@@ -3229,8 +3225,6 @@ static int dce_v11_0_resume(void *handle)
        ret = dce_v11_0_hw_init(handle);
-        amdgpu_atombios_scratch_regs_restore(adev);
        /* turn on the BL */
        if (adev->mode_info.bl_encoder) {
                u8 bl_level = amdgpu_display_backlight_get_level(adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
index b948d6cb1399..15f9fc0514b2 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -2482,10 +2482,6 @@ static int dce_v6_0_hw_fini(void *handle)
 static int dce_v6_0_suspend(void *handle)
 {
-        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        amdgpu_atombios_scratch_regs_save(adev);
        return dce_v6_0_hw_fini(handle);
 }
@@ -2496,8 +2492,6 @@ static int dce_v6_0_resume(void *handle)
        ret = dce_v6_0_hw_init(handle);
-        amdgpu_atombios_scratch_regs_restore(adev);
        /* turn on the BL */
        if (adev->mode_info.bl_encoder) {
                u8 bl_level = amdgpu_display_backlight_get_level(adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index 5966166ec94c..8c4d808db0f1 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -3033,10 +3033,6 @@ static int dce_v8_0_hw_fini(void *handle)
 static int dce_v8_0_suspend(void *handle)
 {
-        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        amdgpu_atombios_scratch_regs_save(adev);
        return dce_v8_0_hw_fini(handle);
 }
@@ -3047,8 +3043,6 @@ static int dce_v8_0_resume(void *handle)
        ret = dce_v8_0_hw_init(handle);
-        amdgpu_atombios_scratch_regs_restore(adev);
        /* turn on the BL */
        if (adev->mode_info.bl_encoder) {
                u8 bl_level = amdgpu_display_backlight_get_level(adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 6c6ff57b1c95..bb97182dc749 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -640,7 +640,6 @@ static const u32 stoney_mgcg_cgcg_init[] =
        mmCP_MEM_SLP_CNTL, 0xffffffff, 0x00020201,
        mmRLC_MEM_SLP_CNTL, 0xffffffff, 0x00020201,
        mmCGTS_SM_CTRL_REG, 0xffffffff, 0x96940200,
-        mmATC_MISC_CG, 0xffffffff, 0x000c0200,
 };
 static void gfx_v8_0_set_ring_funcs(struct amdgpu_device *adev);
@@ -4087,14 +4086,21 @@ static int gfx_v8_0_rlc_load_microcode(struct amdgpu_device *adev)
 static int gfx_v8_0_rlc_resume(struct amdgpu_device *adev)
 {
        int r;
+        u32 tmp;
        gfx_v8_0_rlc_stop(adev);
        /* disable CG */
-        WREG32(mmRLC_CGCG_CGLS_CTRL, 0);
+        tmp = RREG32(mmRLC_CGCG_CGLS_CTRL);
+        tmp &= ~(RLC_CGCG_CGLS_CTRL__CGCG_EN_MASK |
+                 RLC_CGCG_CGLS_CTRL__CGLS_EN_MASK);
+        WREG32(mmRLC_CGCG_CGLS_CTRL, tmp);
        if (adev->asic_type == CHIP_POLARIS11 ||
-            adev->asic_type == CHIP_POLARIS10)
+            adev->asic_type == CHIP_POLARIS10) {
-                WREG32(mmRLC_CGCG_CGLS_CTRL_3D, 0);
+                tmp = RREG32(mmRLC_CGCG_CGLS_CTRL_3D);
+                tmp &= ~0x3;
+                WREG32(mmRLC_CGCG_CGLS_CTRL_3D, tmp);
+        }
        /* disable PG */
        WREG32(mmRLC_PG_CNTL, 0);
@@ -5137,7 +5143,7 @@ static int gfx_v8_0_wait_for_idle(void *handle)
        return -ETIMEDOUT;
 }
-static int gfx_v8_0_check_soft_reset(void *handle)
+static bool gfx_v8_0_check_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 grbm_soft_reset = 0, srbm_soft_reset = 0;
@@ -5189,16 +5195,14 @@ static int gfx_v8_0_check_soft_reset(void *handle)
                                                SRBM_SOFT_RESET, SOFT_RESET_SEM, 1);
        if (grbm_soft_reset || srbm_soft_reset) {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_GFX].hang = true;
                adev->gfx.grbm_soft_reset = grbm_soft_reset;
                adev->gfx.srbm_soft_reset = srbm_soft_reset;
+                return true;
        } else {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_GFX].hang = false;
                adev->gfx.grbm_soft_reset = 0;
                adev->gfx.srbm_soft_reset = 0;
+                return false;
        }
-        return 0;
 }
 static void gfx_v8_0_inactive_hqd(struct amdgpu_device *adev,
@@ -5226,7 +5230,8 @@ static int gfx_v8_0_pre_soft_reset(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 grbm_soft_reset = 0, srbm_soft_reset = 0;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_GFX].hang)
+        if ((!adev->gfx.grbm_soft_reset) &&
+            (!adev->gfx.srbm_soft_reset))
                return 0;
        grbm_soft_reset = adev->gfx.grbm_soft_reset;
@@ -5264,7 +5269,8 @@ static int gfx_v8_0_soft_reset(void *handle)
        u32 grbm_soft_reset = 0, srbm_soft_reset = 0;
        u32 tmp;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_GFX].hang)
+        if ((!adev->gfx.grbm_soft_reset) &&
+            (!adev->gfx.srbm_soft_reset))
                return 0;
        grbm_soft_reset = adev->gfx.grbm_soft_reset;
@@ -5334,7 +5340,8 @@ static int gfx_v8_0_post_soft_reset(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 grbm_soft_reset = 0, srbm_soft_reset = 0;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_GFX].hang)
+        if ((!adev->gfx.grbm_soft_reset) &&
+            (!adev->gfx.srbm_soft_reset))
                return 0;
        grbm_soft_reset = adev->gfx.grbm_soft_reset;
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 1b319f5bc696..a16b2201d52c 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -100,6 +100,7 @@ static const u32 cz_mgcg_cgcg_init[] =
 static const u32 stoney_mgcg_cgcg_init[] =
 {
+        mmATC_MISC_CG, 0xffffffff, 0x000c0200,
        mmMC_MEM_POWER_LS, 0xffffffff, 0x00000104
 };
@@ -1099,7 +1100,7 @@ static int gmc_v8_0_wait_for_idle(void *handle)
 }
-static int gmc_v8_0_check_soft_reset(void *handle)
+static bool gmc_v8_0_check_soft_reset(void *handle)
 {
        u32 srbm_soft_reset = 0;
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
@@ -1116,20 +1117,19 @@ static int gmc_v8_0_check_soft_reset(void *handle)
                                                        SRBM_SOFT_RESET, SOFT_RESET_MC, 1);
        }
        if (srbm_soft_reset) {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_GMC].hang = true;
                adev->mc.srbm_soft_reset = srbm_soft_reset;
+                return true;
        } else {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_GMC].hang = false;
                adev->mc.srbm_soft_reset = 0;
+                return false;
        }
-        return 0;
 }
 static int gmc_v8_0_pre_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_GMC].hang)
+        if (!adev->mc.srbm_soft_reset)
                return 0;
        gmc_v8_0_mc_stop(adev, &adev->mc.save);
@@ -1145,7 +1145,7 @@ static int gmc_v8_0_soft_reset(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 srbm_soft_reset;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_GMC].hang)
+        if (!adev->mc.srbm_soft_reset)
                return 0;
        srbm_soft_reset = adev->mc.srbm_soft_reset;
@@ -1175,7 +1175,7 @@ static int gmc_v8_0_post_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_GMC].hang)
+        if (!adev->mc.srbm_soft_reset)
                return 0;
        gmc_v8_0_mc_resume(adev, &adev->mc.save);
diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index f8618a3881a8..71d2856222fa 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -3063,6 +3063,8 @@ static int kv_dpm_sw_fini(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        flush_work(&adev->pm.dpm.thermal.work);
        mutex_lock(&adev->pm.mutex);
        amdgpu_pm_sysfs_fini(adev);
        kv_dpm_fini(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
index f325fd86430b..a9d10941fb53 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
@@ -1268,7 +1268,7 @@ static int sdma_v3_0_wait_for_idle(void *handle)
        return -ETIMEDOUT;
 }
-static int sdma_v3_0_check_soft_reset(void *handle)
+static bool sdma_v3_0_check_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 srbm_soft_reset = 0;
@@ -1281,14 +1281,12 @@ static int sdma_v3_0_check_soft_reset(void *handle)
        }
        if (srbm_soft_reset) {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_SDMA].hang = true;
                adev->sdma.srbm_soft_reset = srbm_soft_reset;
+                return true;
        } else {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_SDMA].hang = false;
                adev->sdma.srbm_soft_reset = 0;
+                return false;
        }
-        return 0;
 }
 static int sdma_v3_0_pre_soft_reset(void *handle)
@@ -1296,7 +1294,7 @@ static int sdma_v3_0_pre_soft_reset(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 srbm_soft_reset = 0;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_SDMA].hang)
+        if (!adev->sdma.srbm_soft_reset)
                return 0;
        srbm_soft_reset = adev->sdma.srbm_soft_reset;
@@ -1315,7 +1313,7 @@ static int sdma_v3_0_post_soft_reset(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 srbm_soft_reset = 0;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_SDMA].hang)
+        if (!adev->sdma.srbm_soft_reset)
                return 0;
        srbm_soft_reset = adev->sdma.srbm_soft_reset;
@@ -1335,7 +1333,7 @@ static int sdma_v3_0_soft_reset(void *handle)
        u32 srbm_soft_reset = 0;
        u32 tmp;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_SDMA].hang)
+        if (!adev->sdma.srbm_soft_reset)
                return 0;
        srbm_soft_reset = adev->sdma.srbm_soft_reset;
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index 8bd08925b370..d6f85b1a0b93 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -3477,6 +3477,49 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
        int i;
        struct si_dpm_quirk *p = si_dpm_quirk_list;
+        /* limit all SI kickers */
+        if (adev->asic_type == CHIP_PITCAIRN) {
+                if ((adev->pdev->revision == 0x81) ||
+                    (adev->pdev->device == 0x6810) ||
+                    (adev->pdev->device == 0x6811) ||
+                    (adev->pdev->device == 0x6816) ||
+                    (adev->pdev->device == 0x6817) ||
+                    (adev->pdev->device == 0x6806))
+                        max_mclk = 120000;
+        } else if (adev->asic_type == CHIP_VERDE) {
+                if ((adev->pdev->revision == 0x81) ||
+                    (adev->pdev->revision == 0x83) ||
+                    (adev->pdev->revision == 0x87) ||
+                    (adev->pdev->device == 0x6820) ||
+                    (adev->pdev->device == 0x6821) ||
+                    (adev->pdev->device == 0x6822) ||
+                    (adev->pdev->device == 0x6823) ||
+                    (adev->pdev->device == 0x682A) ||
+                    (adev->pdev->device == 0x682B)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        } else if (adev->asic_type == CHIP_OLAND) {
+                if ((adev->pdev->revision == 0xC7) ||
+                    (adev->pdev->revision == 0x80) ||
+                    (adev->pdev->revision == 0x81) ||
+                    (adev->pdev->revision == 0x83) ||
+                    (adev->pdev->device == 0x6604) ||
+                    (adev->pdev->device == 0x6605)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        } else if (adev->asic_type == CHIP_HAINAN) {
+                if ((adev->pdev->revision == 0x81) ||
+                    (adev->pdev->revision == 0x83) ||
+                    (adev->pdev->revision == 0xC3) ||
+                    (adev->pdev->device == 0x6664) ||
+                    (adev->pdev->device == 0x6665) ||
+                    (adev->pdev->device == 0x6667)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        }
        /* Apply dpm quirks */
        while (p && p->chip_device != 0) {
                if (adev->pdev->vendor == p->chip_vendor &&
@@ -3489,16 +3532,6 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
                }
                ++p;
        }
-        /* limit mclk on all R7 370 parts for stability */
-        if (adev->pdev->device == 0x6811 &&
-            adev->pdev->revision == 0x81)
-                max_mclk = 120000;
-        /* limit sclk/mclk on Jet parts for stability */
-        if (adev->pdev->device == 0x6665 &&
-            adev->pdev->revision == 0xc3) {
-                max_sclk = 75000;
-                max_mclk = 80000;
-        }
        if (rps->vce_active) {
                rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
@@ -7771,6 +7804,8 @@ static int si_dpm_sw_fini(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        flush_work(&adev->pm.dpm.thermal.work);
        mutex_lock(&adev->pm.mutex);
        amdgpu_pm_sysfs_fini(adev);
        si_dpm_fini(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/tonga_ih.c b/drivers/gpu/drm/amd/amdgpu/tonga_ih.c
index d127d59f953a..b4ea229bb449 100644
--- a/drivers/gpu/drm/amd/amdgpu/tonga_ih.c
+++ b/drivers/gpu/drm/amd/amdgpu/tonga_ih.c
@@ -373,7 +373,7 @@ static int tonga_ih_wait_for_idle(void *handle)
        return -ETIMEDOUT;
 }
-static int tonga_ih_check_soft_reset(void *handle)
+static bool tonga_ih_check_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 srbm_soft_reset = 0;
@@ -384,21 +384,19 @@ static int tonga_ih_check_soft_reset(void *handle)
                                                SOFT_RESET_IH, 1);
        if (srbm_soft_reset) {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_IH].hang = true;
                adev->irq.srbm_soft_reset = srbm_soft_reset;
+                return true;
        } else {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_IH].hang = false;
                adev->irq.srbm_soft_reset = 0;
+                return false;
        }
-        return 0;
 }
 static int tonga_ih_pre_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_IH].hang)
+        if (!adev->irq.srbm_soft_reset)
                return 0;
        return tonga_ih_hw_fini(adev);
@@ -408,7 +406,7 @@ static int tonga_ih_post_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_IH].hang)
+        if (!adev->irq.srbm_soft_reset)
                return 0;
        return tonga_ih_hw_init(adev);
@@ -419,7 +417,7 @@ static int tonga_ih_soft_reset(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 srbm_soft_reset;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_IH].hang)
+        if (!adev->irq.srbm_soft_reset)
                return 0;
        srbm_soft_reset = adev->irq.srbm_soft_reset;
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
index e0fd9f21ed95..ab3df6d75656 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
@@ -770,7 +770,7 @@ static int uvd_v6_0_wait_for_idle(void *handle)
 }
 #define AMDGPU_UVD_STATUS_BUSY_MASK    0xfd
-static int uvd_v6_0_check_soft_reset(void *handle)
+static bool uvd_v6_0_check_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 srbm_soft_reset = 0;
@@ -782,19 +782,19 @@ static int uvd_v6_0_check_soft_reset(void *handle)
                srbm_soft_reset = REG_SET_FIELD(srbm_soft_reset, SRBM_SOFT_RESET, SOFT_RESET_UVD, 1);
        if (srbm_soft_reset) {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_UVD].hang = true;
                adev->uvd.srbm_soft_reset = srbm_soft_reset;
+                return true;
        } else {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_UVD].hang = false;
                adev->uvd.srbm_soft_reset = 0;
+                return false;
        }
-        return 0;
 }
 static int uvd_v6_0_pre_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_UVD].hang)
+        if (!adev->uvd.srbm_soft_reset)
                return 0;
        uvd_v6_0_stop(adev);
@@ -806,7 +806,7 @@ static int uvd_v6_0_soft_reset(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 srbm_soft_reset;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_UVD].hang)
+        if (!adev->uvd.srbm_soft_reset)
                return 0;
        srbm_soft_reset = adev->uvd.srbm_soft_reset;
@@ -836,7 +836,7 @@ static int uvd_v6_0_post_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_UVD].hang)
+        if (!adev->uvd.srbm_soft_reset)
                return 0;
        mdelay(5);
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index 3f6db4ec0102..6feed726e299 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -52,6 +52,8 @@
 #define VCE_V3_0_STACK_SIZE     (64 * 1024)
 #define VCE_V3_0_DATA_SIZE      ((16 * 1024 * AMDGPU_MAX_VCE_HANDLES) + (52 * 1024))
+#define FW_52_8_3       ((52 << 24) | (8 << 16) | (3 << 8))
 static void vce_v3_0_mc_resume(struct amdgpu_device *adev, int idx);
 static void vce_v3_0_set_ring_funcs(struct amdgpu_device *adev);
 static void vce_v3_0_set_irq_funcs(struct amdgpu_device *adev);
@@ -382,6 +384,10 @@ static int vce_v3_0_sw_init(void *handle)
        if (r)
                return r;
+        /* 52.8.3 required for 3 ring support */
+        if (adev->vce.fw_version < FW_52_8_3)
+                adev->vce.num_rings = 2;
        r = amdgpu_vce_resume(adev);
        if (r)
                return r;
@@ -561,7 +567,7 @@ static int vce_v3_0_wait_for_idle(void *handle)
 #define  AMDGPU_VCE_STATUS_BUSY_MASK (VCE_STATUS_VCPU_REPORT_AUTO_BUSY_MASK | \
                                      VCE_STATUS_VCPU_REPORT_RB0_BUSY_MASK)
-static int vce_v3_0_check_soft_reset(void *handle)
+static bool vce_v3_0_check_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 srbm_soft_reset = 0;
@@ -591,16 +597,15 @@ static int vce_v3_0_check_soft_reset(void *handle)
                srbm_soft_reset = REG_SET_FIELD(srbm_soft_reset, SRBM_SOFT_RESET, SOFT_RESET_VCE1, 1);
        }
        WREG32_FIELD(GRBM_GFX_INDEX, INSTANCE_INDEX, 0);
+        mutex_unlock(&adev->grbm_idx_mutex);
        if (srbm_soft_reset) {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_VCE].hang = true;
                adev->vce.srbm_soft_reset = srbm_soft_reset;
+                return true;
        } else {
-                adev->ip_block_status[AMD_IP_BLOCK_TYPE_VCE].hang = false;
                adev->vce.srbm_soft_reset = 0;
+                return false;
        }
-        mutex_unlock(&adev->grbm_idx_mutex);
-        return 0;
 }
 static int vce_v3_0_soft_reset(void *handle)
@@ -608,7 +613,7 @@ static int vce_v3_0_soft_reset(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        u32 srbm_soft_reset;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_VCE].hang)
+        if (!adev->vce.srbm_soft_reset)
                return 0;
        srbm_soft_reset = adev->vce.srbm_soft_reset;
@@ -638,7 +643,7 @@ static int vce_v3_0_pre_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_VCE].hang)
+        if (!adev->vce.srbm_soft_reset)
                return 0;
        mdelay(5);
@@ -651,7 +656,7 @@ static int vce_v3_0_post_soft_reset(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-        if (!adev->ip_block_status[AMD_IP_BLOCK_TYPE_VCE].hang)
+        if (!adev->vce.srbm_soft_reset)
                return 0;
        mdelay(5);
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index c0d9aad7126f..f62f1a74f890 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -80,7 +80,9 @@
 #include "dce_virtual.h"
 MODULE_FIRMWARE("amdgpu/topaz_smc.bin");
+MODULE_FIRMWARE("amdgpu/topaz_k_smc.bin");
 MODULE_FIRMWARE("amdgpu/tonga_smc.bin");
+MODULE_FIRMWARE("amdgpu/tonga_k_smc.bin");
 MODULE_FIRMWARE("amdgpu/fiji_smc.bin");
 MODULE_FIRMWARE("amdgpu/polaris10_smc.bin");
 MODULE_FIRMWARE("amdgpu/polaris10_smc_sk.bin");
@@ -1651,7 +1653,7 @@ static int vi_common_early_init(void *handle)
                        AMD_CG_SUPPORT_SDMA_MGCG |
                        AMD_CG_SUPPORT_SDMA_LS |
                        AMD_CG_SUPPORT_VCE_MGCG;
-                adev->pg_flags |= AMD_PG_SUPPORT_GFX_PG |
+                adev->pg_flags = AMD_PG_SUPPORT_GFX_PG |
                        AMD_PG_SUPPORT_GFX_SMG |
                        AMD_PG_SUPPORT_GFX_PIPELINE |
                        AMD_PG_SUPPORT_UVD |
diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h
index c934b78c9e2f..bec8125bceb0 100644
--- a/drivers/gpu/drm/amd/include/amd_shared.h
+++ b/drivers/gpu/drm/amd/include/amd_shared.h
@@ -165,7 +165,7 @@ struct amd_ip_funcs {
        /* poll for idle */
        int (*wait_for_idle)(void *handle);
        /* check soft reset the IP block */
-        int (*check_soft_reset)(void *handle);
+        bool (*check_soft_reset)(void *handle);
        /* pre soft reset the IP block */
        int (*pre_soft_reset)(void *handle);
        /* soft reset the IP block */
diff --git a/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c b/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
index 92b117843875..8cee4e0f9fde 100644
--- a/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
+++ b/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
@@ -49,6 +49,7 @@ static const pem_event_action * const uninitialize_event[] = {
        uninitialize_display_phy_access_tasks,
        disable_gfx_voltage_island_power_gating_tasks,
        disable_gfx_clock_gating_tasks,
+        uninitialize_thermal_controller_tasks,
        set_boot_state_tasks,
        adjust_power_state_tasks,
        disable_dynamic_state_management_tasks,
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
index 7e4fcbbbe086..960424913496 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
@@ -1785,6 +1785,21 @@ static int cz_get_max_high_clocks(struct pp_hwmgr *hwmgr, struct amd_pp_simple_c
        return 0;
 }
+static int cz_thermal_get_temperature(struct pp_hwmgr *hwmgr)
+{
+        int actual_temp = 0;
+        uint32_t val = cgs_read_ind_register(hwmgr->device,
+                                             CGS_IND_REG__SMC, ixTHM_TCON_CUR_TMP);
+        uint32_t temp = PHM_GET_FIELD(val, THM_TCON_CUR_TMP, CUR_TEMP);
+        if (PHM_GET_FIELD(val, THM_TCON_CUR_TMP, CUR_TEMP_RANGE_SEL))
+                actual_temp = ((temp / 8) - 49) * PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        else
+                actual_temp = (temp / 8) * PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+        return actual_temp;
+}
 static int cz_read_sensor(struct pp_hwmgr *hwmgr, int idx, int32_t *value)
 {
        struct cz_hwmgr *cz_hwmgr = (struct cz_hwmgr *)(hwmgr->backend);
@@ -1881,6 +1896,9 @@ static int cz_read_sensor(struct pp_hwmgr *hwmgr, int idx, int32_t *value)
        case AMDGPU_PP_SENSOR_VCE_POWER:
                *value = cz_hwmgr->vce_power_gated ? 0 : 1;
                return 0;
+        case AMDGPU_PP_SENSOR_GPU_TEMP:
+                *value = cz_thermal_get_temperature(hwmgr);
+                return 0;
        default:
                return -EINVAL;
        }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
index 14f8c1f4da3d..0723758ed065 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
@@ -272,7 +272,7 @@ bool phm_check_smc_update_required_for_display_configuration(struct pp_hwmgr *hw
        PHM_FUNC_CHECK(hwmgr);
        if (hwmgr->hwmgr_func->check_smc_update_required_for_display_configuration == NULL)
-                return -EINVAL;
+                return false;
        return hwmgr->hwmgr_func->check_smc_update_required_for_display_configuration(hwmgr);
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
index 1167205057b3..e03dcb6ea9c1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
@@ -710,13 +710,15 @@ int phm_get_voltage_evv_on_sclk(struct pp_hwmgr *hwmgr, uint8_t voltage_type,
        uint32_t vol;
        int ret = 0;
-        if (hwmgr->chip_id < CHIP_POLARIS10) {
+        if (hwmgr->chip_id < CHIP_TONGA) {
-                atomctrl_get_voltage_evv_on_sclk(hwmgr, voltage_type, sclk, id, voltage);
+                ret = atomctrl_get_voltage_evv(hwmgr, id, voltage);
+        } else if (hwmgr->chip_id < CHIP_POLARIS10) {
+                ret = atomctrl_get_voltage_evv_on_sclk(hwmgr, voltage_type, sclk, id, voltage);
                if (*voltage >= 2000 || *voltage == 0)
                        *voltage = 1150;
        } else {
                ret = atomctrl_get_voltage_evv_on_sclk_ai(hwmgr, voltage_type, sclk, id, &vol);
-                *voltage = (uint16_t)vol/100;
+                *voltage = (uint16_t)(vol/100);
        }
        return ret;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
index 1126bd4f74dc..0894527d932f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
@@ -1320,7 +1320,8 @@ int atomctrl_get_voltage_evv_on_sclk_ai(struct pp_hwmgr *hwmgr, uint8_t voltage_
        if (0 != result)
                return result;
-        *voltage = le32_to_cpu(((GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_3 *)(&get_voltage_info_param_space))->ulVoltageLevel);
+        *voltage = le32_to_cpu(((GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_3 *)
+                                (&get_voltage_info_param_space))->ulVoltageLevel);
        return result;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c b/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
index 7de701d8a450..4477c55a58e3 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
@@ -1201,12 +1201,15 @@ static uint32_t make_classification_flags(struct pp_hwmgr *hwmgr,
 static int ppt_get_num_of_vce_state_table_entries_v1_0(struct pp_hwmgr *hwmgr)
 {
        const ATOM_Tonga_POWERPLAYTABLE *pp_table = get_powerplay_table(hwmgr);
-        const ATOM_Tonga_VCE_State_Table *vce_state_table =
+        const ATOM_Tonga_VCE_State_Table *vce_state_table;
-                                (ATOM_Tonga_VCE_State_Table *)(((unsigned long)pp_table) + le16_to_cpu(pp_table->usVCEStateTableOffset));
-        if (vce_state_table == NULL)
+        if (pp_table == NULL)
                return 0;
+        vce_state_table = (void *)pp_table +
+                        le16_to_cpu(pp_table->usVCEStateTableOffset);
        return vce_state_table->ucNumEntries;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index 508245d49d33..08cd0bd3ebe5 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -1030,20 +1030,19 @@ static int smu7_disable_sclk_mclk_dpm(struct pp_hwmgr *hwmgr)
        struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
        /* disable SCLK dpm */
-        if (!data->sclk_dpm_key_disabled)
+        if (!data->sclk_dpm_key_disabled) {
-                PP_ASSERT_WITH_CODE(
+                PP_ASSERT_WITH_CODE(true == smum_is_dpm_running(hwmgr),
-                                (smum_send_msg_to_smc(hwmgr->smumgr,
+                                "Trying to disable SCLK DPM when DPM is disabled",
-                                                PPSMC_MSG_DPM_Disable) == 0),
+                                return 0);
-                                "Failed to disable SCLK DPM!",
+                smum_send_msg_to_smc(hwmgr->smumgr, PPSMC_MSG_DPM_Disable);
-                                return -EINVAL);
+        }
        /* disable MCLK dpm */
        if (!data->mclk_dpm_key_disabled) {
-                PP_ASSERT_WITH_CODE(
+                PP_ASSERT_WITH_CODE(true == smum_is_dpm_running(hwmgr),
-                                (smum_send_msg_to_smc(hwmgr->smumgr,
+                                "Trying to disable MCLK DPM when DPM is disabled",
-                                                PPSMC_MSG_MCLKDPM_Disable) == 0),
+                                return 0);
-                                "Failed to disable MCLK DPM!",
+                smum_send_msg_to_smc(hwmgr->smumgr, PPSMC_MSG_MCLKDPM_Disable);
-                                return -EINVAL);
        }
        return 0;
@@ -1069,10 +1068,13 @@ static int smu7_stop_dpm(struct pp_hwmgr *hwmgr)
                                return -EINVAL);
        }
-        if (smu7_disable_sclk_mclk_dpm(hwmgr)) {
+        smu7_disable_sclk_mclk_dpm(hwmgr);
-                printk(KERN_ERR "Failed to disable Sclk DPM and Mclk DPM!");
-                return -EINVAL;
+        PP_ASSERT_WITH_CODE(true == smum_is_dpm_running(hwmgr),
-        }
+                        "Trying to disable voltage DPM when DPM is disabled",
+                        return 0);
+        smum_send_msg_to_smc(hwmgr->smumgr, PPSMC_MSG_Voltage_Cntl_Disable);
        return 0;
 }
@@ -1166,8 +1168,8 @@ int smu7_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
        tmp_result = (!smum_is_dpm_running(hwmgr)) ? 0 : -1;
        PP_ASSERT_WITH_CODE(tmp_result == 0,
-                        "DPM is already running right now, no need to enable DPM!",
+                        "DPM is already running",
-                        return 0);
+                        );
        if (smu7_voltage_control(hwmgr)) {
                tmp_result = smu7_enable_voltage_control(hwmgr);
@@ -1226,7 +1228,7 @@ int smu7_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
        PP_ASSERT_WITH_CODE((0 == tmp_result),
                        "Failed to enable VR hot GPIO interrupt!", result = tmp_result);
-        smum_send_msg_to_smc(hwmgr->smumgr, (PPSMC_Msg)PPSMC_HasDisplay);
+        smum_send_msg_to_smc(hwmgr->smumgr, (PPSMC_Msg)PPSMC_NoDisplay);
        tmp_result = smu7_enable_sclk_control(hwmgr);
        PP_ASSERT_WITH_CODE((0 == tmp_result),
@@ -1306,6 +1308,12 @@ int smu7_disable_dpm_tasks(struct pp_hwmgr *hwmgr)
        PP_ASSERT_WITH_CODE((tmp_result == 0),
                        "Failed to disable thermal auto throttle!", result = tmp_result);
+        if (1 == PHM_READ_VFPF_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC, FEATURE_STATUS, AVS_ON)) {
+                PP_ASSERT_WITH_CODE((0 == smum_send_msg_to_smc(hwmgr->smumgr, PPSMC_MSG_DisableAvfs)),
+                                        "Failed to disable AVFS!",
+                                        return -EINVAL);
+        }
        tmp_result = smu7_stop_dpm(hwmgr);
        PP_ASSERT_WITH_CODE((tmp_result == 0),
                        "Failed to stop DPM!", result = tmp_result);
@@ -1452,17 +1460,17 @@ static int smu7_get_evv_voltages(struct pp_hwmgr *hwmgr)
        struct phm_ppt_v1_clock_voltage_dependency_table *sclk_table = NULL;
-        if (table_info != NULL)
-                sclk_table = table_info->vdd_dep_on_sclk;
        for (i = 0; i < SMU7_MAX_LEAKAGE_COUNT; i++) {
                vv_id = ATOM_VIRTUAL_VOLTAGE_ID0 + i;
                if (data->vdd_gfx_control == SMU7_VOLTAGE_CONTROL_BY_SVID2) {
-                        if (0 == phm_get_sclk_for_voltage_evv(hwmgr,
+                        if ((hwmgr->pp_table_version == PP_TABLE_V1)
+                            && !phm_get_sclk_for_voltage_evv(hwmgr,
                                                table_info->vddgfx_lookup_table, vv_id, &sclk)) {
                                if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps,
                                                        PHM_PlatformCaps_ClockStretcher)) {
+                                        sclk_table = table_info->vdd_dep_on_sclk;
                                        for (j = 1; j < sclk_table->count; j++) {
                                                if (sclk_table->entries[j].clk == sclk &&
                                                                sclk_table->entries[j].cks_enable == 0) {
@@ -1488,12 +1496,15 @@ static int smu7_get_evv_voltages(struct pp_hwmgr *hwmgr)
                                }
                        }
                } else {
                        if ((hwmgr->pp_table_version == PP_TABLE_V0)
                                || !phm_get_sclk_for_voltage_evv(hwmgr,
                                        table_info->vddc_lookup_table, vv_id, &sclk)) {
                                if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps,
                                                PHM_PlatformCaps_ClockStretcher)) {
+                                        if (table_info == NULL)
+                                                return -EINVAL;
+                                        sclk_table = table_info->vdd_dep_on_sclk;
                                        for (j = 1; j < sclk_table->count; j++) {
                                                if (sclk_table->entries[j].clk == sclk &&
                                                                sclk_table->entries[j].cks_enable == 0) {
@@ -2117,15 +2128,20 @@ static int smu7_patch_acp_vddc(struct pp_hwmgr *hwmgr,
 }
 static int smu7_patch_limits_vddc(struct pp_hwmgr *hwmgr,
-                                     struct phm_clock_and_voltage_limits *tab)
+                                  struct phm_clock_and_voltage_limits *tab)
 {
+        uint32_t vddc, vddci;
        struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
        if (tab) {
-                smu7_patch_ppt_v0_with_vdd_leakage(hwmgr, (uint32_t *)&tab->vddc,
+                vddc = tab->vddc;
-                                                        &data->vddc_leakage);
+                smu7_patch_ppt_v0_with_vdd_leakage(hwmgr, &vddc,
-                smu7_patch_ppt_v0_with_vdd_leakage(hwmgr, (uint32_t *)&tab->vddci,
+                                                   &data->vddc_leakage);
-                                                        &data->vddci_leakage);
+                tab->vddc = vddc;
+                vddci = tab->vddci;
+                smu7_patch_ppt_v0_with_vdd_leakage(hwmgr, &vddci,
+                                                   &data->vddci_leakage);
+                tab->vddci = vddci;
        }
        return 0;
@@ -2968,19 +2984,19 @@ static int smu7_get_pp_table_entry_callback_func_v0(struct pp_hwmgr *hwmgr,
        if (!(data->mc_micro_code_feature & DISABLE_MC_LOADMICROCODE) && memory_clock > data->highest_mclk)
                data->highest_mclk = memory_clock;
-        performance_level = &(ps->performance_levels
-                        [ps->performance_level_count++]);
        PP_ASSERT_WITH_CODE(
                        (ps->performance_level_count < smum_get_mac_definition(hwmgr->smumgr, SMU_MAX_LEVELS_GRAPHICS)),
                        "Performance levels exceeds SMC limit!",
                        return -EINVAL);
        PP_ASSERT_WITH_CODE(
-                        (ps->performance_level_count <=
+                        (ps->performance_level_count <
                                        hwmgr->platform_descriptor.hardwareActivityPerformanceLevels),
-                        "Performance levels exceeds Driver limit!",
+                        "Performance levels exceeds Driver limit, Skip!",
-                        return -EINVAL);
+                        return 0);
+        performance_level = &(ps->performance_levels
+                        [ps->performance_level_count++]);
        /* Performance levels are arranged from low to high. */
        performance_level->memory_clock = memory_clock;
@@ -3802,13 +3818,15 @@ static inline bool smu7_are_power_levels_equal(const struct smu7_performance_lev
 int smu7_check_states_equal(struct pp_hwmgr *hwmgr, const struct pp_hw_power_state *pstate1, const struct pp_hw_power_state *pstate2, bool *equal)
 {
-        const struct smu7_power_state *psa = cast_const_phw_smu7_power_state(pstate1);
+        const struct smu7_power_state *psa;
-        const struct smu7_power_state *psb = cast_const_phw_smu7_power_state(pstate2);
+        const struct smu7_power_state *psb;
        int i;
        if (pstate1 == NULL || pstate2 == NULL || equal == NULL)
                return -EINVAL;
+        psa = cast_const_phw_smu7_power_state(pstate1);
+        psb = cast_const_phw_smu7_power_state(pstate2);
        /* If the two states don't even have the same number of performance levels they cannot be the same state. */
        if (psa->performance_level_count != psb->performance_level_count) {
                *equal = false;
@@ -4213,18 +4231,26 @@ static int smu7_get_sclks(struct pp_hwmgr *hwmgr, struct amd_pp_clocks *clocks)
 {
        struct phm_ppt_v1_information *table_info =
                        (struct phm_ppt_v1_information *)hwmgr->pptable;
-        struct phm_ppt_v1_clock_voltage_dependency_table *dep_sclk_table;
+        struct phm_ppt_v1_clock_voltage_dependency_table *dep_sclk_table = NULL;
+        struct phm_clock_voltage_dependency_table *sclk_table;
        int i;
-        if (table_info == NULL)
+        if (hwmgr->pp_table_version == PP_TABLE_V1) {
-                return -EINVAL;
+                if (table_info == NULL || table_info->vdd_dep_on_sclk == NULL)
+                        return -EINVAL;
-        dep_sclk_table = table_info->vdd_dep_on_sclk;
+                dep_sclk_table = table_info->vdd_dep_on_sclk;
+                for (i = 0; i < dep_sclk_table->count; i++) {
-        for (i = 0; i < dep_sclk_table->count; i++) {
+                        clocks->clock[i] = dep_sclk_table->entries[i].clk;
-                clocks->clock[i] = dep_sclk_table->entries[i].clk;
+                        clocks->count++;
-                clocks->count++;
+                }
+        } else if (hwmgr->pp_table_version == PP_TABLE_V0) {
+                sclk_table = hwmgr->dyn_state.vddc_dependency_on_sclk;
+                for (i = 0; i < sclk_table->count; i++) {
+                        clocks->clock[i] = sclk_table->entries[i].clk;
+                        clocks->count++;
+                }
        }
        return 0;
 }
@@ -4246,17 +4272,24 @@ static int smu7_get_mclks(struct pp_hwmgr *hwmgr, struct amd_pp_clocks *clocks)
                        (struct phm_ppt_v1_information *)hwmgr->pptable;
        struct phm_ppt_v1_clock_voltage_dependency_table *dep_mclk_table;
        int i;
+        struct phm_clock_voltage_dependency_table *mclk_table;
-        if (table_info == NULL)
+        if (hwmgr->pp_table_version == PP_TABLE_V1) {
-                return -EINVAL;
+                if (table_info == NULL)
+                        return -EINVAL;
-        dep_mclk_table = table_info->vdd_dep_on_mclk;
+                dep_mclk_table = table_info->vdd_dep_on_mclk;
+                for (i = 0; i < dep_mclk_table->count; i++) {
-        for (i = 0; i < dep_mclk_table->count; i++) {
+                        clocks->clock[i] = dep_mclk_table->entries[i].clk;
-                clocks->clock[i] = dep_mclk_table->entries[i].clk;
+                        clocks->latency[i] = smu7_get_mem_latency(hwmgr,
-                clocks->latency[i] = smu7_get_mem_latency(hwmgr,
                                                dep_mclk_table->entries[i].clk);
-                clocks->count++;
+                        clocks->count++;
+                }
+        } else if (hwmgr->pp_table_version == PP_TABLE_V0) {
+                mclk_table = hwmgr->dyn_state.vddc_dependency_on_mclk;
+                for (i = 0; i < mclk_table->count; i++) {
+                        clocks->clock[i] = mclk_table->entries[i].clk;
+                        clocks->count++;
+                }
        }
        return 0;
 }
@@ -4324,6 +4357,7 @@ static const struct pp_hwmgr_func smu7_hwmgr_funcs = {
        .set_mclk_od = smu7_set_mclk_od,
        .get_clock_by_type = smu7_get_clock_by_type,
        .read_sensor = smu7_read_sensor,
+        .dynamic_state_management_disable = smu7_disable_dpm_tasks,
 };
 uint8_t smu7_get_sleep_divider_id_from_clock(uint32_t clock,
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_thermal.c
index fb6c6f6106d5..29d0319b22e6 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_thermal.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_thermal.c
@@ -30,7 +30,7 @@ int smu7_fan_ctrl_get_fan_speed_info(struct pp_hwmgr *hwmgr,
                struct phm_fan_speed_info *fan_speed_info)
 {
        if (hwmgr->thermal_controller.fanInfo.bNoFan)
-                return 0;
+                return -ENODEV;
        fan_speed_info->supports_percent_read = true;
        fan_speed_info->supports_percent_write = true;
@@ -60,7 +60,7 @@ int smu7_fan_ctrl_get_fan_speed_percent(struct pp_hwmgr *hwmgr,
        uint64_t tmp64;
        if (hwmgr->thermal_controller.fanInfo.bNoFan)
-                return 0;
+                return -ENODEV;
        duty100 = PHM_READ_VFPF_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC,
                        CG_FDO_CTRL1, FMAX_DUTY100);
@@ -89,7 +89,7 @@ int smu7_fan_ctrl_get_fan_speed_rpm(struct pp_hwmgr *hwmgr, uint32_t *speed)
        if (hwmgr->thermal_controller.fanInfo.bNoFan ||
                        (hwmgr->thermal_controller.fanInfo.
                                ucTachometerPulsesPerRevolution == 0))
-                return 0;
+                return -ENODEV;
        tach_period = PHM_READ_VFPF_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC,
                        CG_TACH_STATUS, TACH_PERIOD);
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c
index eda802bc63c8..8c889caba420 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c
@@ -2458,7 +2458,7 @@ static int iceland_set_mc_special_registers(struct pp_hwmgr *hwmgr,
                        PP_ASSERT_WITH_CODE((j <= SMU71_DISCRETE_MC_REGISTER_ARRAY_SIZE),
                                "Invalid VramInfo table.", return -EINVAL);
-                        if (!data->is_memory_gddr5) {
+                        if (!data->is_memory_gddr5 && j < SMU71_DISCRETE_MC_REGISTER_ARRAY_SIZE) {
                                table->mc_reg_address[j].s1 = mmMC_PMG_AUTO_CMD;
                                table->mc_reg_address[j].s0 = mmMC_PMG_AUTO_CMD;
                                for (k = 0; k < table->num_entries; k++) {
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c
index 4ccc0b72324d..71bb2f8dc157 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c
@@ -2214,6 +2214,7 @@ uint32_t polaris10_get_mac_definition(uint32_t value)
 int polaris10_process_firmware_header(struct pp_hwmgr *hwmgr)
 {
        struct polaris10_smumgr *smu_data = (struct polaris10_smumgr *)(hwmgr->smumgr->backend);
+        struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
        uint32_t tmp;
        int result;
        bool error = false;
@@ -2233,8 +2234,10 @@ int polaris10_process_firmware_header(struct pp_hwmgr *hwmgr)
                        offsetof(SMU74_Firmware_Header, SoftRegisters),
                        &tmp, SMC_RAM_END);
-        if (!result)
+        if (!result) {
+                data->soft_regs_start = tmp;
                smu_data->smu7_data.soft_regs_start = tmp;
+        }
        error |= (0 != result);
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
index 963a24d46a93..ffe1f85ce300 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
@@ -34,9 +34,6 @@ static bool amd_sched_entity_is_ready(struct amd_sched_entity *entity);
 static void amd_sched_wakeup(struct amd_gpu_scheduler *sched);
 static void amd_sched_process_job(struct fence *f, struct fence_cb *cb);
-struct kmem_cache *sched_fence_slab;
-atomic_t sched_fence_slab_ref = ATOMIC_INIT(0);
 /* Initialize a given run queue struct */
 static void amd_sched_rq_init(struct amd_sched_rq *rq)
 {
@@ -618,13 +615,6 @@ int amd_sched_init(struct amd_gpu_scheduler *sched,
        INIT_LIST_HEAD(&sched->ring_mirror_list);
        spin_lock_init(&sched->job_list_lock);
        atomic_set(&sched->hw_rq_count, 0);
-        if (atomic_inc_return(&sched_fence_slab_ref) == 1) {
-                sched_fence_slab = kmem_cache_create(
-                        "amd_sched_fence", sizeof(struct amd_sched_fence), 0,
-                        SLAB_HWCACHE_ALIGN, NULL);
-                if (!sched_fence_slab)
-                        return -ENOMEM;
-        }
        /* Each scheduler will run on a seperate kernel thread */
        sched->thread = kthread_run(amd_sched_main, sched, sched->name);
@@ -645,6 +635,4 @@ void amd_sched_fini(struct amd_gpu_scheduler *sched)
 {
        if (sched->thread)
                kthread_stop(sched->thread);
-        if (atomic_dec_and_test(&sched_fence_slab_ref))
-                kmem_cache_destroy(sched_fence_slab);
 }
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
index 7cbbbfb502ef..51068e6c3d9a 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
@@ -30,9 +30,6 @@
 struct amd_gpu_scheduler;
 struct amd_sched_rq;
-extern struct kmem_cache *sched_fence_slab;
-extern atomic_t sched_fence_slab_ref;
 /**
 * A scheduler entity is a wrapper around a job queue or a group
 * of other entities. Entities take turns emitting jobs from their
@@ -145,6 +142,9 @@ void amd_sched_entity_fini(struct amd_gpu_scheduler *sched,
                           struct amd_sched_entity *entity);
 void amd_sched_entity_push_job(struct amd_sched_job *sched_job);
+int amd_sched_fence_slab_init(void);
+void amd_sched_fence_slab_fini(void);
 struct amd_sched_fence *amd_sched_fence_create(
        struct amd_sched_entity *s_entity, void *owner);
 void amd_sched_fence_scheduled(struct amd_sched_fence *fence);
diff --git a/drivers/gpu/drm/amd/scheduler/sched_fence.c b/drivers/gpu/drm/amd/scheduler/sched_fence.c
index 6b63beaf7574..88fc2d662579 100644
--- a/drivers/gpu/drm/amd/scheduler/sched_fence.c
+++ b/drivers/gpu/drm/amd/scheduler/sched_fence.c
@@ -27,6 +27,25 @@
 #include <drm/drmP.h>
 #include "gpu_scheduler.h"
+static struct kmem_cache *sched_fence_slab;
+int amd_sched_fence_slab_init(void)
+{
+        sched_fence_slab = kmem_cache_create(
+                "amd_sched_fence", sizeof(struct amd_sched_fence), 0,
+                SLAB_HWCACHE_ALIGN, NULL);
+        if (!sched_fence_slab)
+                return -ENOMEM;
+        return 0;
+}
+void amd_sched_fence_slab_fini(void)
+{
+        rcu_barrier();
+        kmem_cache_destroy(sched_fence_slab);
+}
 struct amd_sched_fence *amd_sched_fence_create(struct amd_sched_entity *entity,
                                               void *owner)
 {
@@ -103,7 +122,7 @@ static void amd_sched_fence_free(struct rcu_head *rcu)
 }
 /**
- * amd_sched_fence_release - callback that fence can be freed
+ * amd_sched_fence_release_scheduled - callback that fence can be freed
 *
 * @fence: fence
 *
@@ -118,7 +137,7 @@ static void amd_sched_fence_release_scheduled(struct fence *f)
 }
 /**
- * amd_sched_fence_release_scheduled - drop extra reference
+ * amd_sched_fence_release_finished - drop extra reference
 *
 * @f: fence
 *
diff --git a/drivers/gpu/drm/arc/arcpgu_hdmi.c b/drivers/gpu/drm/arc/arcpgu_hdmi.c
index b7a8b2ac4055..b69c66b4897e 100644
--- a/drivers/gpu/drm/arc/arcpgu_hdmi.c
+++ b/drivers/gpu/drm/arc/arcpgu_hdmi.c
@@ -14,170 +14,45 @@
 *
 */
-#include <drm/drm_crtc_helper.h>
+#include <drm/drm_crtc.h>
 #include <drm/drm_encoder_slave.h>
-#include <drm/drm_atomic_helper.h>
 #include "arcpgu.h"
-struct arcpgu_drm_connector {
-        struct drm_connector connector;
-        struct drm_encoder_slave *encoder_slave;
-};
-static int arcpgu_drm_connector_get_modes(struct drm_connector *connector)
-{
-        const struct drm_encoder_slave_funcs *sfuncs;
-        struct drm_encoder_slave *slave;
-        struct arcpgu_drm_connector *con =
-                container_of(connector, struct arcpgu_drm_connector, connector);
-        slave = con->encoder_slave;
-        if (slave == NULL) {
-                dev_err(connector->dev->dev,
-                        "connector_get_modes: cannot find slave encoder for connector\n");
-                return 0;
-        }
-        sfuncs = slave->slave_funcs;
-        if (sfuncs->get_modes == NULL)
-                return 0;
-        return sfuncs->get_modes(&slave->base, connector);
-}
-static enum drm_connector_status
-arcpgu_drm_connector_detect(struct drm_connector *connector, bool force)
-{
-        enum drm_connector_status status = connector_status_unknown;
-        const struct drm_encoder_slave_funcs *sfuncs;
-        struct drm_encoder_slave *slave;
-        struct arcpgu_drm_connector *con =
-                container_of(connector, struct arcpgu_drm_connector, connector);
-        slave = con->encoder_slave;
-        if (slave == NULL) {
-                dev_err(connector->dev->dev,
-                        "connector_detect: cannot find slave encoder for connector\n");
-                return status;
-        }
-        sfuncs = slave->slave_funcs;
-        if (sfuncs && sfuncs->detect)
-                return sfuncs->detect(&slave->base, connector);
-        dev_err(connector->dev->dev, "connector_detect: could not detect slave funcs\n");
-        return status;
-}
-static void arcpgu_drm_connector_destroy(struct drm_connector *connector)
-{
-        drm_connector_unregister(connector);
-        drm_connector_cleanup(connector);
-}
-static const struct drm_connector_helper_funcs
-arcpgu_drm_connector_helper_funcs = {
-        .get_modes = arcpgu_drm_connector_get_modes,
-};
-static const struct drm_connector_funcs arcpgu_drm_connector_funcs = {
-        .dpms = drm_helper_connector_dpms,
-        .reset = drm_atomic_helper_connector_reset,
-        .detect = arcpgu_drm_connector_detect,
-        .fill_modes = drm_helper_probe_single_connector_modes,
-        .destroy = arcpgu_drm_connector_destroy,
-        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
-        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
-};
-static struct drm_encoder_helper_funcs arcpgu_drm_encoder_helper_funcs = {
-        .dpms = drm_i2c_encoder_dpms,
-        .mode_fixup = drm_i2c_encoder_mode_fixup,
-        .mode_set = drm_i2c_encoder_mode_set,
-        .prepare = drm_i2c_encoder_prepare,
-        .commit = drm_i2c_encoder_commit,
-        .detect = drm_i2c_encoder_detect,
-};
 static struct drm_encoder_funcs arcpgu_drm_encoder_funcs = {
        .destroy = drm_encoder_cleanup,
 };
 int arcpgu_drm_hdmi_init(struct drm_device *drm, struct device_node *np)
 {
-        struct arcpgu_drm_connector *arcpgu_connector;
+        struct drm_encoder *encoder;
-        struct drm_i2c_encoder_driver *driver;
+        struct drm_bridge *bridge;
-        struct drm_encoder_slave *encoder;
-        struct drm_connector *connector;
+        int ret = 0;
-        struct i2c_client *i2c_slave;
-        int ret;
        encoder = devm_kzalloc(drm->dev, sizeof(*encoder), GFP_KERNEL);
        if (encoder == NULL)
                return -ENOMEM;
-        i2c_slave = of_find_i2c_device_by_node(np);
+        /* Locate drm bridge from the hdmi encoder DT node */
-        if (!i2c_slave || !i2c_get_clientdata(i2c_slave)) {
+        bridge = of_drm_find_bridge(np);
-                dev_err(drm->dev, "failed to find i2c slave encoder\n");
+        if (!bridge)
-                return -EPROBE_DEFER;
-        }
-        if (i2c_slave->dev.driver == NULL) {
-                dev_err(drm->dev, "failed to find i2c slave driver\n");
                return -EPROBE_DEFER;
-        }
-        driver =
+        encoder->possible_crtcs = 1;
-            to_drm_i2c_encoder_driver(to_i2c_driver(i2c_slave->dev.driver));
+        encoder->possible_clones = 0;
-        ret = driver->encoder_init(i2c_slave, drm, encoder);
+        ret = drm_encoder_init(drm, encoder, &arcpgu_drm_encoder_funcs,
-        if (ret) {
-                dev_err(drm->dev, "failed to initialize i2c encoder slave\n");
-                return ret;
-        }
-        encoder->base.possible_crtcs = 1;
-        encoder->base.possible_clones = 0;
-        ret = drm_encoder_init(drm, &encoder->base, &arcpgu_drm_encoder_funcs,
                               DRM_MODE_ENCODER_TMDS, NULL);
        if (ret)
                return ret;
-        drm_encoder_helper_add(&encoder->base,
+        /* Link drm_bridge to encoder */
-                               &arcpgu_drm_encoder_helper_funcs);
+        bridge->encoder = encoder;
+        encoder->bridge = bridge;
-        arcpgu_connector = devm_kzalloc(drm->dev, sizeof(*arcpgu_connector),
-                                        GFP_KERNEL);
-        if (!arcpgu_connector) {
-                ret = -ENOMEM;
-                goto error_encoder_cleanup;
-        }
-        connector = &arcpgu_connector->connector;
-        drm_connector_helper_add(connector, &arcpgu_drm_connector_helper_funcs);
-        ret = drm_connector_init(drm, connector, &arcpgu_drm_connector_funcs,
-                        DRM_MODE_CONNECTOR_HDMIA);
-        if (ret < 0) {
-                dev_err(drm->dev, "failed to initialize drm connector\n");
-                goto error_encoder_cleanup;
-        }
-        ret = drm_mode_connector_attach_encoder(connector, &encoder->base);
+        ret = drm_bridge_attach(drm, bridge);
-        if (ret < 0) {
+        if (ret)
-                dev_err(drm->dev, "could not attach connector to encoder\n");
+                drm_encoder_cleanup(encoder);
-                drm_connector_unregister(connector);
-                goto error_connector_cleanup;
-        }
-        arcpgu_connector->encoder_slave = encoder;
-        return 0;
-error_connector_cleanup:
-        drm_connector_cleanup(connector);
-error_encoder_cleanup:
-        drm_encoder_cleanup(&encoder->base);
        return ret;
 }
diff --git a/drivers/gpu/drm/arm/hdlcd_crtc.c b/drivers/gpu/drm/arm/hdlcd_crtc.c
index 48019ae22ddb..28341b32067f 100644
--- a/drivers/gpu/drm/arm/hdlcd_crtc.c
+++ b/drivers/gpu/drm/arm/hdlcd_crtc.c
@@ -150,15 +150,14 @@ static void hdlcd_crtc_enable(struct drm_crtc *crtc)
        clk_prepare_enable(hdlcd->clk);
        hdlcd_crtc_mode_set_nofb(crtc);
        hdlcd_write(hdlcd, HDLCD_REG_COMMAND, 1);
+        drm_crtc_vblank_on(crtc);
 }
 static void hdlcd_crtc_disable(struct drm_crtc *crtc)
 {
        struct hdlcd_drm_private *hdlcd = crtc_to_hdlcd_priv(crtc);
-        if (!crtc->state->active)
+        drm_crtc_vblank_off(crtc);
-                return;
        hdlcd_write(hdlcd, HDLCD_REG_COMMAND, 0);
        clk_disable_unprepare(hdlcd->clk);
 }
diff --git a/drivers/gpu/drm/arm/hdlcd_drv.c b/drivers/gpu/drm/arm/hdlcd_drv.c
index fb6a418ce6be..e138fb51e8ce 100644
--- a/drivers/gpu/drm/arm/hdlcd_drv.c
+++ b/drivers/gpu/drm/arm/hdlcd_drv.c
@@ -375,7 +375,6 @@ static int hdlcd_drm_bind(struct device *dev)
 err_fbdev:
        drm_kms_helper_poll_fini(drm);
-        drm_mode_config_cleanup(drm);
        drm_vblank_cleanup(drm);
 err_vblank:
        pm_runtime_disable(drm->dev);
@@ -387,6 +386,7 @@ err_unload:
        drm_irq_uninstall(drm);
        of_reserved_mem_device_release(drm->dev);
 err_free:
+        drm_mode_config_cleanup(drm);
        dev_set_drvdata(dev, NULL);
        drm_dev_unref(drm);
diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
index 2f58e9e2a59c..a51f8cbcfe26 100644
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -332,17 +332,19 @@ static void armada_drm_crtc_dpms(struct drm_crtc *crtc, int dpms)
 {
        struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
-        if (dcrtc->dpms != dpms) {
+        if (dpms_blanked(dcrtc->dpms) != dpms_blanked(dpms)) {
-                dcrtc->dpms = dpms;
-                if (!IS_ERR(dcrtc->clk) && !dpms_blanked(dpms))
-                        WARN_ON(clk_prepare_enable(dcrtc->clk));
-                armada_drm_crtc_update(dcrtc);
-                if (!IS_ERR(dcrtc->clk) && dpms_blanked(dpms))
-                        clk_disable_unprepare(dcrtc->clk);
                if (dpms_blanked(dpms))
                        armada_drm_vblank_off(dcrtc);
-                else
+                else if (!IS_ERR(dcrtc->clk))
+                        WARN_ON(clk_prepare_enable(dcrtc->clk));
+                dcrtc->dpms = dpms;
+                armada_drm_crtc_update(dcrtc);
+                if (!dpms_blanked(dpms))
                        drm_crtc_vblank_on(&dcrtc->crtc);
+                else if (!IS_ERR(dcrtc->clk))
+                        clk_disable_unprepare(dcrtc->clk);
+        } else if (dcrtc->dpms != dpms) {
+                dcrtc->dpms = dpms;
        }
 }
diff --git a/drivers/gpu/drm/ast/ast_ttm.c b/drivers/gpu/drm/ast/ast_ttm.c
index 608df4c90520..0743e65cb240 100644
--- a/drivers/gpu/drm/ast/ast_ttm.c
+++ b/drivers/gpu/drm/ast/ast_ttm.c
@@ -267,6 +267,8 @@ int ast_mm_init(struct ast_private *ast)
                return ret;
        }
+        arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                   pci_resource_len(dev->pdev, 0));
        ast->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0),
                                        pci_resource_len(dev->pdev, 0));
@@ -275,11 +277,15 @@ int ast_mm_init(struct ast_private *ast)
 void ast_mm_fini(struct ast_private *ast)
 {
+        struct drm_device *dev = ast->dev;
        ttm_bo_device_release(&ast->ttm.bdev);
        ast_ttm_global_release(ast);
        arch_phys_wc_del(ast->fb_mtrr);
+        arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                pci_resource_len(dev->pdev, 0));
 }
 void ast_ttm_placement(struct ast_bo *bo, int domain)
diff --git a/drivers/gpu/drm/cirrus/cirrus_ttm.c b/drivers/gpu/drm/cirrus/cirrus_ttm.c
index bb2438dd8733..5e7e63ce7bce 100644
--- a/drivers/gpu/drm/cirrus/cirrus_ttm.c
+++ b/drivers/gpu/drm/cirrus/cirrus_ttm.c
@@ -267,6 +267,9 @@ int cirrus_mm_init(struct cirrus_device *cirrus)
                return ret;
        }
+        arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                   pci_resource_len(dev->pdev, 0));
        cirrus->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0),
                                           pci_resource_len(dev->pdev, 0));
@@ -276,6 +279,8 @@ int cirrus_mm_init(struct cirrus_device *cirrus)
 void cirrus_mm_fini(struct cirrus_device *cirrus)
 {
+        struct drm_device *dev = cirrus->dev;
        if (!cirrus->mm_inited)
                return;
@@ -285,6 +290,8 @@ void cirrus_mm_fini(struct cirrus_device *cirrus)
        arch_phys_wc_del(cirrus->fb_mtrr);
        cirrus->fb_mtrr = 0;
+        arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                pci_resource_len(dev->pdev, 0));
 }
 void cirrus_ttm_placement(struct cirrus_bo *bo, int domain)
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 23739609427d..e6862a744210 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -420,18 +420,21 @@ drm_atomic_replace_property_blob_from_id(struct drm_crtc *crtc,
                                         ssize_t expected_size,
                                         bool *replaced)
 {
-        struct drm_device *dev = crtc->dev;
        struct drm_property_blob *new_blob = NULL;
        if (blob_id != 0) {
-                new_blob = drm_property_lookup_blob(dev, blob_id);
+                new_blob = drm_property_lookup_blob(crtc->dev, blob_id);
                if (new_blob == NULL)
                        return -EINVAL;
-                if (expected_size > 0 && expected_size != new_blob->length)
+                if (expected_size > 0 && expected_size != new_blob->length) {
+                        drm_property_unreference_blob(new_blob);
                        return -EINVAL;
+                }
        }
        drm_atomic_replace_property_blob(blob, new_blob, replaced);
+        drm_property_unreference_blob(new_blob);
        return 0;
 }
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index c3f83476f996..21f992605541 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -594,10 +594,6 @@ drm_atomic_helper_check_planes(struct drm_device *dev,
        struct drm_plane_state *plane_state;
        int i, ret = 0;
-        ret = drm_atomic_normalize_zpos(dev, state);
-        if (ret)
-                return ret;
        for_each_plane_in_state(state, plane, plane_state, i) {
                const struct drm_plane_helper_funcs *funcs;
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 04e457117980..aa644487749c 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -914,6 +914,7 @@ static void drm_dp_destroy_port(struct kref *kref)
                /* no need to clean up vcpi
                 * as if we have no connector we never setup a vcpi */
                drm_dp_port_teardown_pdt(port, port->pdt);
+                port->pdt = DP_PEER_DEVICE_NONE;
        }
        kfree(port);
 }
@@ -1159,7 +1160,9 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
                        drm_dp_put_port(port);
                        goto out;
                }
-                if (port->port_num >= DP_MST_LOGICAL_PORT_0) {
+                if ((port->pdt == DP_PEER_DEVICE_DP_LEGACY_CONV ||
+                     port->pdt == DP_PEER_DEVICE_SST_SINK) &&
+                    port->port_num >= DP_MST_LOGICAL_PORT_0) {
                        port->cached_edid = drm_get_edid(port->connector, &port->aux.ddc);
                        drm_mode_connector_set_tile_property(port->connector);
                }
@@ -2919,6 +2922,7 @@ static void drm_dp_destroy_connector_work(struct work_struct *work)
                mgr->cbs->destroy_connector(mgr, port->connector);
                drm_dp_port_teardown_pdt(port, port->pdt);
+                port->pdt = DP_PEER_DEVICE_NONE;
                if (!port->input && port->vcpi.vcpi > 0) {
                        drm_dp_mst_reset_vcpi_slots(mgr, port);
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 03414bde1f15..6c75e62c0b22 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -131,7 +131,12 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
        return 0;
 fail:
        for (i = 0; i < fb_helper->connector_count; i++) {
-                kfree(fb_helper->connector_info[i]);
+                struct drm_fb_helper_connector *fb_helper_connector =
+                        fb_helper->connector_info[i];
+                drm_connector_unreference(fb_helper_connector->connector);
+                kfree(fb_helper_connector);
                fb_helper->connector_info[i] = NULL;
        }
        fb_helper->connector_count = 0;
@@ -603,6 +608,24 @@ int drm_fb_helper_blank(int blank, struct fb_info *info)
 }
 EXPORT_SYMBOL(drm_fb_helper_blank);
+static void drm_fb_helper_modeset_release(struct drm_fb_helper *helper,
+                                          struct drm_mode_set *modeset)
+{
+        int i;
+        for (i = 0; i < modeset->num_connectors; i++) {
+                drm_connector_unreference(modeset->connectors[i]);
+                modeset->connectors[i] = NULL;
+        }
+        modeset->num_connectors = 0;
+        drm_mode_destroy(helper->dev, modeset->mode);
+        modeset->mode = NULL;
+        /* FIXME should hold a ref? */
+        modeset->fb = NULL;
+}
 static void drm_fb_helper_crtc_free(struct drm_fb_helper *helper)
 {
        int i;
@@ -612,10 +635,12 @@ static void drm_fb_helper_crtc_free(struct drm_fb_helper *helper)
                kfree(helper->connector_info[i]);
        }
        kfree(helper->connector_info);
        for (i = 0; i < helper->crtc_count; i++) {
-                kfree(helper->crtc_info[i].mode_set.connectors);
+                struct drm_mode_set *modeset = &helper->crtc_info[i].mode_set;
-                if (helper->crtc_info[i].mode_set.mode)
-                        drm_mode_destroy(helper->dev, helper->crtc_info[i].mode_set.mode);
+                drm_fb_helper_modeset_release(helper, modeset);
+                kfree(modeset->connectors);
        }
        kfree(helper->crtc_info);
 }
@@ -644,7 +669,9 @@ static void drm_fb_helper_dirty_work(struct work_struct *work)
        clip->x2 = clip->y2 = 0;
        spin_unlock_irqrestore(&helper->dirty_lock, flags);
-        helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1);
+        /* call dirty callback only when it has been really touched */
+        if (clip_copy.x1 < clip_copy.x2 && clip_copy.y1 < clip_copy.y2)
+                helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1);
 }
 /**
@@ -2088,7 +2115,6 @@ static void drm_setup_crtcs(struct drm_fb_helper *fb_helper)
        struct drm_fb_helper_crtc **crtcs;
        struct drm_display_mode **modes;
        struct drm_fb_offset *offsets;
-        struct drm_mode_set *modeset;
        bool *enabled;
        int width, height;
        int i;
@@ -2136,45 +2162,35 @@ static void drm_setup_crtcs(struct drm_fb_helper *fb_helper)
        /* need to set the modesets up here for use later */
        /* fill out the connector<->crtc mappings into the modesets */
-        for (i = 0; i < fb_helper->crtc_count; i++) {
+        for (i = 0; i < fb_helper->crtc_count; i++)
-                modeset = &fb_helper->crtc_info[i].mode_set;
+                drm_fb_helper_modeset_release(fb_helper,
-                modeset->num_connectors = 0;
+                                              &fb_helper->crtc_info[i].mode_set);
-                modeset->fb = NULL;
-        }
        for (i = 0; i < fb_helper->connector_count; i++) {
                struct drm_display_mode *mode = modes[i];
                struct drm_fb_helper_crtc *fb_crtc = crtcs[i];
                struct drm_fb_offset *offset = &offsets[i];
-                modeset = &fb_crtc->mode_set;
+                struct drm_mode_set *modeset = &fb_crtc->mode_set;
                if (mode && fb_crtc) {
+                        struct drm_connector *connector =
+                                fb_helper->connector_info[i]->connector;
                        DRM_DEBUG_KMS("desired mode %s set on crtc %d (%d,%d)\n",
                                      mode->name, fb_crtc->mode_set.crtc->base.id, offset->x, offset->y);
                        fb_crtc->desired_mode = mode;
                        fb_crtc->x = offset->x;
                        fb_crtc->y = offset->y;
-                        if (modeset->mode)
-                                drm_mode_destroy(dev, modeset->mode);
                        modeset->mode = drm_mode_duplicate(dev,
                                                           fb_crtc->desired_mode);
-                        modeset->connectors[modeset->num_connectors++] = fb_helper->connector_info[i]->connector;
+                        drm_connector_reference(connector);
+                        modeset->connectors[modeset->num_connectors++] = connector;
                        modeset->fb = fb_helper->fb;
                        modeset->x = offset->x;
                        modeset->y = offset->y;
                }
        }
-        /* Clear out any old modes if there are no more connected outputs. */
-        for (i = 0; i < fb_helper->crtc_count; i++) {
-                modeset = &fb_helper->crtc_info[i].mode_set;
-                if (modeset->num_connectors == 0) {
-                        BUG_ON(modeset->fb);
-                        if (modeset->mode)
-                                drm_mode_destroy(dev, modeset->mode);
-                        modeset->mode = NULL;
-                }
-        }
 out:
        kfree(crtcs);
        kfree(modes);
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
index 1df2d33d0b40..ffb2ab389d1d 100644
--- a/drivers/gpu/drm/drm_info.c
+++ b/drivers/gpu/drm/drm_info.c
@@ -54,9 +54,6 @@ int drm_name_info(struct seq_file *m, void *data)
        mutex_lock(&dev->master_mutex);
        master = dev->master;
-        if (!master)
-                goto out_unlock;
        seq_printf(m, "%s", dev->driver->name);
        if (dev->dev)
                seq_printf(m, " dev=%s", dev_name(dev->dev));
@@ -65,7 +62,6 @@ int drm_name_info(struct seq_file *m, void *data)
        if (dev->unique)
                seq_printf(m, " unique=%s", dev->unique);
        seq_printf(m, "\n");
-out_unlock:
        mutex_unlock(&dev->master_mutex);
        return 0;
diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index 0ad2c47f808f..71c3473476c7 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -254,10 +254,12 @@ static int drm_getcap(struct drm_device *dev, void *data, struct drm_file *file_
                req->value = dev->mode_config.async_page_flip;
                break;
        case DRM_CAP_PAGE_FLIP_TARGET:
-                req->value = 1;
+                if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                drm_for_each_crtc(crtc, dev) {
+                        req->value = 1;
-                        if (!crtc->funcs->page_flip_target)
+                        drm_for_each_crtc(crtc, dev) {
-                                req->value = 0;
+                                if (!crtc->funcs->page_flip_target)
+                                        req->value = 0;
+                        }
                }
                break;
        case DRM_CAP_CURSOR_WIDTH:
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
index cb86c7e5495c..d9230132dfbc 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
@@ -329,20 +329,34 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, unsigned int event,
        /*
         * Append a LINK to the submitted command buffer to return to
         * the ring buffer.  return_target is the ring target address.
-         * We need three dwords: event, wait, link.
+         * We need at most 7 dwords in the return target: 2 cache flush +
+         * 2 semaphore stall + 1 event + 1 wait + 1 link.
         */
-        return_dwords = 3;
+        return_dwords = 7;
        return_target = etnaviv_buffer_reserve(gpu, buffer, return_dwords);
        CMD_LINK(cmdbuf, return_dwords, return_target);
        /*
-         * Append event, wait and link pointing back to the wait
+         * Append a cache flush, stall, event, wait and link pointing back to
-         * command to the ring buffer.
+         * the wait command to the ring buffer.
         */
+        if (gpu->exec_state == ETNA_PIPE_2D) {
+                CMD_LOAD_STATE(buffer, VIVS_GL_FLUSH_CACHE,
+                                       VIVS_GL_FLUSH_CACHE_PE2D);
+        } else {
+                CMD_LOAD_STATE(buffer, VIVS_GL_FLUSH_CACHE,
+                                       VIVS_GL_FLUSH_CACHE_DEPTH |
+                                       VIVS_GL_FLUSH_CACHE_COLOR);
+                CMD_LOAD_STATE(buffer, VIVS_TS_FLUSH_CACHE,
+                                       VIVS_TS_FLUSH_CACHE_FLUSH);
+        }
+        CMD_SEM(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_PE);
+        CMD_STALL(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_PE);
        CMD_LOAD_STATE(buffer, VIVS_GL_EVENT, VIVS_GL_EVENT_EVENT_ID(event) |
                       VIVS_GL_EVENT_FROM_PE);
        CMD_WAIT(buffer);
-        CMD_LINK(buffer, 2, return_target + 8);
+        CMD_LINK(buffer, 2, etnaviv_iommu_get_cmdbuf_va(gpu, buffer) +
+                            buffer->user_size - 4);
        if (drm_debug & DRM_UT_DRIVER)
                pr_info("stream link to 0x%08x @ 0x%08x %p\n",
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
index 5ce3603e6eac..0370b842d9cc 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -748,19 +748,22 @@ static struct page **etnaviv_gem_userptr_do_get_pages(
        int ret = 0, pinned, npages = etnaviv_obj->base.size >> PAGE_SHIFT;
        struct page **pvec;
        uintptr_t ptr;
+        unsigned int flags = 0;
        pvec = drm_malloc_ab(npages, sizeof(struct page *));
        if (!pvec)
                return ERR_PTR(-ENOMEM);
+        if (!etnaviv_obj->userptr.ro)
+                flags |= FOLL_WRITE;
        pinned = 0;
        ptr = etnaviv_obj->userptr.ptr;
        down_read(&mm->mmap_sem);
        while (pinned < npages) {
                ret = get_user_pages_remote(task, mm, ptr, npages - pinned,
-                                            !etnaviv_obj->userptr.ro, 0,
+                                            flags, pvec + pinned, NULL);
-                                            pvec + pinned, NULL);
                if (ret < 0)
                        break;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
index d3796ed8d8c5..169ac96e8f08 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
@@ -330,7 +330,8 @@ u32 etnaviv_iommu_get_cmdbuf_va(struct etnaviv_gpu *gpu,
                        return (u32)buf->vram_node.start;
                mutex_lock(&mmu->lock);
-                ret = etnaviv_iommu_find_iova(mmu, &buf->vram_node, buf->size);
+                ret = etnaviv_iommu_find_iova(mmu, &buf->vram_node,
+                                              buf->size + SZ_64K);
                if (ret < 0) {
                        mutex_unlock(&mmu->lock);
                        return 0;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index def78c8c1780..f86e7c846678 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -262,6 +262,26 @@ int exynos_atomic_commit(struct drm_device *dev, struct drm_atomic_state *state,
        return 0;
 }
+int exynos_atomic_check(struct drm_device *dev,
+                        struct drm_atomic_state *state)
+{
+        int ret;
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+        ret = drm_atomic_normalize_zpos(dev, state);
+        if (ret)
+                return ret;
+        ret = drm_atomic_helper_check_planes(dev, state);
+        if (ret)
+                return ret;
+        return ret;
+}
 static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
 {
        struct drm_exynos_file_private *file_priv;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index d215149e737b..80c4d5b81689 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -301,6 +301,7 @@ static inline int exynos_dpi_bind(struct drm_device *dev,
 int exynos_atomic_commit(struct drm_device *dev, struct drm_atomic_state *state,
                         bool nonblock);
+int exynos_atomic_check(struct drm_device *dev, struct drm_atomic_state *state);
 extern struct platform_driver fimd_driver;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index 40ce841eb952..23cce0a3f5fc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -190,7 +190,7 @@ dma_addr_t exynos_drm_fb_dma_addr(struct drm_framebuffer *fb, int index)
 static const struct drm_mode_config_funcs exynos_drm_mode_config_funcs = {
        .fb_create = exynos_user_fb_create,
        .output_poll_changed = exynos_drm_output_poll_changed,
-        .atomic_check = drm_atomic_helper_check,
+        .atomic_check = exynos_atomic_check,
        .atomic_commit = exynos_atomic_commit,
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index aa92decf4233..fbd13fabdf2d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -488,7 +488,8 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
                goto err_free;
        }
-        ret = get_vaddr_frames(start, npages, true, true, g2d_userptr->vec);
+        ret = get_vaddr_frames(start, npages, FOLL_FORCE | FOLL_WRITE,
+                g2d_userptr->vec);
        if (ret != npages) {
                DRM_ERROR("failed to get user pages from userptr.\n");
                if (ret < 0)
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index e8fb6ef947ee..38eaa63afb31 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -1907,6 +1907,8 @@ err_disable_pm_runtime:
 err_hdmiphy:
        if (hdata->hdmiphy_port)
                put_device(&hdata->hdmiphy_port->dev);
+        if (hdata->regs_hdmiphy)
+                iounmap(hdata->regs_hdmiphy);
 err_ddc:
        put_device(&hdata->ddc_adpt->dev);
@@ -1929,6 +1931,9 @@ static int hdmi_remove(struct platform_device *pdev)
        if (hdata->hdmiphy_port)
                put_device(&hdata->hdmiphy_port->dev);
+        if (hdata->regs_hdmiphy)
+                iounmap(hdata->regs_hdmiphy);
        put_device(&hdata->ddc_adpt->dev);
        return 0;
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
index 3371635cd4d7..deb57435cc89 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
@@ -25,8 +25,13 @@
 static void fsl_dcu_drm_crtc_atomic_flush(struct drm_crtc *crtc,
                                          struct drm_crtc_state *old_crtc_state)
 {
+        struct drm_device *dev = crtc->dev;
+        struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
        struct drm_pending_vblank_event *event = crtc->state->event;
+        regmap_write(fsl_dev->regmap,
+                     DCU_UPDATE_MODE, DCU_UPDATE_MODE_READREG);
        if (event) {
                crtc->state->event = NULL;
@@ -39,11 +44,15 @@ static void fsl_dcu_drm_crtc_atomic_flush(struct drm_crtc *crtc,
        }
 }
-static void fsl_dcu_drm_disable_crtc(struct drm_crtc *crtc)
+static void fsl_dcu_drm_crtc_atomic_disable(struct drm_crtc *crtc,
+                                        struct drm_crtc_state *old_crtc_state)
 {
        struct drm_device *dev = crtc->dev;
        struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+        /* always disable planes on the CRTC */
+        drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, true);
        drm_crtc_vblank_off(crtc);
        regmap_update_bits(fsl_dev->regmap, DCU_DCU_MODE,
@@ -51,6 +60,7 @@ static void fsl_dcu_drm_disable_crtc(struct drm_crtc *crtc)
                           DCU_MODE_DCU_MODE(DCU_MODE_OFF));
        regmap_write(fsl_dev->regmap, DCU_UPDATE_MODE,
                     DCU_UPDATE_MODE_READREG);
+        clk_disable_unprepare(fsl_dev->pix_clk);
 }
 static void fsl_dcu_drm_crtc_enable(struct drm_crtc *crtc)
@@ -58,6 +68,7 @@ static void fsl_dcu_drm_crtc_enable(struct drm_crtc *crtc)
        struct drm_device *dev = crtc->dev;
        struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
+        clk_prepare_enable(fsl_dev->pix_clk);
        regmap_update_bits(fsl_dev->regmap, DCU_DCU_MODE,
                           DCU_MODE_DCU_MODE_MASK,
                           DCU_MODE_DCU_MODE(DCU_MODE_NORMAL));
@@ -116,14 +127,12 @@ static void fsl_dcu_drm_crtc_mode_set_nofb(struct drm_crtc *crtc)
                     DCU_THRESHOLD_LS_BF_VS(BF_VS_VAL) |
                     DCU_THRESHOLD_OUT_BUF_HIGH(BUF_MAX_VAL) |
                     DCU_THRESHOLD_OUT_BUF_LOW(BUF_MIN_VAL));
-        regmap_write(fsl_dev->regmap, DCU_UPDATE_MODE,
-                     DCU_UPDATE_MODE_READREG);
        return;
 }
 static const struct drm_crtc_helper_funcs fsl_dcu_drm_crtc_helper_funcs = {
+        .atomic_disable = fsl_dcu_drm_crtc_atomic_disable,
        .atomic_flush = fsl_dcu_drm_crtc_atomic_flush,
-        .disable = fsl_dcu_drm_disable_crtc,
        .enable = fsl_dcu_drm_crtc_enable,
        .mode_set_nofb = fsl_dcu_drm_crtc_mode_set_nofb,
 };
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
index 0884c45aefe8..cc2fde2ae5ef 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
@@ -59,8 +59,6 @@ static int fsl_dcu_drm_irq_init(struct drm_device *dev)
        regmap_write(fsl_dev->regmap, DCU_INT_STATUS, 0);
        regmap_write(fsl_dev->regmap, DCU_INT_MASK, ~0);
-        regmap_write(fsl_dev->regmap, DCU_UPDATE_MODE,
-                     DCU_UPDATE_MODE_READREG);
        return ret;
 }
@@ -139,8 +137,6 @@ static irqreturn_t fsl_dcu_drm_irq(int irq, void *arg)
                drm_handle_vblank(dev, 0);
        regmap_write(fsl_dev->regmap, DCU_INT_STATUS, int_status);
-        regmap_write(fsl_dev->regmap, DCU_UPDATE_MODE,
-                     DCU_UPDATE_MODE_READREG);
        return IRQ_HANDLED;
 }
@@ -267,12 +263,8 @@ static int fsl_dcu_drm_pm_resume(struct device *dev)
                return ret;
        }
-        ret = clk_prepare_enable(fsl_dev->pix_clk);
+        if (fsl_dev->tcon)
-        if (ret < 0) {
+                fsl_tcon_bypass_enable(fsl_dev->tcon);
-                dev_err(dev, "failed to enable pix clk\n");
-                goto disable_dcu_clk;
-        }
        fsl_dcu_drm_init_planes(fsl_dev->drm);
        drm_atomic_helper_resume(fsl_dev->drm, fsl_dev->state);
@@ -284,10 +276,6 @@ static int fsl_dcu_drm_pm_resume(struct device *dev)
        enable_irq(fsl_dev->irq);
        return 0;
-disable_dcu_clk:
-        clk_disable_unprepare(fsl_dev->clk);
-        return ret;
 }
 #endif
@@ -401,18 +389,12 @@ static int fsl_dcu_drm_probe(struct platform_device *pdev)
                goto disable_clk;
        }
-        ret = clk_prepare_enable(fsl_dev->pix_clk);
-        if (ret < 0) {
-                dev_err(dev, "failed to enable pix clk\n");
-                goto unregister_pix_clk;
-        }
        fsl_dev->tcon = fsl_tcon_init(dev);
        drm = drm_dev_alloc(driver, dev);
        if (IS_ERR(drm)) {
                ret = PTR_ERR(drm);
-                goto disable_pix_clk;
+                goto unregister_pix_clk;
        }
        fsl_dev->dev = dev;
@@ -433,8 +415,6 @@ static int fsl_dcu_drm_probe(struct platform_device *pdev)
 unref:
        drm_dev_unref(drm);
-disable_pix_clk:
-        clk_disable_unprepare(fsl_dev->pix_clk);
 unregister_pix_clk:
        clk_unregister(fsl_dev->pix_clk);
 disable_clk:
@@ -447,7 +427,6 @@ static int fsl_dcu_drm_remove(struct platform_device *pdev)
        struct fsl_dcu_drm_device *fsl_dev = platform_get_drvdata(pdev);
        clk_disable_unprepare(fsl_dev->clk);
-        clk_disable_unprepare(fsl_dev->pix_clk);
        clk_unregister(fsl_dev->pix_clk);
        drm_put_dev(fsl_dev->drm);
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
index a7e5486bd1e9..a99f48847420 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
@@ -160,11 +160,6 @@ static void fsl_dcu_drm_plane_atomic_update(struct drm_plane *plane,
                             DCU_LAYER_POST_SKIP(0) |
                             DCU_LAYER_PRE_SKIP(0));
        }
-        regmap_update_bits(fsl_dev->regmap, DCU_DCU_MODE,
-                           DCU_MODE_DCU_MODE_MASK,
-                           DCU_MODE_DCU_MODE(DCU_MODE_NORMAL));
-        regmap_write(fsl_dev->regmap,
-                     DCU_UPDATE_MODE, DCU_UPDATE_MODE_READREG);
        return;
 }
@@ -211,11 +206,6 @@ void fsl_dcu_drm_init_planes(struct drm_device *dev)
                for (j = 1; j <= fsl_dev->soc->layer_regs; j++)
                        regmap_write(fsl_dev->regmap, DCU_CTRLDESCLN(i, j), 0);
        }
-        regmap_update_bits(fsl_dev->regmap, DCU_DCU_MODE,
-                           DCU_MODE_DCU_MODE_MASK,
-                           DCU_MODE_DCU_MODE(DCU_MODE_OFF));
-        regmap_write(fsl_dev->regmap, DCU_UPDATE_MODE,
-                     DCU_UPDATE_MODE_READREG);
 }
 struct drm_plane *fsl_dcu_drm_primary_create_plane(struct drm_device *dev)
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c
index 26edcc899712..e1dd75b18118 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c
@@ -20,38 +20,6 @@
 #include "fsl_dcu_drm_drv.h"
 #include "fsl_tcon.h"
-static int
-fsl_dcu_drm_encoder_atomic_check(struct drm_encoder *encoder,
-                                 struct drm_crtc_state *crtc_state,
-                                 struct drm_connector_state *conn_state)
-{
-        return 0;
-}
-static void fsl_dcu_drm_encoder_disable(struct drm_encoder *encoder)
-{
-        struct drm_device *dev = encoder->dev;
-        struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
-        if (fsl_dev->tcon)
-                fsl_tcon_bypass_disable(fsl_dev->tcon);
-}
-static void fsl_dcu_drm_encoder_enable(struct drm_encoder *encoder)
-{
-        struct drm_device *dev = encoder->dev;
-        struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
-        if (fsl_dev->tcon)
-                fsl_tcon_bypass_enable(fsl_dev->tcon);
-}
-static const struct drm_encoder_helper_funcs encoder_helper_funcs = {
-        .atomic_check = fsl_dcu_drm_encoder_atomic_check,
-        .disable = fsl_dcu_drm_encoder_disable,
-        .enable = fsl_dcu_drm_encoder_enable,
-};
 static void fsl_dcu_drm_encoder_destroy(struct drm_encoder *encoder)
 {
        drm_encoder_cleanup(encoder);
@@ -68,13 +36,16 @@ int fsl_dcu_drm_encoder_create(struct fsl_dcu_drm_device *fsl_dev,
        int ret;
        encoder->possible_crtcs = 1;
+        /* Use bypass mode for parallel RGB/LVDS encoder */
+        if (fsl_dev->tcon)
+                fsl_tcon_bypass_enable(fsl_dev->tcon);
        ret = drm_encoder_init(fsl_dev->drm, encoder, &encoder_funcs,
                               DRM_MODE_ENCODER_LVDS, NULL);
        if (ret < 0)
                return ret;
-        drm_encoder_helper_add(encoder, &encoder_helper_funcs);
        return 0;
 }
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index bfb2efd8d4d4..18dfdd5c1b3b 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1447,8 +1447,6 @@ static int i915_drm_suspend(struct drm_device *dev)
        dev_priv->suspend_count++;
-        intel_display_set_init_power(dev_priv, false);
        intel_csr_ucode_suspend(dev_priv);
 out:
@@ -1466,6 +1464,8 @@ static int i915_drm_suspend_late(struct drm_device *dev, bool hibernation)
        disable_rpm_wakeref_asserts(dev_priv);
+        intel_display_set_init_power(dev_priv, false);
        fw_csr = !IS_BROXTON(dev_priv) &&
                suspend_to_idle(dev_priv) && dev_priv->csr.dmc_payload;
        /*
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 8b9ee4e390c0..685e9e065287 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2883,6 +2883,11 @@ __i915_printk(struct drm_i915_private *dev_priv, const char *level,
 extern long i915_compat_ioctl(struct file *filp, unsigned int cmd,
                              unsigned long arg);
 #endif
+extern const struct dev_pm_ops i915_pm_ops;
+extern int i915_driver_load(struct pci_dev *pdev,
+                            const struct pci_device_id *ent);
+extern void i915_driver_unload(struct drm_device *dev);
 extern int intel_gpu_reset(struct drm_i915_private *dev_priv, u32 engine_mask);
 extern bool intel_has_gpu_reset(struct drm_i915_private *dev_priv);
 extern void i915_reset(struct drm_i915_private *dev_priv);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 947e82c2b175..00eb4814b913 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1806,7 +1806,7 @@ int i915_gem_fault(struct vm_area_struct *area, struct vm_fault *vmf)
                /* Use a partial view if it is bigger than available space */
                chunk_size = MIN_CHUNK_PAGES;
                if (i915_gem_object_is_tiled(obj))
-                        chunk_size = max(chunk_size, tile_row_pages(obj));
+                        chunk_size = roundup(chunk_size, tile_row_pages(obj));
                memset(&view, 0, sizeof(view));
                view.type = I915_GGTT_VIEW_PARTIAL;
@@ -2268,7 +2268,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                        page = shmem_read_mapping_page(mapping, i);
                        if (IS_ERR(page)) {
                                ret = PTR_ERR(page);
-                                goto err_pages;
+                                goto err_sg;
                        }
                }
 #ifdef CONFIG_SWIOTLB
@@ -2311,8 +2311,9 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
        return 0;
-err_pages:
+err_sg:
        sg_mark_end(sg);
+err_pages:
        for_each_sgt_page(page, sgt_iter, st)
                put_page(page);
        sg_free_table(st);
@@ -3543,15 +3544,27 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
        if (view->type == I915_GGTT_VIEW_NORMAL)
                vma = i915_gem_object_ggtt_pin(obj, view, 0, alignment,
                                               PIN_MAPPABLE | PIN_NONBLOCK);
-        if (IS_ERR(vma))
+        if (IS_ERR(vma)) {
-                vma = i915_gem_object_ggtt_pin(obj, view, 0, alignment, 0);
+                struct drm_i915_private *i915 = to_i915(obj->base.dev);
+                unsigned int flags;
+                /* Valleyview is definitely limited to scanning out the first
+                 * 512MiB. Lets presume this behaviour was inherited from the
+                 * g4x display engine and that all earlier gen are similarly
+                 * limited. Testing suggests that it is a little more
+                 * complicated than this. For example, Cherryview appears quite
+                 * happy to scanout from anywhere within its global aperture.
+                 */
+                flags = 0;
+                if (HAS_GMCH_DISPLAY(i915))
+                        flags = PIN_MAPPABLE;
+                vma = i915_gem_object_ggtt_pin(obj, view, 0, alignment, flags);
+        }
        if (IS_ERR(vma))
                goto err_unpin_display;
        vma->display_alignment = max_t(u64, vma->display_alignment, alignment);
-        WARN_ON(obj->pin_display > i915_vma_pin_count(vma));
        i915_gem_object_flush_cpu_write_domain(obj);
        old_write_domain = obj->base.write_domain;
@@ -3588,7 +3601,6 @@ i915_gem_object_unpin_from_display_plane(struct i915_vma *vma)
                list_move_tail(&vma->vm_link, &vma->vm->inactive_list);
        i915_vma_unpin(vma);
-        WARN_ON(vma->obj->pin_display > i915_vma_pin_count(vma));
 }
 /**
@@ -3745,7 +3757,12 @@ void __i915_vma_set_map_and_fenceable(struct i915_vma *vma)
        mappable = (vma->node.start + fence_size <=
                    dev_priv->ggtt.mappable_end);
-        if (mappable && fenceable)
+        /*
+         * Explicitly disable for rotated VMA since the display does not
+         * need the fence and the VMA is not accessible to other users.
+         */
+        if (mappable && fenceable &&
+            vma->ggtt_view.type != I915_GGTT_VIEW_ROTATED)
                vma->flags |= I915_VMA_CAN_FENCE;
        else
                vma->flags &= ~I915_VMA_CAN_FENCE;
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 7adb4c77cc7f..a218c2e395e7 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1281,6 +1281,12 @@ i915_gem_validate_context(struct drm_device *dev, struct drm_file *file,
        return ctx;
 }
+static bool gpu_write_needs_clflush(struct drm_i915_gem_object *obj)
+{
+        return !(obj->cache_level == I915_CACHE_NONE ||
+                 obj->cache_level == I915_CACHE_WT);
+}
 void i915_vma_move_to_active(struct i915_vma *vma,
                             struct drm_i915_gem_request *req,
                             unsigned int flags)
@@ -1311,6 +1317,8 @@ void i915_vma_move_to_active(struct i915_vma *vma,
                /* update for the implicit flush after a batch */
                obj->base.write_domain &= ~I915_GEM_GPU_DOMAINS;
+                if (!obj->cache_dirty && gpu_write_needs_clflush(obj))
+                        obj->cache_dirty = true;
        }
        if (flags & EXEC_OBJECT_NEEDS_FENCE)
diff --git a/drivers/gpu/drm/i915/i915_gem_fence.c b/drivers/gpu/drm/i915/i915_gem_fence.c
index 8df1fa7234e8..2c7ba0ee127c 100644
--- a/drivers/gpu/drm/i915/i915_gem_fence.c
+++ b/drivers/gpu/drm/i915/i915_gem_fence.c
@@ -290,6 +290,8 @@ i915_vma_put_fence(struct i915_vma *vma)
 {
        struct drm_i915_fence_reg *fence = vma->fence;
+        assert_rpm_wakelock_held(to_i915(vma->vm->dev));
        if (!fence)
                return 0;
@@ -341,6 +343,8 @@ i915_vma_get_fence(struct i915_vma *vma)
        struct drm_i915_fence_reg *fence;
        struct i915_vma *set = i915_gem_object_is_tiled(vma->obj) ? vma : NULL;
+        assert_rpm_wakelock_held(to_i915(vma->vm->dev));
        /* Just update our place in the LRU if our fence is getting reused. */
        if (vma->fence) {
                fence = vma->fence;
@@ -371,6 +375,12 @@ void i915_gem_restore_fences(struct drm_device *dev)
        struct drm_i915_private *dev_priv = to_i915(dev);
        int i;
+        /* Note that this may be called outside of struct_mutex, by
+         * runtime suspend/resume. The barrier we require is enforced by
+         * rpm itself - all access to fences/GTT are only within an rpm
+         * wakeref, and to acquire that wakeref you must pass through here.
+         */
        for (i = 0; i < dev_priv->num_fence_regs; i++) {
                struct drm_i915_fence_reg *reg = &dev_priv->fence_regs[i];
                struct i915_vma *vma = reg->vma;
@@ -379,10 +389,17 @@ void i915_gem_restore_fences(struct drm_device *dev)
                 * Commit delayed tiling changes if we have an object still
                 * attached to the fence, otherwise just clear the fence.
                 */
-                if (vma && !i915_gem_object_is_tiled(vma->obj))
+                if (vma && !i915_gem_object_is_tiled(vma->obj)) {
+                        GEM_BUG_ON(!reg->dirty);
+                        GEM_BUG_ON(vma->obj->fault_mappable);
+                        list_move(&reg->link, &dev_priv->mm.fence_list);
+                        vma->fence = NULL;
                        vma = NULL;
+                }
-                fence_update(reg, vma);
+                fence_write(reg, vma);
+                reg->vma = vma;
        }
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
index e537930c64b5..c6f780f5abc9 100644
--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
@@ -508,6 +508,10 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work)
        pvec = drm_malloc_gfp(npages, sizeof(struct page *), GFP_TEMPORARY);
        if (pvec != NULL) {
                struct mm_struct *mm = obj->userptr.mm->mm;
+                unsigned int flags = 0;
+                if (!obj->userptr.read_only)
+                        flags |= FOLL_WRITE;
                ret = -EFAULT;
                if (atomic_inc_not_zero(&mm->mm_users)) {
@@ -517,7 +521,7 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work)
                                        (work->task, mm,
                                         obj->userptr.ptr + pinned * PAGE_SIZE,
                                         npages - pinned,
-                                         !obj->userptr.read_only, 0,
+                                         flags,
                                         pvec + pinned, NULL);
                                if (ret < 0)
                                        break;
diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index 687c768833b3..31e6edd08dd0 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -431,9 +431,6 @@ static const struct pci_device_id pciidlist[] = {
 };
 MODULE_DEVICE_TABLE(pci, pciidlist);
-extern int i915_driver_load(struct pci_dev *pdev,
-                            const struct pci_device_id *ent);
 static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        struct intel_device_info *intel_info =
@@ -463,8 +460,6 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        return i915_driver_load(pdev, ent);
 }
-extern void i915_driver_unload(struct drm_device *dev);
 static void i915_pci_remove(struct pci_dev *pdev)
 {
        struct drm_device *dev = pci_get_drvdata(pdev);
@@ -473,8 +468,6 @@ static void i915_pci_remove(struct pci_dev *pdev)
        drm_dev_unref(dev);
 }
-extern const struct dev_pm_ops i915_pm_ops;
 static struct pci_driver i915_pci_driver = {
        .name = DRIVER_NAME,
        .id_table = pciidlist,
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index c6e69e4cfa83..cf2560708e03 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1031,6 +1031,77 @@ static u8 translate_iboost(u8 val)
        return mapping[val];
 }
+static void sanitize_ddc_pin(struct drm_i915_private *dev_priv,
+                             enum port port)
+{
+        const struct ddi_vbt_port_info *info =
+                &dev_priv->vbt.ddi_port_info[port];
+        enum port p;
+        if (!info->alternate_ddc_pin)
+                return;
+        for_each_port_masked(p, (1 << port) - 1) {
+                struct ddi_vbt_port_info *i = &dev_priv->vbt.ddi_port_info[p];
+                if (info->alternate_ddc_pin != i->alternate_ddc_pin)
+                        continue;
+                DRM_DEBUG_KMS("port %c trying to use the same DDC pin (0x%x) as port %c, "
+                              "disabling port %c DVI/HDMI support\n",
+                              port_name(p), i->alternate_ddc_pin,
+                              port_name(port), port_name(p));
+                /*
+                 * If we have multiple ports supposedly sharing the
+                 * pin, then dvi/hdmi couldn't exist on the shared
+                 * port. Otherwise they share the same ddc bin and
+                 * system couldn't communicate with them separately.
+                 *
+                 * Due to parsing the ports in alphabetical order,
+                 * a higher port will always clobber a lower one.
+                 */
+                i->supports_dvi = false;
+                i->supports_hdmi = false;
+                i->alternate_ddc_pin = 0;
+        }
+}
+static void sanitize_aux_ch(struct drm_i915_private *dev_priv,
+                            enum port port)
+{
+        const struct ddi_vbt_port_info *info =
+                &dev_priv->vbt.ddi_port_info[port];
+        enum port p;
+        if (!info->alternate_aux_channel)
+                return;
+        for_each_port_masked(p, (1 << port) - 1) {
+                struct ddi_vbt_port_info *i = &dev_priv->vbt.ddi_port_info[p];
+                if (info->alternate_aux_channel != i->alternate_aux_channel)
+                        continue;
+                DRM_DEBUG_KMS("port %c trying to use the same AUX CH (0x%x) as port %c, "
+                              "disabling port %c DP support\n",
+                              port_name(p), i->alternate_aux_channel,
+                              port_name(port), port_name(p));
+                /*
+                 * If we have multiple ports supposedlt sharing the
+                 * aux channel, then DP couldn't exist on the shared
+                 * port. Otherwise they share the same aux channel
+                 * and system couldn't communicate with them separately.
+                 *
+                 * Due to parsing the ports in alphabetical order,
+                 * a higher port will always clobber a lower one.
+                 */
+                i->supports_dp = false;
+                i->alternate_aux_channel = 0;
+        }
+}
 static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
                           const struct bdb_header *bdb)
 {
@@ -1072,7 +1143,7 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
        if (!child)
                return;
-        aux_channel = child->raw[25];
+        aux_channel = child->common.aux_channel;
        ddc_pin = child->common.ddc_pin;
        is_dvi = child->common.device_type & DEVICE_TYPE_TMDS_DVI_SIGNALING;
@@ -1105,54 +1176,15 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
                DRM_DEBUG_KMS("Port %c is internal DP\n", port_name(port));
        if (is_dvi) {
-                if (port == PORT_E) {
+                info->alternate_ddc_pin = ddc_pin;
-                        info->alternate_ddc_pin = ddc_pin;
-                        /* if DDIE share ddc pin with other port, then
+                sanitize_ddc_pin(dev_priv, port);
-                         * dvi/hdmi couldn't exist on the shared port.
-                         * Otherwise they share the same ddc bin and system
-                         * couldn't communicate with them seperately. */
-                        if (ddc_pin == DDC_PIN_B) {
-                                dev_priv->vbt.ddi_port_info[PORT_B].supports_dvi = 0;
-                                dev_priv->vbt.ddi_port_info[PORT_B].supports_hdmi = 0;
-                        } else if (ddc_pin == DDC_PIN_C) {
-                                dev_priv->vbt.ddi_port_info[PORT_C].supports_dvi = 0;
-                                dev_priv->vbt.ddi_port_info[PORT_C].supports_hdmi = 0;
-                        } else if (ddc_pin == DDC_PIN_D) {
-                                dev_priv->vbt.ddi_port_info[PORT_D].supports_dvi = 0;
-                                dev_priv->vbt.ddi_port_info[PORT_D].supports_hdmi = 0;
-                        }
-                } else if (ddc_pin == DDC_PIN_B && port != PORT_B)
-                        DRM_DEBUG_KMS("Unexpected DDC pin for port B\n");
-                else if (ddc_pin == DDC_PIN_C && port != PORT_C)
-                        DRM_DEBUG_KMS("Unexpected DDC pin for port C\n");
-                else if (ddc_pin == DDC_PIN_D && port != PORT_D)
-                        DRM_DEBUG_KMS("Unexpected DDC pin for port D\n");
        }
        if (is_dp) {
-                if (port == PORT_E) {
+                info->alternate_aux_channel = aux_channel;
-                        info->alternate_aux_channel = aux_channel;
-                        /* if DDIE share aux channel with other port, then
+                sanitize_aux_ch(dev_priv, port);
-                         * DP couldn't exist on the shared port. Otherwise
-                         * they share the same aux channel and system
-                         * couldn't communicate with them seperately. */
-                        if (aux_channel == DP_AUX_A)
-                                dev_priv->vbt.ddi_port_info[PORT_A].supports_dp = 0;
-                        else if (aux_channel == DP_AUX_B)
-                                dev_priv->vbt.ddi_port_info[PORT_B].supports_dp = 0;
-                        else if (aux_channel == DP_AUX_C)
-                                dev_priv->vbt.ddi_port_info[PORT_C].supports_dp = 0;
-                        else if (aux_channel == DP_AUX_D)
-                                dev_priv->vbt.ddi_port_info[PORT_D].supports_dp = 0;
-                }
-                else if (aux_channel == DP_AUX_A && port != PORT_A)
-                        DRM_DEBUG_KMS("Unexpected AUX channel for port A\n");
-                else if (aux_channel == DP_AUX_B && port != PORT_B)
-                        DRM_DEBUG_KMS("Unexpected AUX channel for port B\n");
-                else if (aux_channel == DP_AUX_C && port != PORT_C)
-                        DRM_DEBUG_KMS("Unexpected AUX channel for port C\n");
-                else if (aux_channel == DP_AUX_D && port != PORT_D)
-                        DRM_DEBUG_KMS("Unexpected AUX channel for port D\n");
        }
        if (bdb->version >= 158) {
@@ -1641,7 +1673,8 @@ bool intel_bios_is_port_edp(struct drm_i915_private *dev_priv, enum port port)
        return false;
 }
-bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, enum port port)
+static bool child_dev_is_dp_dual_mode(const union child_device_config *p_child,
+                                      enum port port)
 {
        static const struct {
                u16 dp, hdmi;
@@ -1655,22 +1688,35 @@ bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, enum por
                [PORT_D] = { DVO_PORT_DPD, DVO_PORT_HDMID, },
                [PORT_E] = { DVO_PORT_DPE, DVO_PORT_HDMIE, },
        };
-        int i;
        if (port == PORT_A || port >= ARRAY_SIZE(port_mapping))
                return false;
-        if (!dev_priv->vbt.child_dev_num)
+        if ((p_child->common.device_type & DEVICE_TYPE_DP_DUAL_MODE_BITS) !=
+            (DEVICE_TYPE_DP_DUAL_MODE & DEVICE_TYPE_DP_DUAL_MODE_BITS))
                return false;
+        if (p_child->common.dvo_port == port_mapping[port].dp)
+                return true;
+        /* Only accept a HDMI dvo_port as DP++ if it has an AUX channel */
+        if (p_child->common.dvo_port == port_mapping[port].hdmi &&
+            p_child->common.aux_channel != 0)
+                return true;
+        return false;
+}
+bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv,
+                                     enum port port)
+{
+        int i;
        for (i = 0; i < dev_priv->vbt.child_dev_num; i++) {
                const union child_device_config *p_child =
                        &dev_priv->vbt.child_dev[i];
-                if ((p_child->common.dvo_port == port_mapping[port].dp ||
+                if (child_dev_is_dp_dual_mode(p_child, port))
-                     p_child->common.dvo_port == port_mapping[port].hdmi) &&
-                    (p_child->common.device_type & DEVICE_TYPE_DP_DUAL_MODE_BITS) ==
-                    (DEVICE_TYPE_DP_DUAL_MODE & DEVICE_TYPE_DP_DUAL_MODE_BITS))
                        return true;
        }
diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c
index 73b6858600ac..1b20e160bc1f 100644
--- a/drivers/gpu/drm/i915/intel_device_info.c
+++ b/drivers/gpu/drm/i915/intel_device_info.c
@@ -192,7 +192,7 @@ static void broadwell_sseu_info_init(struct drm_i915_private *dev_priv)
        struct sseu_dev_info *sseu = &mkwrite_device_info(dev_priv)->sseu;
        const int s_max = 3, ss_max = 3, eu_max = 8;
        int s, ss;
-        u32 fuse2, eu_disable[s_max];
+        u32 fuse2, eu_disable[3]; /* s_max */
        fuse2 = I915_READ(GEN8_FUSE2);
        sseu->slice_mask = (fuse2 & GEN8_F2_S_ENA_MASK) >> GEN8_F2_S_ENA_SHIFT;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index fbcfed63a76e..3cb70d73239b 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2978,7 +2978,8 @@ int skl_check_plane_surface(struct intel_plane_state *plane_state)
        /* Rotate src coordinates to match rotated GTT view */
        if (intel_rotation_90_or_270(rotation))
                drm_rect_rotate(&plane_state->base.src,
-                                fb->width, fb->height, DRM_ROTATE_270);
+                                fb->width << 16, fb->height << 16,
+                                DRM_ROTATE_270);
        /*
         * Handle the AUX surface first since
@@ -10242,6 +10243,29 @@ static void bxt_modeset_commit_cdclk(struct drm_atomic_state *old_state)
        bxt_set_cdclk(to_i915(dev), req_cdclk);
 }
+static int bdw_adjust_min_pipe_pixel_rate(struct intel_crtc_state *crtc_state,
+                                          int pixel_rate)
+{
+        struct drm_i915_private *dev_priv = to_i915(crtc_state->base.crtc->dev);
+        /* pixel rate mustn't exceed 95% of cdclk with IPS on BDW */
+        if (IS_BROADWELL(dev_priv) && crtc_state->ips_enabled)
+                pixel_rate = DIV_ROUND_UP(pixel_rate * 100, 95);
+        /* BSpec says "Do not use DisplayPort with CDCLK less than
+         * 432 MHz, audio enabled, port width x4, and link rate
+         * HBR2 (5.4 GHz), or else there may be audio corruption or
+         * screen corruption."
+         */
+        if (intel_crtc_has_dp_encoder(crtc_state) &&
+            crtc_state->has_audio &&
+            crtc_state->port_clock >= 540000 &&
+            crtc_state->lane_count == 4)
+                pixel_rate = max(432000, pixel_rate);
+        return pixel_rate;
+}
 /* compute the max rate for new configuration */
 static int ilk_max_pixel_rate(struct drm_atomic_state *state)
 {
@@ -10267,9 +10291,9 @@ static int ilk_max_pixel_rate(struct drm_atomic_state *state)
                pixel_rate = ilk_pipe_pixel_rate(crtc_state);
-                /* pixel rate mustn't exceed 95% of cdclk with IPS on BDW */
+                if (IS_BROADWELL(dev_priv) || IS_GEN9(dev_priv))
-                if (IS_BROADWELL(dev_priv) && crtc_state->ips_enabled)
+                        pixel_rate = bdw_adjust_min_pipe_pixel_rate(crtc_state,
-                        pixel_rate = DIV_ROUND_UP(pixel_rate * 100, 95);
+                                                                    pixel_rate);
                intel_state->min_pixclk[i] = pixel_rate;
        }
@@ -12236,7 +12260,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        intel_crtc->reset_count = i915_reset_count(&dev_priv->gpu_error);
        if (i915_reset_in_progress_or_wedged(&dev_priv->gpu_error)) {
                ret = -EIO;
-                goto cleanup;
+                goto unlock;
        }
        atomic_inc(&intel_crtc->unpin_work_count);
@@ -12328,6 +12352,7 @@ cleanup_unpin:
        intel_unpin_fb_obj(fb, crtc->primary->state->rotation);
 cleanup_pending:
        atomic_dec(&intel_crtc->unpin_work_count);
+unlock:
        mutex_unlock(&dev->struct_mutex);
 cleanup:
        crtc->primary->fb = old_fb;
@@ -14310,7 +14335,7 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
        for_each_plane_in_state(state, plane, plane_state, i) {
                struct intel_plane_state *intel_plane_state =
-                        to_intel_plane_state(plane_state);
+                        to_intel_plane_state(plane->state);
                if (!intel_plane_state->wait_req)
                        continue;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 14a3cf0b7213..bf344d08356a 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1108,6 +1108,44 @@ intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
        return ret;
 }
+static enum port intel_aux_port(struct drm_i915_private *dev_priv,
+                                enum port port)
+{
+        const struct ddi_vbt_port_info *info =
+                &dev_priv->vbt.ddi_port_info[port];
+        enum port aux_port;
+        if (!info->alternate_aux_channel) {
+                DRM_DEBUG_KMS("using AUX %c for port %c (platform default)\n",
+                              port_name(port), port_name(port));
+                return port;
+        }
+        switch (info->alternate_aux_channel) {
+        case DP_AUX_A:
+                aux_port = PORT_A;
+                break;
+        case DP_AUX_B:
+                aux_port = PORT_B;
+                break;
+        case DP_AUX_C:
+                aux_port = PORT_C;
+                break;
+        case DP_AUX_D:
+                aux_port = PORT_D;
+                break;
+        default:
+                MISSING_CASE(info->alternate_aux_channel);
+                aux_port = PORT_A;
+                break;
+        }
+        DRM_DEBUG_KMS("using AUX %c for port %c (VBT)\n",
+                      port_name(aux_port), port_name(port));
+        return aux_port;
+}
 static i915_reg_t g4x_aux_ctl_reg(struct drm_i915_private *dev_priv,
                                       enum port port)
 {
@@ -1168,36 +1206,9 @@ static i915_reg_t ilk_aux_data_reg(struct drm_i915_private *dev_priv,
        }
 }
-/*
- * On SKL we don't have Aux for port E so we rely
- * on VBT to set a proper alternate aux channel.
- */
-static enum port skl_porte_aux_port(struct drm_i915_private *dev_priv)
-{
-        const struct ddi_vbt_port_info *info =
-                &dev_priv->vbt.ddi_port_info[PORT_E];
-        switch (info->alternate_aux_channel) {
-        case DP_AUX_A:
-                return PORT_A;
-        case DP_AUX_B:
-                return PORT_B;
-        case DP_AUX_C:
-                return PORT_C;
-        case DP_AUX_D:
-                return PORT_D;
-        default:
-                MISSING_CASE(info->alternate_aux_channel);
-                return PORT_A;
-        }
-}
 static i915_reg_t skl_aux_ctl_reg(struct drm_i915_private *dev_priv,
                                       enum port port)
 {
-        if (port == PORT_E)
-                port = skl_porte_aux_port(dev_priv);
        switch (port) {
        case PORT_A:
        case PORT_B:
@@ -1213,9 +1224,6 @@ static i915_reg_t skl_aux_ctl_reg(struct drm_i915_private *dev_priv,
 static i915_reg_t skl_aux_data_reg(struct drm_i915_private *dev_priv,
                                        enum port port, int index)
 {
-        if (port == PORT_E)
-                port = skl_porte_aux_port(dev_priv);
        switch (port) {
        case PORT_A:
        case PORT_B:
@@ -1253,7 +1261,8 @@ static i915_reg_t intel_aux_data_reg(struct drm_i915_private *dev_priv,
 static void intel_aux_reg_init(struct intel_dp *intel_dp)
 {
        struct drm_i915_private *dev_priv = to_i915(intel_dp_to_dev(intel_dp));
-        enum port port = dp_to_dig_port(intel_dp)->port;
+        enum port port = intel_aux_port(dev_priv,
+                                        dp_to_dig_port(intel_dp)->port);
        int i;
        intel_dp->aux_ch_ctl_reg = intel_aux_ctl_reg(dev_priv, port);
@@ -3551,8 +3560,8 @@ intel_edp_init_dpcd(struct intel_dp *intel_dp)
        /* Read the eDP Display control capabilities registers */
        if ((intel_dp->dpcd[DP_EDP_CONFIGURATION_CAP] & DP_DPCD_DISPLAY_CONTROL_CAPABLE) &&
            drm_dp_dpcd_read(&intel_dp->aux, DP_EDP_DPCD_REV,
-                             intel_dp->edp_dpcd, sizeof(intel_dp->edp_dpcd) ==
+                             intel_dp->edp_dpcd, sizeof(intel_dp->edp_dpcd)) ==
-                             sizeof(intel_dp->edp_dpcd)))
+                             sizeof(intel_dp->edp_dpcd))
                DRM_DEBUG_KMS("EDP DPCD : %*ph\n", (int) sizeof(intel_dp->edp_dpcd),
                              intel_dp->edp_dpcd);
@@ -4454,21 +4463,11 @@ static enum drm_connector_status
 intel_dp_detect(struct drm_connector *connector, bool force)
 {
        struct intel_dp *intel_dp = intel_attached_dp(connector);
-        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
-        struct intel_encoder *intel_encoder = &intel_dig_port->base;
        enum drm_connector_status status = connector->status;
        DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
                      connector->base.id, connector->name);
-        if (intel_dp->is_mst) {
-                /* MST devices are disconnected from a monitor POV */
-                intel_dp_unset_edid(intel_dp);
-                if (intel_encoder->type != INTEL_OUTPUT_EDP)
-                        intel_encoder->type = INTEL_OUTPUT_DP;
-                return connector_status_disconnected;
-        }
        /* If full detect is not performed yet, do a full detect */
        if (!intel_dp->detect_done)
                status = intel_dp_long_pulse(intel_dp->attached_connector);
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index faa67624e1ed..c43dd9abce79 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -104,8 +104,10 @@ static int intel_fbc_calculate_cfb_size(struct drm_i915_private *dev_priv,
        int lines;
        intel_fbc_get_plane_source_size(cache, NULL, &lines);
-        if (INTEL_INFO(dev_priv)->gen >= 7)
+        if (INTEL_GEN(dev_priv) == 7)
                lines = min(lines, 2048);
+        else if (INTEL_GEN(dev_priv) >= 8)
+                lines = min(lines, 2560);
        /* Hardware needs the full buffer stride, not just the active area. */
        return lines * cache->fb.stride;
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index f40a35f2913a..13c306173f27 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -1799,6 +1799,50 @@ intel_hdmi_add_properties(struct intel_hdmi *intel_hdmi, struct drm_connector *c
        intel_hdmi->aspect_ratio = HDMI_PICTURE_ASPECT_NONE;
 }
+static u8 intel_hdmi_ddc_pin(struct drm_i915_private *dev_priv,
+                             enum port port)
+{
+        const struct ddi_vbt_port_info *info =
+                &dev_priv->vbt.ddi_port_info[port];
+        u8 ddc_pin;
+        if (info->alternate_ddc_pin) {
+                DRM_DEBUG_KMS("Using DDC pin 0x%x for port %c (VBT)\n",
+                              info->alternate_ddc_pin, port_name(port));
+                return info->alternate_ddc_pin;
+        }
+        switch (port) {
+        case PORT_B:
+                if (IS_BROXTON(dev_priv))
+                        ddc_pin = GMBUS_PIN_1_BXT;
+                else
+                        ddc_pin = GMBUS_PIN_DPB;
+                break;
+        case PORT_C:
+                if (IS_BROXTON(dev_priv))
+                        ddc_pin = GMBUS_PIN_2_BXT;
+                else
+                        ddc_pin = GMBUS_PIN_DPC;
+                break;
+        case PORT_D:
+                if (IS_CHERRYVIEW(dev_priv))
+                        ddc_pin = GMBUS_PIN_DPD_CHV;
+                else
+                        ddc_pin = GMBUS_PIN_DPD;
+                break;
+        default:
+                MISSING_CASE(port);
+                ddc_pin = GMBUS_PIN_DPB;
+                break;
+        }
+        DRM_DEBUG_KMS("Using DDC pin 0x%x for port %c (platform default)\n",
+                      ddc_pin, port_name(port));
+        return ddc_pin;
+}
 void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
                               struct intel_connector *intel_connector)
 {
@@ -1808,7 +1852,6 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
        struct drm_device *dev = intel_encoder->base.dev;
        struct drm_i915_private *dev_priv = to_i915(dev);
        enum port port = intel_dig_port->port;
-        uint8_t alternate_ddc_pin;
        DRM_DEBUG_KMS("Adding HDMI connector on port %c\n",
                      port_name(port));
@@ -1826,12 +1869,10 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
        connector->doublescan_allowed = 0;
        connector->stereo_allowed = 1;
+        intel_hdmi->ddc_bus = intel_hdmi_ddc_pin(dev_priv, port);
        switch (port) {
        case PORT_B:
-                if (IS_BROXTON(dev_priv))
-                        intel_hdmi->ddc_bus = GMBUS_PIN_1_BXT;
-                else
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPB;
                /*
                 * On BXT A0/A1, sw needs to activate DDIA HPD logic and
                 * interrupts to check the external panel connection.
@@ -1842,46 +1883,17 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
                        intel_encoder->hpd_pin = HPD_PORT_B;
                break;
        case PORT_C:
-                if (IS_BROXTON(dev_priv))
-                        intel_hdmi->ddc_bus = GMBUS_PIN_2_BXT;
-                else
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPC;
                intel_encoder->hpd_pin = HPD_PORT_C;
                break;
        case PORT_D:
-                if (WARN_ON(IS_BROXTON(dev_priv)))
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DISABLED;
-                else if (IS_CHERRYVIEW(dev_priv))
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPD_CHV;
-                else
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPD;
                intel_encoder->hpd_pin = HPD_PORT_D;
                break;
        case PORT_E:
-                /* On SKL PORT E doesn't have seperate GMBUS pin
-                 *  We rely on VBT to set a proper alternate GMBUS pin. */
-                alternate_ddc_pin =
-                        dev_priv->vbt.ddi_port_info[PORT_E].alternate_ddc_pin;
-                switch (alternate_ddc_pin) {
-                case DDC_PIN_B:
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPB;
-                        break;
-                case DDC_PIN_C:
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPC;
-                        break;
-                case DDC_PIN_D:
-                        intel_hdmi->ddc_bus = GMBUS_PIN_DPD;
-                        break;
-                default:
-                        MISSING_CASE(alternate_ddc_pin);
-                }
                intel_encoder->hpd_pin = HPD_PORT_E;
                break;
-        case PORT_A:
-                intel_encoder->hpd_pin = HPD_PORT_A;
-                /* Internal port only for eDP. */
        default:
-                BUG();
+                MISSING_CASE(port);
+                return;
        }
        if (IS_VALLEYVIEW(dev) || IS_CHERRYVIEW(dev)) {
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index a2f751cd187a..db24f898853c 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3362,13 +3362,15 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
        int num_active;
        int id, i;
+        /* Clear the partitioning for disabled planes. */
+        memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
+        memset(ddb->y_plane[pipe], 0, sizeof(ddb->y_plane[pipe]));
        if (WARN_ON(!state))
                return 0;
        if (!cstate->base.active) {
                ddb->pipe[pipe].start = ddb->pipe[pipe].end = 0;
-                memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
-                memset(ddb->y_plane[pipe], 0, sizeof(ddb->y_plane[pipe]));
                return 0;
        }
@@ -3468,12 +3470,6 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
        return 0;
 }
-static uint32_t skl_pipe_pixel_rate(const struct intel_crtc_state *config)
-{
-        /* TODO: Take into account the scalers once we support them */
-        return config->base.adjusted_mode.crtc_clock;
-}
 /*
 * The max latency should be 257 (max the punit can code is 255 and we add 2us
 * for the read latency) and cpp should always be <= 8, so that
@@ -3524,7 +3520,7 @@ static uint32_t skl_adjusted_plane_pixel_rate(const struct intel_crtc_state *cst
         * Adjusted plane pixel rate is just the pipe's adjusted pixel rate
         * with additional adjustments for plane-specific scaling.
         */
-        adjusted_pixel_rate = skl_pipe_pixel_rate(cstate);
+        adjusted_pixel_rate = ilk_pipe_pixel_rate(cstate);
        downscale_amount = skl_plane_downscale_amount(pstate);
        pixel_rate = adjusted_pixel_rate * downscale_amount >> 16;
@@ -3736,11 +3732,11 @@ skl_compute_linetime_wm(struct intel_crtc_state *cstate)
        if (!cstate->base.active)
                return 0;
-        if (WARN_ON(skl_pipe_pixel_rate(cstate) == 0))
+        if (WARN_ON(ilk_pipe_pixel_rate(cstate) == 0))
                return 0;
        return DIV_ROUND_UP(8 * cstate->base.adjusted_mode.crtc_htotal * 1000,
-                            skl_pipe_pixel_rate(cstate));
+                            ilk_pipe_pixel_rate(cstate));
 }
 static void skl_compute_transition_wm(struct intel_crtc_state *cstate,
@@ -4050,6 +4046,12 @@ skl_compute_ddb(struct drm_atomic_state *state)
                intel_state->wm_results.dirty_pipes = ~0;
        }
+        /*
+         * We're not recomputing for the pipes not included in the commit, so
+         * make sure we start with the current state.
+         */
+        memcpy(ddb, &dev_priv->wm.skl_hw.ddb, sizeof(*ddb));
        for_each_intel_crtc_mask(dev, intel_crtc, realloc_pipes) {
                struct intel_crtc_state *cstate;
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 6c11168facd6..a38c2fefe85a 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -1139,7 +1139,9 @@ static void vlv_display_power_well_deinit(struct drm_i915_private *dev_priv)
        intel_power_sequencer_reset(dev_priv);
-        intel_hpd_poll_init(dev_priv);
+        /* Prevent us from re-enabling polling on accident in late suspend */
+        if (!dev_priv->drm.dev->power.is_suspended)
+                intel_hpd_poll_init(dev_priv);
 }
 static void vlv_display_power_well_enable(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 73a521fdf1bd..dbed12c484c9 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -358,7 +358,7 @@ vlv_update_plane(struct drm_plane *dplane,
        int plane = intel_plane->plane;
        u32 sprctl;
        u32 sprsurf_offset, linear_offset;
-        unsigned int rotation = dplane->state->rotation;
+        unsigned int rotation = plane_state->base.rotation;
        const struct drm_intel_sprite_colorkey *key = &plane_state->ckey;
        int crtc_x = plane_state->base.dst.x1;
        int crtc_y = plane_state->base.dst.y1;
diff --git a/drivers/gpu/drm/i915/intel_vbt_defs.h b/drivers/gpu/drm/i915/intel_vbt_defs.h
index 68db9621f1f0..8886cab19f98 100644
--- a/drivers/gpu/drm/i915/intel_vbt_defs.h
+++ b/drivers/gpu/drm/i915/intel_vbt_defs.h
@@ -280,7 +280,8 @@ struct common_child_dev_config {
        u8 dp_support:1;
        u8 tmds_support:1;
        u8 support_reserved:5;
-        u8 not_common3[12];
+        u8 aux_channel;
+        u8 not_common3[11];
        u8 iboost_level;
 } __packed;
diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
index 98df09c2b388..9672b579f950 100644
--- a/drivers/gpu/drm/imx/imx-drm-core.c
+++ b/drivers/gpu/drm/imx/imx-drm-core.c
@@ -357,8 +357,8 @@ static int imx_drm_bind(struct device *dev)
        int ret;
        drm = drm_dev_alloc(&imx_drm_driver, dev);
-        if (!drm)
+        if (IS_ERR(drm))
-                return -ENOMEM;
+                return PTR_ERR(drm);
        imxdrm = devm_kzalloc(dev, sizeof(*imxdrm), GFP_KERNEL);
        if (!imxdrm) {
@@ -436,9 +436,11 @@ static int imx_drm_bind(struct device *dev)
 err_fbhelper:
        drm_kms_helper_poll_fini(drm);
+#if IS_ENABLED(CONFIG_DRM_FBDEV_EMULATION)
        if (imxdrm->fbhelper)
                drm_fbdev_cma_fini(imxdrm->fbhelper);
 err_unbind:
+#endif
        component_unbind_all(drm->dev, drm);
 err_vblank:
        drm_vblank_cleanup(drm);
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 4e1ae3fc462d..6be515a9fb69 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -68,6 +68,12 @@ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
        ipu_dc_disable_channel(ipu_crtc->dc);
        ipu_di_disable(ipu_crtc->di);
+        /*
+         * Planes must be disabled before DC clock is removed, as otherwise the
+         * attached IDMACs will be left in undefined state, possibly hanging
+         * the IPU or even system.
+         */
+        drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, false);
        ipu_dc_disable(ipu);
        spin_lock_irq(&crtc->dev->event_lock);
@@ -77,9 +83,6 @@ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
        }
        spin_unlock_irq(&crtc->dev->event_lock);
-        /* always disable planes on the CRTC */
-        drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, true);
        drm_crtc_vblank_off(crtc);
 }
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index ce22d0a0ddc8..d5864ed4d772 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -103,11 +103,11 @@ drm_plane_state_to_vbo(struct drm_plane_state *state)
               (state->src_x >> 16) / 2 - eba;
 }
-static void ipu_plane_atomic_set_base(struct ipu_plane *ipu_plane,
+static void ipu_plane_atomic_set_base(struct ipu_plane *ipu_plane)
-                                      struct drm_plane_state *old_state)
 {
        struct drm_plane *plane = &ipu_plane->base;
        struct drm_plane_state *state = plane->state;
+        struct drm_crtc_state *crtc_state = state->crtc->state;
        struct drm_framebuffer *fb = state->fb;
        unsigned long eba, ubo, vbo;
        int active;
@@ -117,7 +117,7 @@ static void ipu_plane_atomic_set_base(struct ipu_plane *ipu_plane,
        switch (fb->pixel_format) {
        case DRM_FORMAT_YUV420:
        case DRM_FORMAT_YVU420:
-                if (old_state->fb)
+                if (!drm_atomic_crtc_needs_modeset(crtc_state))
                        break;
                /*
@@ -149,7 +149,7 @@ static void ipu_plane_atomic_set_base(struct ipu_plane *ipu_plane,
                break;
        }
-        if (old_state->fb) {
+        if (!drm_atomic_crtc_needs_modeset(crtc_state)) {
                active = ipu_idmac_get_current_buffer(ipu_plane->ipu_ch);
                ipu_cpmem_set_buffer(ipu_plane->ipu_ch, !active, eba);
                ipu_idmac_select_buffer(ipu_plane->ipu_ch, !active);
@@ -259,6 +259,7 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
        struct drm_framebuffer *fb = state->fb;
        struct drm_framebuffer *old_fb = old_state->fb;
        unsigned long eba, ubo, vbo, old_ubo, old_vbo;
+        int hsub, vsub;
        /* Ok to disable */
        if (!fb)
@@ -355,7 +356,9 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                if ((ubo > 0xfffff8) || (vbo > 0xfffff8))
                        return -EINVAL;
-                if (old_fb) {
+                if (old_fb &&
+                    (old_fb->pixel_format == DRM_FORMAT_YUV420 ||
+                     old_fb->pixel_format == DRM_FORMAT_YVU420)) {
                        old_ubo = drm_plane_state_to_ubo(old_state);
                        old_vbo = drm_plane_state_to_vbo(old_state);
                        if (ubo != old_ubo || vbo != old_vbo)
@@ -370,6 +373,16 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                if (old_fb && old_fb->pitches[1] != fb->pitches[1])
                        crtc_state->mode_changed = true;
+                /*
+                 * The x/y offsets must be even in case of horizontal/vertical
+                 * chroma subsampling.
+                 */
+                hsub = drm_format_horz_chroma_subsampling(fb->pixel_format);
+                vsub = drm_format_vert_chroma_subsampling(fb->pixel_format);
+                if (((state->src_x >> 16) & (hsub - 1)) ||
+                    ((state->src_y >> 16) & (vsub - 1)))
+                        return -EINVAL;
        }
        return 0;
@@ -392,7 +405,7 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
                struct drm_crtc_state *crtc_state = state->crtc->state;
                if (!drm_atomic_crtc_needs_modeset(crtc_state)) {
-                        ipu_plane_atomic_set_base(ipu_plane, old_state);
+                        ipu_plane_atomic_set_base(ipu_plane);
                        return;
                }
        }
@@ -424,6 +437,7 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
                        ipu_dp_set_global_alpha(ipu_plane->dp, false, 0, false);
                        break;
                default:
+                        ipu_dp_set_global_alpha(ipu_plane->dp, true, 0, true);
                        break;
                }
        }
@@ -437,7 +451,7 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
        ipu_cpmem_set_high_priority(ipu_plane->ipu_ch);
        ipu_idmac_set_double_buffer(ipu_plane->ipu_ch, 1);
        ipu_cpmem_set_stride(ipu_plane->ipu_ch, state->fb->pitches[0]);
-        ipu_plane_atomic_set_base(ipu_plane, old_state);
+        ipu_plane_atomic_set_base(ipu_plane);
        ipu_plane_enable(ipu_plane);
 }
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
index 019b7ca392d7..c70310206ac5 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
@@ -80,6 +80,7 @@ static void mtk_ovl_enable_vblank(struct mtk_ddp_comp *comp,
                                                 ddp_comp);
        priv->crtc = crtc;
+        writel(0x0, comp->regs + DISP_REG_OVL_INTSTA);
        writel_relaxed(OVL_FME_CPL_INT, comp->regs + DISP_REG_OVL_INTEN);
 }
@@ -250,13 +251,6 @@ static int mtk_disp_ovl_probe(struct platform_device *pdev)
        if (irq < 0)
                return irq;
-        ret = devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler,
-                               IRQF_TRIGGER_NONE, dev_name(dev), priv);
-        if (ret < 0) {
-                dev_err(dev, "Failed to request irq %d: %d\n", irq, ret);
-                return ret;
-        }
        comp_id = mtk_ddp_comp_get_id(dev->of_node, MTK_DISP_OVL);
        if (comp_id < 0) {
                dev_err(dev, "Failed to identify by alias: %d\n", comp_id);
@@ -272,6 +266,13 @@ static int mtk_disp_ovl_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, priv);
+        ret = devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler,
+                               IRQF_TRIGGER_NONE, dev_name(dev), priv);
+        if (ret < 0) {
+                dev_err(dev, "Failed to request irq %d: %d\n", irq, ret);
+                return ret;
+        }
        ret = component_add(dev, &mtk_disp_ovl_component_ops);
        if (ret)
                dev_err(dev, "Failed to add component: %d\n", ret);
diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c
index 0186e500d2a5..90fb831ef031 100644
--- a/drivers/gpu/drm/mediatek/mtk_dpi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dpi.c
@@ -432,11 +432,16 @@ static int mtk_dpi_set_display_mode(struct mtk_dpi *dpi,
        unsigned long pll_rate;
        unsigned int factor;
+        /* let pll_rate can fix the valid range of tvdpll (1G~2GHz) */
        pix_rate = 1000UL * mode->clock;
-        if (mode->clock <= 74000)
+        if (mode->clock <= 27000)
+                factor = 16 * 3;
+        else if (mode->clock <= 84000)
                factor = 8 * 3;
-        else
+        else if (mode->clock <= 167000)
                factor = 4 * 3;
+        else
+                factor = 2 * 3;
        pll_rate = pix_rate * factor;
        dev_dbg(dpi->dev, "Want PLL %lu Hz, pixel clock %lu Hz\n",
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
index df33b3ca6ffd..48cc01fd20c7 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
@@ -123,7 +123,7 @@ static void mtk_od_config(struct mtk_ddp_comp *comp, unsigned int w,
                          unsigned int bpc)
 {
        writel(w << 16 | h, comp->regs + DISP_OD_SIZE);
-        writel(OD_RELAYMODE, comp->regs + OD_RELAYMODE);
+        writel(OD_RELAYMODE, comp->regs + DISP_OD_CFG);
        mtk_dither_set(comp, bpc, DISP_OD_CFG);
 }
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index 28b2044ed9f2..eaa5a2240c0c 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -86,7 +86,7 @@
 #define DSI_PHY_TIMECON0        0x110
 #define LPX                             (0xff << 0)
-#define HS_PRPR                         (0xff << 8)
+#define HS_PREP                         (0xff << 8)
 #define HS_ZERO                         (0xff << 16)
 #define HS_TRAIL                        (0xff << 24)
@@ -102,10 +102,16 @@
 #define CLK_TRAIL                       (0xff << 24)
 #define DSI_PHY_TIMECON3        0x11c
-#define CLK_HS_PRPR                     (0xff << 0)
+#define CLK_HS_PREP                     (0xff << 0)
 #define CLK_HS_POST                     (0xff << 8)
 #define CLK_HS_EXIT                     (0xff << 16)
+#define T_LPX           5
+#define T_HS_PREP       6
+#define T_HS_TRAIL      8
+#define T_HS_EXIT       7
+#define T_HS_ZERO       10
 #define NS_TO_CYCLE(n, c)    ((n) / (c) + (((n) % (c)) ? 1 : 0))
 struct phy;
@@ -161,20 +167,18 @@ static void mtk_dsi_mask(struct mtk_dsi *dsi, u32 offset, u32 mask, u32 data)
 static void dsi_phy_timconfig(struct mtk_dsi *dsi)
 {
        u32 timcon0, timcon1, timcon2, timcon3;
-        unsigned int ui, cycle_time;
+        u32 ui, cycle_time;
-        unsigned int lpx;
        ui = 1000 / dsi->data_rate + 0x01;
        cycle_time = 8000 / dsi->data_rate + 0x01;
-        lpx = 5;
-        timcon0 = (8 << 24) | (0xa << 16) | (0x6 << 8) | lpx;
+        timcon0 = T_LPX | T_HS_PREP << 8 | T_HS_ZERO << 16 | T_HS_TRAIL << 24;
-        timcon1 = (7 << 24) | (5 * lpx << 16) | ((3 * lpx) / 2) << 8 |
+        timcon1 = 4 * T_LPX | (3 * T_LPX / 2) << 8 | 5 * T_LPX << 16 |
-                  (4 * lpx);
+                  T_HS_EXIT << 24;
        timcon2 = ((NS_TO_CYCLE(0x64, cycle_time) + 0xa) << 24) |
                  (NS_TO_CYCLE(0x150, cycle_time) << 16);
-        timcon3 = (2 * lpx) << 16 | NS_TO_CYCLE(80 + 52 * ui, cycle_time) << 8 |
+        timcon3 = NS_TO_CYCLE(0x40, cycle_time) | (2 * T_LPX) << 16 |
-                   NS_TO_CYCLE(0x40, cycle_time);
+                  NS_TO_CYCLE(80 + 52 * ui, cycle_time) << 8;
        writel(timcon0, dsi->regs + DSI_PHY_TIMECON0);
        writel(timcon1, dsi->regs + DSI_PHY_TIMECON1);
@@ -202,19 +206,47 @@ static int mtk_dsi_poweron(struct mtk_dsi *dsi)
 {
        struct device *dev = dsi->dev;
        int ret;
+        u64 pixel_clock, total_bits;
+        u32 htotal, htotal_bits, bit_per_pixel, overhead_cycles, overhead_bits;
        if (++dsi->refcount != 1)
                return 0;
+        switch (dsi->format) {
+        case MIPI_DSI_FMT_RGB565:
+                bit_per_pixel = 16;
+                break;
+        case MIPI_DSI_FMT_RGB666_PACKED:
+                bit_per_pixel = 18;
+                break;
+        case MIPI_DSI_FMT_RGB666:
+        case MIPI_DSI_FMT_RGB888:
+        default:
+                bit_per_pixel = 24;
+                break;
+        }
        /**
-         * data_rate = (pixel_clock / 1000) * pixel_dipth * mipi_ratio;
+         * vm.pixelclock is in kHz, pixel_clock unit is Hz, so multiply by 1000
-         * pixel_clock unit is Khz, data_rata unit is MHz, so need divide 1000.
+         * htotal_time = htotal * byte_per_pixel / num_lanes
-         * mipi_ratio is mipi clk coefficient for balance the pixel clk in mipi.
+         * overhead_time = lpx + hs_prepare + hs_zero + hs_trail + hs_exit
-         * we set mipi_ratio is 1.05.
+         * mipi_ratio = (htotal_time + overhead_time) / htotal_time
+         * data_rate = pixel_clock * bit_per_pixel * mipi_ratio / num_lanes;
         */
-        dsi->data_rate = dsi->vm.pixelclock * 3 * 21 / (1 * 1000 * 10);
+        pixel_clock = dsi->vm.pixelclock * 1000;
+        htotal = dsi->vm.hactive + dsi->vm.hback_porch + dsi->vm.hfront_porch +
+                        dsi->vm.hsync_len;
+        htotal_bits = htotal * bit_per_pixel;
+        overhead_cycles = T_LPX + T_HS_PREP + T_HS_ZERO + T_HS_TRAIL +
+                        T_HS_EXIT;
+        overhead_bits = overhead_cycles * dsi->lanes * 8;
+        total_bits = htotal_bits + overhead_bits;
+        dsi->data_rate = DIV_ROUND_UP_ULL(pixel_clock * total_bits,
+                                          htotal * dsi->lanes);
-        ret = clk_set_rate(dsi->hs_clk, dsi->data_rate * 1000000);
+        ret = clk_set_rate(dsi->hs_clk, dsi->data_rate);
        if (ret < 0) {
                dev_err(dev, "Failed to set data rate: %d\n", ret);
                goto err_refcount;
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
index 71227deef21b..0e8c4d9af340 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
@@ -1133,12 +1133,6 @@ static int mtk_hdmi_output_set_display_mode(struct mtk_hdmi *hdmi,
        phy_power_on(hdmi->phy);
        mtk_hdmi_aud_output_config(hdmi, mode);
-        mtk_hdmi_setup_audio_infoframe(hdmi);
-        mtk_hdmi_setup_avi_infoframe(hdmi, mode);
-        mtk_hdmi_setup_spd_infoframe(hdmi, "mediatek", "On-chip HDMI");
-        if (mode->flags & DRM_MODE_FLAG_3D_MASK)
-                mtk_hdmi_setup_vendor_specific_infoframe(hdmi, mode);
        mtk_hdmi_hw_vid_black(hdmi, false);
        mtk_hdmi_hw_aud_unmute(hdmi);
        mtk_hdmi_hw_send_av_unmute(hdmi);
@@ -1401,6 +1395,16 @@ static void mtk_hdmi_bridge_pre_enable(struct drm_bridge *bridge)
        hdmi->powered = true;
 }
+static void mtk_hdmi_send_infoframe(struct mtk_hdmi *hdmi,
+                                    struct drm_display_mode *mode)
+{
+        mtk_hdmi_setup_audio_infoframe(hdmi);
+        mtk_hdmi_setup_avi_infoframe(hdmi, mode);
+        mtk_hdmi_setup_spd_infoframe(hdmi, "mediatek", "On-chip HDMI");
+        if (mode->flags & DRM_MODE_FLAG_3D_MASK)
+                mtk_hdmi_setup_vendor_specific_infoframe(hdmi, mode);
+}
 static void mtk_hdmi_bridge_enable(struct drm_bridge *bridge)
 {
        struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
@@ -1409,6 +1413,7 @@ static void mtk_hdmi_bridge_enable(struct drm_bridge *bridge)
        clk_prepare_enable(hdmi->clk[MTK_HDMI_CLK_HDMI_PLL]);
        clk_prepare_enable(hdmi->clk[MTK_HDMI_CLK_HDMI_PIXEL]);
        phy_power_on(hdmi->phy);
+        mtk_hdmi_send_infoframe(hdmi, &hdmi->mode);
        hdmi->enabled = true;
 }
diff --git a/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c b/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
index 8a24754b440f..51cb9cfb6646 100644
--- a/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
+++ b/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
@@ -265,6 +265,9 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
        unsigned int pre_div;
        unsigned int div;
+        unsigned int pre_ibias;
+        unsigned int hdmi_ibias;
+        unsigned int imp_en;
        dev_dbg(hdmi_phy->dev, "%s: %lu Hz, parent: %lu Hz\n", __func__,
                rate, parent_rate);
@@ -298,18 +301,31 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
                          (0x1 << PLL_BR_SHIFT),
                          RG_HDMITX_PLL_BP | RG_HDMITX_PLL_BC |
                          RG_HDMITX_PLL_BR);
-        mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON3, RG_HDMITX_PRD_IMP_EN);
+        if (rate < 165000000) {
+                mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON3,
+                                        RG_HDMITX_PRD_IMP_EN);
+                pre_ibias = 0x3;
+                imp_en = 0x0;
+                hdmi_ibias = hdmi_phy->ibias;
+        } else {
+                mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON3,
+                                      RG_HDMITX_PRD_IMP_EN);
+                pre_ibias = 0x6;
+                imp_en = 0xf;
+                hdmi_ibias = hdmi_phy->ibias_up;
+        }
        mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON4,
-                          (0x3 << PRD_IBIAS_CLK_SHIFT) |
+                          (pre_ibias << PRD_IBIAS_CLK_SHIFT) |
-                          (0x3 << PRD_IBIAS_D2_SHIFT) |
+                          (pre_ibias << PRD_IBIAS_D2_SHIFT) |
-                          (0x3 << PRD_IBIAS_D1_SHIFT) |
+                          (pre_ibias << PRD_IBIAS_D1_SHIFT) |
-                          (0x3 << PRD_IBIAS_D0_SHIFT),
+                          (pre_ibias << PRD_IBIAS_D0_SHIFT),
                          RG_HDMITX_PRD_IBIAS_CLK |
                          RG_HDMITX_PRD_IBIAS_D2 |
                          RG_HDMITX_PRD_IBIAS_D1 |
                          RG_HDMITX_PRD_IBIAS_D0);
        mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON3,
-                          (0x0 << DRV_IMP_EN_SHIFT), RG_HDMITX_DRV_IMP_EN);
+                          (imp_en << DRV_IMP_EN_SHIFT),
+                          RG_HDMITX_DRV_IMP_EN);
        mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON6,
                          (hdmi_phy->drv_imp_clk << DRV_IMP_CLK_SHIFT) |
                          (hdmi_phy->drv_imp_d2 << DRV_IMP_D2_SHIFT) |
@@ -318,12 +334,14 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
                          RG_HDMITX_DRV_IMP_CLK | RG_HDMITX_DRV_IMP_D2 |
                          RG_HDMITX_DRV_IMP_D1 | RG_HDMITX_DRV_IMP_D0);
        mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON5,
-                          (hdmi_phy->ibias << DRV_IBIAS_CLK_SHIFT) |
+                          (hdmi_ibias << DRV_IBIAS_CLK_SHIFT) |
-                          (hdmi_phy->ibias << DRV_IBIAS_D2_SHIFT) |
+                          (hdmi_ibias << DRV_IBIAS_D2_SHIFT) |
-                          (hdmi_phy->ibias << DRV_IBIAS_D1_SHIFT) |
+                          (hdmi_ibias << DRV_IBIAS_D1_SHIFT) |
-                          (hdmi_phy->ibias << DRV_IBIAS_D0_SHIFT),
+                          (hdmi_ibias << DRV_IBIAS_D0_SHIFT),
-                          RG_HDMITX_DRV_IBIAS_CLK | RG_HDMITX_DRV_IBIAS_D2 |
+                          RG_HDMITX_DRV_IBIAS_CLK |
-                          RG_HDMITX_DRV_IBIAS_D1 | RG_HDMITX_DRV_IBIAS_D0);
+                          RG_HDMITX_DRV_IBIAS_D2 |
+                          RG_HDMITX_DRV_IBIAS_D1 |
+                          RG_HDMITX_DRV_IBIAS_D0);
        return 0;
 }
diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c
index 919b35f2ad24..dcf7d11ac380 100644
--- a/drivers/gpu/drm/mgag200/mgag200_ttm.c
+++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c
@@ -266,6 +266,9 @@ int mgag200_mm_init(struct mga_device *mdev)
                return ret;
        }
+        arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                   pci_resource_len(dev->pdev, 0));
        mdev->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0),
                                         pci_resource_len(dev->pdev, 0));
@@ -274,10 +277,14 @@ int mgag200_mm_init(struct mga_device *mdev)
 void mgag200_mm_fini(struct mga_device *mdev)
 {
+        struct drm_device *dev = mdev->dev;
        ttm_bo_device_release(&mdev->ttm.bdev);
        mgag200_ttm_global_release(mdev);
+        arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0),
+                                pci_resource_len(dev->pdev, 0));
        arch_phys_wc_del(mdev->fb_mtrr);
        mdev->fb_mtrr = 0;
 }
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index f05ed0e1f3d6..6f240021705b 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -139,6 +139,7 @@ struct msm_dsi_host {
        u32 err_work_state;
        struct work_struct err_work;
+        struct work_struct hpd_work;
        struct workqueue_struct *workqueue;
        /* DSI 6G TX buffer*/
@@ -1294,6 +1295,14 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host)
        wmb();  /* make sure dsi controller enabled again */
 }
+static void dsi_hpd_worker(struct work_struct *work)
+{
+        struct msm_dsi_host *msm_host =
+                container_of(work, struct msm_dsi_host, hpd_work);
+        drm_helper_hpd_irq_event(msm_host->dev);
+}
 static void dsi_err_worker(struct work_struct *work)
 {
        struct msm_dsi_host *msm_host =
@@ -1480,7 +1489,7 @@ static int dsi_host_attach(struct mipi_dsi_host *host,
        DBG("id=%d", msm_host->id);
        if (msm_host->dev)
-                drm_helper_hpd_irq_event(msm_host->dev);
+                queue_work(msm_host->workqueue, &msm_host->hpd_work);
        return 0;
 }
@@ -1494,7 +1503,7 @@ static int dsi_host_detach(struct mipi_dsi_host *host,
        DBG("id=%d", msm_host->id);
        if (msm_host->dev)
-                drm_helper_hpd_irq_event(msm_host->dev);
+                queue_work(msm_host->workqueue, &msm_host->hpd_work);
        return 0;
 }
@@ -1748,6 +1757,7 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi)
        /* setup workqueue */
        msm_host->workqueue = alloc_ordered_workqueue("dsi_drm_work", 0);
        INIT_WORK(&msm_host->err_work, dsi_err_worker);
+        INIT_WORK(&msm_host->hpd_work, dsi_hpd_worker);
        msm_dsi->host = &msm_host->base;
        msm_dsi->id = msm_host->id;
diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm.c
index 598fdaff0a41..26e3a01a99c2 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm.c
@@ -521,6 +521,7 @@ static int pll_28nm_register(struct dsi_pll_28nm *pll_28nm)
                .parent_names = (const char *[]){ "xo" },
                .num_parents = 1,
                .name = vco_name,
+                .flags = CLK_IGNORE_UNUSED,
                .ops = &clk_ops_dsi_pll_28nm_vco,
        };
        struct device *dev = &pll_28nm->pdev->dev;
diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm_8960.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm_8960.c
index 38c90e1eb002..49008451085b 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm_8960.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_28nm_8960.c
@@ -412,6 +412,7 @@ static int pll_28nm_register(struct dsi_pll_28nm *pll_28nm)
        struct clk_init_data vco_init = {
                .parent_names = (const char *[]){ "pxo" },
                .num_parents = 1,
+                .flags = CLK_IGNORE_UNUSED,
                .ops = &clk_ops_dsi_pll_28nm_vco,
        };
        struct device *dev = &pll_28nm->pdev->dev;
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_phy_8996.c b/drivers/gpu/drm/msm/hdmi/hdmi_phy_8996.c
index aa94a553794f..143eab46ba68 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_phy_8996.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_phy_8996.c
@@ -702,6 +702,7 @@ static struct clk_init_data pll_init = {
        .ops = &hdmi_8996_pll_ops,
        .parent_names = hdmi_pll_parents,
        .num_parents = ARRAY_SIZE(hdmi_pll_parents),
+        .flags = CLK_IGNORE_UNUSED,
 };
 int msm_hdmi_pll_8996_init(struct platform_device *pdev)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_pll_8960.c b/drivers/gpu/drm/msm/hdmi/hdmi_pll_8960.c
index 92da69aa6187..99590758c68b 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_pll_8960.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_pll_8960.c
@@ -424,6 +424,7 @@ static struct clk_init_data pll_init = {
        .ops = &hdmi_pll_ops,
        .parent_names = hdmi_pll_parents,
        .num_parents = ARRAY_SIZE(hdmi_pll_parents),
+        .flags = CLK_IGNORE_UNUSED,
 };
 int msm_hdmi_pll_8960_init(struct platform_device *pdev)
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
index ac9e4cde1380..8b4e3004f451 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
@@ -272,7 +272,7 @@ const struct mdp5_cfg_hw msm8x16_config = {
                .count = 2,
                .base = { 0x14000, 0x16000 },
                .caps = MDP_PIPE_CAP_HFLIP | MDP_PIPE_CAP_VFLIP |
-                                MDP_PIPE_CAP_SCALE | MDP_PIPE_CAP_DECIMATION,
+                                MDP_PIPE_CAP_DECIMATION,
        },
        .pipe_dma = {
                .count = 1,
@@ -282,7 +282,7 @@ const struct mdp5_cfg_hw msm8x16_config = {
        .lm = {
                .count = 2, /* LM0 and LM3 */
                .base = { 0x44000, 0x47000 },
-                .nb_stages = 5,
+                .nb_stages = 8,
                .max_width = 2048,
                .max_height = 0xFFFF,
        },
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index fa2be7ce9468..c205c360e16d 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -223,12 +223,7 @@ static void blend_setup(struct drm_crtc *crtc)
                plane_cnt++;
        }
-        /*
+        if (!pstates[STAGE_BASE]) {
-        * If there is no base layer, enable border color.
-        * Although it's not possbile in current blend logic,
-        * put it here as a reminder.
-        */
-        if (!pstates[STAGE_BASE] && plane_cnt) {
                ctl_blend_flags |= MDP5_CTL_BLEND_OP_FLAG_BORDER_OUT;
                DBG("Border Color is enabled");
        }
@@ -365,6 +360,15 @@ static int pstate_cmp(const void *a, const void *b)
        return pa->state->zpos - pb->state->zpos;
 }
+/* is there a helper for this? */
+static bool is_fullscreen(struct drm_crtc_state *cstate,
+                struct drm_plane_state *pstate)
+{
+        return (pstate->crtc_x <= 0) && (pstate->crtc_y <= 0) &&
+                ((pstate->crtc_x + pstate->crtc_w) >= cstate->mode.hdisplay) &&
+                ((pstate->crtc_y + pstate->crtc_h) >= cstate->mode.vdisplay);
+}
 static int mdp5_crtc_atomic_check(struct drm_crtc *crtc,
                struct drm_crtc_state *state)
 {
@@ -375,21 +379,11 @@ static int mdp5_crtc_atomic_check(struct drm_crtc *crtc,
        struct plane_state pstates[STAGE_MAX + 1];
        const struct mdp5_cfg_hw *hw_cfg;
        const struct drm_plane_state *pstate;
-        int cnt = 0, i;
+        int cnt = 0, base = 0, i;
        DBG("%s: check", mdp5_crtc->name);
-        /* verify that there are not too many planes attached to crtc
-         * and that we don't have conflicting mixer stages:
-         */
-        hw_cfg = mdp5_cfg_get_hw_config(mdp5_kms->cfg);
        drm_atomic_crtc_state_for_each_plane_state(plane, pstate, state) {
-                if (cnt >= (hw_cfg->lm.nb_stages)) {
-                        dev_err(dev->dev, "too many planes!\n");
-                        return -EINVAL;
-                }
                pstates[cnt].plane = plane;
                pstates[cnt].state = to_mdp5_plane_state(pstate);
@@ -399,8 +393,24 @@ static int mdp5_crtc_atomic_check(struct drm_crtc *crtc,
        /* assign a stage based on sorted zpos property */
        sort(pstates, cnt, sizeof(pstates[0]), pstate_cmp, NULL);
+        /* if the bottom-most layer is not fullscreen, we need to use
+         * it for solid-color:
+         */
+        if ((cnt > 0) && !is_fullscreen(state, &pstates[0].state->base))
+                base++;
+        /* verify that there are not too many planes attached to crtc
+         * and that we don't have conflicting mixer stages:
+         */
+        hw_cfg = mdp5_cfg_get_hw_config(mdp5_kms->cfg);
+        if ((cnt + base) >= hw_cfg->lm.nb_stages) {
+                dev_err(dev->dev, "too many planes!\n");
+                return -EINVAL;
+        }
        for (i = 0; i < cnt; i++) {
-                pstates[i].state->stage = STAGE_BASE + i;
+                pstates[i].state->stage = STAGE_BASE + i + base;
                DBG("%s: assign pipe %s on stage=%d", mdp5_crtc->name,
                                pipe2name(mdp5_plane_pipe(pstates[i].plane)),
                                pstates[i].state->stage);
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index 951c002b05df..83bf997dda03 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -292,8 +292,7 @@ static int mdp5_plane_atomic_check(struct drm_plane *plane,
                format = to_mdp_format(msm_framebuffer_format(state->fb));
                if (MDP_FORMAT_IS_YUV(format) &&
                        !pipe_supports_yuv(mdp5_plane->caps)) {
-                        dev_err(plane->dev->dev,
+                        DBG("Pipe doesn't support YUV\n");
-                                "Pipe doesn't support YUV\n");
                        return -EINVAL;
                }
@@ -301,8 +300,7 @@ static int mdp5_plane_atomic_check(struct drm_plane *plane,
                if (!(mdp5_plane->caps & MDP_PIPE_CAP_SCALE) &&
                        (((state->src_w >> 16) != state->crtc_w) ||
                        ((state->src_h >> 16) != state->crtc_h))) {
-                        dev_err(plane->dev->dev,
+                        DBG("Pipe doesn't support scaling (%dx%d -> %dx%d)\n",
-                                "Pipe doesn't support scaling (%dx%d -> %dx%d)\n",
                                state->src_w >> 16, state->src_h >> 16,
                                state->crtc_w, state->crtc_h);
@@ -313,8 +311,7 @@ static int mdp5_plane_atomic_check(struct drm_plane *plane,
                vflip = !!(state->rotation & DRM_REFLECT_Y);
                if ((vflip && !(mdp5_plane->caps & MDP_PIPE_CAP_VFLIP)) ||
                        (hflip && !(mdp5_plane->caps & MDP_PIPE_CAP_HFLIP))) {
-                        dev_err(plane->dev->dev,
+                        DBG("Pipe doesn't support flip\n");
-                                "Pipe doesn't support flip\n");
                        return -EINVAL;
                }
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index fb5c0b0a7594..46568fc80848 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -228,7 +228,7 @@ static int msm_drm_uninit(struct device *dev)
        flush_workqueue(priv->atomic_wq);
        destroy_workqueue(priv->atomic_wq);
-        if (kms)
+        if (kms && kms->funcs)
                kms->funcs->destroy(kms);
        if (gpu) {
diff --git a/drivers/gpu/drm/msm/msm_gem_shrinker.c b/drivers/gpu/drm/msm/msm_gem_shrinker.c
index 283d2841ba58..192b2d3a79cb 100644
--- a/drivers/gpu/drm/msm/msm_gem_shrinker.c
+++ b/drivers/gpu/drm/msm/msm_gem_shrinker.c
@@ -163,6 +163,9 @@ void msm_gem_shrinker_init(struct drm_device *dev)
 void msm_gem_shrinker_cleanup(struct drm_device *dev)
 {
        struct msm_drm_private *priv = dev->dev_private;
-        WARN_ON(unregister_vmap_purge_notifier(&priv->vmap_notifier));
-        unregister_shrinker(&priv->shrinker);
+        if (priv->shrinker.nr_deferred) {
+                WARN_ON(unregister_vmap_purge_notifier(&priv->vmap_notifier));
+                unregister_shrinker(&priv->shrinker);
+        }
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index dc57b628e074..193573d191e5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -240,7 +240,8 @@ static bool nouveau_pr3_present(struct pci_dev *pdev)
        if (!parent_adev)
                return false;
-        return acpi_has_method(parent_adev->handle, "_PR3");
+        return parent_adev->power.flags.power_resources &&
+                acpi_has_method(parent_adev->handle, "_PR3");
 }
 static void nouveau_dsm_pci_probe(struct pci_dev *pdev, acpi_handle *dhandle_out,
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index 1825dbc33192..a6dbe8258040 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -398,6 +398,9 @@ nouveau_ttm_init(struct nouveau_drm *drm)
        /* VRAM init */
        drm->gem.vram_available = drm->device.info.ram_user;
+        arch_io_reserve_memtype_wc(device->func->resource_addr(device, 1),
+                                   device->func->resource_size(device, 1));
        ret = ttm_bo_init_mm(&drm->ttm.bdev, TTM_PL_VRAM,
                              drm->gem.vram_available >> PAGE_SHIFT);
        if (ret) {
@@ -430,6 +433,8 @@ nouveau_ttm_init(struct nouveau_drm *drm)
 void
 nouveau_ttm_fini(struct nouveau_drm *drm)
 {
+        struct nvkm_device *device = nvxx_device(&drm->device);
        ttm_bo_clean_mm(&drm->ttm.bdev, TTM_PL_VRAM);
        ttm_bo_clean_mm(&drm->ttm.bdev, TTM_PL_TT);
@@ -439,4 +444,7 @@ nouveau_ttm_fini(struct nouveau_drm *drm)
        arch_phys_wc_del(drm->ttm.mtrr);
        drm->ttm.mtrr = 0;
+        arch_io_free_memtype_wc(device->func->resource_addr(device, 1),
+                                device->func->resource_size(device, 1));
 }
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 103fc8650197..a0d4a0522fdc 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1396,9 +1396,7 @@ static void cayman_pcie_gart_fini(struct radeon_device *rdev)
 void cayman_cp_int_cntl_setup(struct radeon_device *rdev,
                              int ring, u32 cp_int_cntl)
 {
-        u32 srbm_gfx_cntl = RREG32(SRBM_GFX_CNTL) & ~3;
+        WREG32(SRBM_GFX_CNTL, RINGID(ring));
-        WREG32(SRBM_GFX_CNTL, srbm_gfx_cntl | (ring & 3));
        WREG32(CP_INT_CNTL, cp_int_cntl);
 }
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index 6a4b020dd0b4..5a26eb4545aa 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -156,19 +156,20 @@ u32 r600_dpm_get_vblank_time(struct radeon_device *rdev)
        struct drm_device *dev = rdev->ddev;
        struct drm_crtc *crtc;
        struct radeon_crtc *radeon_crtc;
-        u32 line_time_us, vblank_lines;
+        u32 vblank_in_pixels;
        u32 vblank_time_us = 0xffffffff; /* if the displays are off, vblank time is max */
        if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
                list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                        radeon_crtc = to_radeon_crtc(crtc);
                        if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
-                                line_time_us = (radeon_crtc->hw_mode.crtc_htotal * 1000) /
+                                vblank_in_pixels =
-                                        radeon_crtc->hw_mode.clock;
+                                        radeon_crtc->hw_mode.crtc_htotal *
-                                vblank_lines = radeon_crtc->hw_mode.crtc_vblank_end -
+                                        (radeon_crtc->hw_mode.crtc_vblank_end -
-                                        radeon_crtc->hw_mode.crtc_vdisplay +
+                                         radeon_crtc->hw_mode.crtc_vdisplay +
-                                        (radeon_crtc->v_border * 2);
+                                         (radeon_crtc->v_border * 2));
-                                vblank_time_us = vblank_lines * line_time_us;
+                                vblank_time_us = vblank_in_pixels * 1000 / radeon_crtc->hw_mode.clock;
                                break;
                        }
                }
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 2fdcd04bc93f..0ae13cd2adda 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -34,6 +34,7 @@ struct radeon_atpx {
 static struct radeon_atpx_priv {
        bool atpx_detected;
+        bool bridge_pm_usable;
        /* handle for device - and atpx */
        acpi_handle dhandle;
        struct radeon_atpx atpx;
@@ -203,7 +204,11 @@ static int radeon_atpx_validate(struct radeon_atpx *atpx)
        atpx->is_hybrid = false;
        if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
                printk("ATPX Hybrid Graphics\n");
-                atpx->functions.power_cntl = false;
+                /*
+                 * Disable legacy PM methods only when pcie port PM is usable,
+                 * otherwise the device might fail to power off or power on.
+                 */
+                atpx->functions.power_cntl = !radeon_atpx_priv.bridge_pm_usable;
                atpx->is_hybrid = true;
        }
@@ -548,11 +553,16 @@ static bool radeon_atpx_detect(void)
        struct pci_dev *pdev = NULL;
        bool has_atpx = false;
        int vga_count = 0;
+        bool d3_supported = false;
+        struct pci_dev *parent_pdev;
        while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
                vga_count++;
                has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
+                parent_pdev = pci_upstream_bridge(pdev);
+                d3_supported |= parent_pdev && parent_pdev->bridge_d3;
        }
        /* some newer PX laptops mark the dGPU as a non-VGA display device */
@@ -560,6 +570,9 @@ static bool radeon_atpx_detect(void)
                vga_count++;
                has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
+                parent_pdev = pci_upstream_bridge(pdev);
+                d3_supported |= parent_pdev && parent_pdev->bridge_d3;
        }
        if (has_atpx && vga_count == 2) {
@@ -567,6 +580,7 @@ static bool radeon_atpx_detect(void)
                printk(KERN_INFO "vga_switcheroo: detected switching method %s handle\n",
                       acpi_method_name);
                radeon_atpx_priv.atpx_detected = true;
+                radeon_atpx_priv.bridge_pm_usable = d3_supported;
                radeon_atpx_init();
                return true;
        }
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 50e96d2c593d..27affbde058c 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -927,6 +927,16 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
        return ret;
 }
+static void radeon_connector_unregister(struct drm_connector *connector)
+{
+        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+        if (radeon_connector->ddc_bus && radeon_connector->ddc_bus->has_aux) {
+                drm_dp_aux_unregister(&radeon_connector->ddc_bus->aux);
+                radeon_connector->ddc_bus->has_aux = false;
+        }
+}
 static void radeon_connector_destroy(struct drm_connector *connector)
 {
        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
@@ -984,6 +994,7 @@ static const struct drm_connector_funcs radeon_lvds_connector_funcs = {
        .dpms = drm_helper_connector_dpms,
        .detect = radeon_lvds_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
+        .early_unregister = radeon_connector_unregister,
        .destroy = radeon_connector_destroy,
        .set_property = radeon_lvds_set_property,
 };
@@ -1111,6 +1122,7 @@ static const struct drm_connector_funcs radeon_vga_connector_funcs = {
        .dpms = drm_helper_connector_dpms,
        .detect = radeon_vga_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
+        .early_unregister = radeon_connector_unregister,
        .destroy = radeon_connector_destroy,
        .set_property = radeon_connector_set_property,
 };
@@ -1188,6 +1200,7 @@ static const struct drm_connector_funcs radeon_tv_connector_funcs = {
        .dpms = drm_helper_connector_dpms,
        .detect = radeon_tv_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
+        .early_unregister = radeon_connector_unregister,
        .destroy = radeon_connector_destroy,
        .set_property = radeon_connector_set_property,
 };
@@ -1519,6 +1532,7 @@ static const struct drm_connector_funcs radeon_dvi_connector_funcs = {
        .detect = radeon_dvi_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .set_property = radeon_connector_set_property,
+        .early_unregister = radeon_connector_unregister,
        .destroy = radeon_connector_destroy,
        .force = radeon_dvi_force,
 };
@@ -1832,6 +1846,7 @@ static const struct drm_connector_funcs radeon_dp_connector_funcs = {
        .detect = radeon_dp_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .set_property = radeon_connector_set_property,
+        .early_unregister = radeon_connector_unregister,
        .destroy = radeon_connector_destroy,
        .force = radeon_dvi_force,
 };
@@ -1841,6 +1856,7 @@ static const struct drm_connector_funcs radeon_edp_connector_funcs = {
        .detect = radeon_dp_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .set_property = radeon_lvds_set_property,
+        .early_unregister = radeon_connector_unregister,
        .destroy = radeon_connector_destroy,
        .force = radeon_dvi_force,
 };
@@ -1850,6 +1866,7 @@ static const struct drm_connector_funcs radeon_lvds_bridge_connector_funcs = {
        .detect = radeon_dp_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .set_property = radeon_lvds_set_property,
+        .early_unregister = radeon_connector_unregister,
        .destroy = radeon_connector_destroy,
        .force = radeon_dvi_force,
 };
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index eb92aef46e3c..621af069a3d2 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -104,6 +104,14 @@ static const char radeon_family_name[][16] = {
        "LAST",
 };
+#if defined(CONFIG_VGA_SWITCHEROO)
+bool radeon_has_atpx_dgpu_power_cntl(void);
+bool radeon_is_atpx_hybrid(void);
+#else
+static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; }
+static inline bool radeon_is_atpx_hybrid(void) { return false; }
+#endif
 #define RADEON_PX_QUIRK_DISABLE_PX  (1 << 0)
 #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1)
@@ -160,6 +168,11 @@ static void radeon_device_handle_px_quirks(struct radeon_device *rdev)
        if (rdev->px_quirk_flags & RADEON_PX_QUIRK_DISABLE_PX)
                rdev->flags &= ~RADEON_IS_PX;
+        /* disable PX is the system doesn't support dGPU power control or hybrid gfx */
+        if (!radeon_is_atpx_hybrid() &&
+            !radeon_has_atpx_dgpu_power_cntl())
+                rdev->flags &= ~RADEON_IS_PX;
 }
 /**
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index b8ab30a7dd6d..cdb8cb568c15 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1675,20 +1675,20 @@ int radeon_modeset_init(struct radeon_device *rdev)
 void radeon_modeset_fini(struct radeon_device *rdev)
 {
-        radeon_fbdev_fini(rdev);
-        kfree(rdev->mode_info.bios_hardcoded_edid);
-        /* free i2c buses */
-        radeon_i2c_fini(rdev);
        if (rdev->mode_info.mode_config_initialized) {
-                radeon_afmt_fini(rdev);
                drm_kms_helper_poll_fini(rdev->ddev);
                radeon_hpd_fini(rdev);
                drm_crtc_force_disable_all(rdev->ddev);
+                radeon_fbdev_fini(rdev);
+                radeon_afmt_fini(rdev);
                drm_mode_config_cleanup(rdev->ddev);
                rdev->mode_info.mode_config_initialized = false;
        }
+        kfree(rdev->mode_info.bios_hardcoded_edid);
+        /* free i2c buses */
+        radeon_i2c_fini(rdev);
 }
 static bool is_hdtv_mode(const struct drm_display_mode *mode)
diff --git a/drivers/gpu/drm/radeon/radeon_dp_auxch.c b/drivers/gpu/drm/radeon/radeon_dp_auxch.c
index 2d465648856a..474a8a1886f7 100644
--- a/drivers/gpu/drm/radeon/radeon_dp_auxch.c
+++ b/drivers/gpu/drm/radeon/radeon_dp_auxch.c
@@ -105,7 +105,7 @@ radeon_dp_aux_transfer_native(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg
        tmp &= AUX_HPD_SEL(0x7);
        tmp |= AUX_HPD_SEL(chan->rec.hpd);
-        tmp |= AUX_EN | AUX_LS_READ_EN | AUX_HPD_DISCON(0x1);
+        tmp |= AUX_EN | AUX_LS_READ_EN;
        WREG32(AUX_CONTROL + aux_offset[instance], tmp);
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 91c8f4339566..00ea0002b539 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -96,9 +96,10 @@
 *   2.45.0 - Allow setting shader registers using DMA/COPY packet3 on SI
 *   2.46.0 - Add PFP_SYNC_ME support on evergreen
 *   2.47.0 - Add UVD_NO_OP register support
+ *   2.48.0 - TA_CS_BC_BASE_ADDR allowed on SI
 */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        47
+#define KMS_DRIVER_MINOR        48
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
index 021aa005623f..29f7817af821 100644
--- a/drivers/gpu/drm/radeon/radeon_i2c.c
+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -982,9 +982,8 @@ void radeon_i2c_destroy(struct radeon_i2c_chan *i2c)
 {
        if (!i2c)
                return;
+        WARN_ON(i2c->has_aux);
        i2c_del_adapter(&i2c->adapter);
-        if (i2c->has_aux)
-                drm_dp_aux_unregister(&i2c->aux);
        kfree(i2c);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index be30861afae9..41b72ce6613f 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -446,6 +446,10 @@ void radeon_bo_force_delete(struct radeon_device *rdev)
 int radeon_bo_init(struct radeon_device *rdev)
 {
+        /* reserve PAT memory space to WC for VRAM */
+        arch_io_reserve_memtype_wc(rdev->mc.aper_base,
+                                   rdev->mc.aper_size);
        /* Add an MTRR for the VRAM */
        if (!rdev->fastfb_working) {
                rdev->mc.vram_mtrr = arch_phys_wc_add(rdev->mc.aper_base,
@@ -463,6 +467,7 @@ void radeon_bo_fini(struct radeon_device *rdev)
 {
        radeon_ttm_fini(rdev);
        arch_phys_wc_del(rdev->mc.vram_mtrr);
+        arch_io_free_memtype_wc(rdev->mc.aper_base, rdev->mc.aper_size);
 }
 /* Returns how many bytes TTM can move per IB.
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 455268214b89..3de5e6e21662 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -566,7 +566,8 @@ static int radeon_ttm_tt_pin_userptr(struct ttm_tt *ttm)
                uint64_t userptr = gtt->userptr + pinned * PAGE_SIZE;
                struct page **pages = ttm->pages + pinned;
-                r = get_user_pages(userptr, num_pages, write, 0, pages, NULL);
+                r = get_user_pages(userptr, num_pages, write ? FOLL_WRITE : 0,
+                                   pages, NULL);
                if (r < 0)
                        goto release_pages;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 7ee9aafbdf74..e402be8821c4 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -4431,6 +4431,7 @@ static bool si_vm_reg_valid(u32 reg)
        case SPI_CONFIG_CNTL:
        case SPI_CONFIG_CNTL_1:
        case TA_CNTL_AUX:
+        case TA_CS_BC_BASE_ADDR:
                return true;
        default:
                DRM_ERROR("Invalid register 0x%x in CS\n", reg);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 89bdf20344ae..c49934527a87 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2999,6 +2999,49 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
        int i;
        struct si_dpm_quirk *p = si_dpm_quirk_list;
+        /* limit all SI kickers */
+        if (rdev->family == CHIP_PITCAIRN) {
+                if ((rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->device == 0x6810) ||
+                    (rdev->pdev->device == 0x6811) ||
+                    (rdev->pdev->device == 0x6816) ||
+                    (rdev->pdev->device == 0x6817) ||
+                    (rdev->pdev->device == 0x6806))
+                        max_mclk = 120000;
+        } else if (rdev->family == CHIP_VERDE) {
+                if ((rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->revision == 0x83) ||
+                    (rdev->pdev->revision == 0x87) ||
+                    (rdev->pdev->device == 0x6820) ||
+                    (rdev->pdev->device == 0x6821) ||
+                    (rdev->pdev->device == 0x6822) ||
+                    (rdev->pdev->device == 0x6823) ||
+                    (rdev->pdev->device == 0x682A) ||
+                    (rdev->pdev->device == 0x682B)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        } else if (rdev->family == CHIP_OLAND) {
+                if ((rdev->pdev->revision == 0xC7) ||
+                    (rdev->pdev->revision == 0x80) ||
+                    (rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->revision == 0x83) ||
+                    (rdev->pdev->device == 0x6604) ||
+                    (rdev->pdev->device == 0x6605)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        } else if (rdev->family == CHIP_HAINAN) {
+                if ((rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->revision == 0x83) ||
+                    (rdev->pdev->revision == 0xC3) ||
+                    (rdev->pdev->device == 0x6664) ||
+                    (rdev->pdev->device == 0x6665) ||
+                    (rdev->pdev->device == 0x6667)) {
+                        max_sclk = 75000;
+                        max_mclk = 80000;
+                }
+        }
        /* Apply dpm quirks */
        while (p && p->chip_device != 0) {
                if (rdev->pdev->vendor == p->chip_vendor &&
@@ -3011,16 +3054,6 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                }
                ++p;
        }
-        /* limit mclk on all R7 370 parts for stability */
-        if (rdev->pdev->device == 0x6811 &&
-            rdev->pdev->revision == 0x81)
-                max_mclk = 120000;
-        /* limit sclk/mclk on Jet parts for stability */
-        if (rdev->pdev->device == 0x6665 &&
-            rdev->pdev->revision == 0xc3) {
-                max_sclk = 75000;
-                max_mclk = 80000;
-        }
        if (rps->vce_active) {
                rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index eb220eecba78..65a911ddd509 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -1145,6 +1145,7 @@
 #define SPI_LB_CU_MASK                                  0x9354
 #define TA_CNTL_AUX                                     0x9508
+#define TA_CS_BC_BASE_ADDR                              0x950C
 #define CC_RB_BACKEND_DISABLE                           0x98F4
 #define         BACKEND_DISABLE(x)                      ((x) << 16)
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
index bd9c3bb9252c..392c7e6de042 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
@@ -231,8 +231,16 @@ static int rcar_du_atomic_check(struct drm_device *dev,
        struct rcar_du_device *rcdu = dev->dev_private;
        int ret;
-        ret = drm_atomic_helper_check(dev, state);
+        ret = drm_atomic_helper_check_modeset(dev, state);
-        if (ret < 0)
+        if (ret)
+                return ret;
+        ret = drm_atomic_normalize_zpos(dev, state);
+        if (ret)
+                return ret;
+        ret = drm_atomic_helper_check_planes(dev, state);
+        if (ret)
                return ret;
        if (rcar_du_has(rcdu, RCAR_DU_FEATURE_VSP1_SOURCE))
diff --git a/drivers/gpu/drm/sti/sti_drv.c b/drivers/gpu/drm/sti/sti_drv.c
index 2784919a7366..9df308565f6c 100644
--- a/drivers/gpu/drm/sti/sti_drv.c
+++ b/drivers/gpu/drm/sti/sti_drv.c
@@ -195,6 +195,26 @@ static void sti_atomic_work(struct work_struct *work)
        sti_atomic_complete(private, private->commit.state);
 }
+static int sti_atomic_check(struct drm_device *dev,
+                            struct drm_atomic_state *state)
+{
+        int ret;
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+        ret = drm_atomic_normalize_zpos(dev, state);
+        if (ret)
+                return ret;
+        ret = drm_atomic_helper_check_planes(dev, state);
+        if (ret)
+                return ret;
+        return ret;
+}
 static int sti_atomic_commit(struct drm_device *drm,
                             struct drm_atomic_state *state, bool nonblock)
 {
@@ -248,7 +268,7 @@ static void sti_output_poll_changed(struct drm_device *ddev)
 static const struct drm_mode_config_funcs sti_mode_config_funcs = {
        .fb_create = drm_fb_cma_create,
        .output_poll_changed = sti_output_poll_changed,
-        .atomic_check = drm_atomic_helper_check,
+        .atomic_check = sti_atomic_check,
        .atomic_commit = sti_atomic_commit,
 };
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index 0da9862ad8ed..70e9fd59c5a2 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -142,9 +142,9 @@ static int sun4i_drv_bind(struct device *dev)
        /* Create our layers */
        drv->layers = sun4i_layers_init(drm);
-        if (!drv->layers) {
+        if (IS_ERR(drv->layers)) {
                dev_err(drm->dev, "Couldn't create the planes\n");
-                ret = -EINVAL;
+                ret = PTR_ERR(drv->layers);
                goto free_drm;
        }
diff --git a/drivers/gpu/drm/sun4i/sun4i_rgb.c b/drivers/gpu/drm/sun4i/sun4i_rgb.c
index c3ff10f559cc..d198ad7e5323 100644
--- a/drivers/gpu/drm/sun4i/sun4i_rgb.c
+++ b/drivers/gpu/drm/sun4i/sun4i_rgb.c
@@ -152,15 +152,13 @@ static void sun4i_rgb_encoder_enable(struct drm_encoder *encoder)
        DRM_DEBUG_DRIVER("Enabling RGB output\n");
-        if (!IS_ERR(tcon->panel)) {
+        if (!IS_ERR(tcon->panel))
                drm_panel_prepare(tcon->panel);
-                drm_panel_enable(tcon->panel);
-        }
-        /* encoder->bridge can be NULL; drm_bridge_enable checks for it */
-        drm_bridge_enable(encoder->bridge);
        sun4i_tcon_channel_enable(tcon, 0);
+        if (!IS_ERR(tcon->panel))
+                drm_panel_enable(tcon->panel);
 }
 static void sun4i_rgb_encoder_disable(struct drm_encoder *encoder)
@@ -171,15 +169,13 @@ static void sun4i_rgb_encoder_disable(struct drm_encoder *encoder)
        DRM_DEBUG_DRIVER("Disabling RGB output\n");
-        sun4i_tcon_channel_disable(tcon, 0);
+        if (!IS_ERR(tcon->panel))
+                drm_panel_disable(tcon->panel);
-        /* encoder->bridge can be NULL; drm_bridge_disable checks for it */
+        sun4i_tcon_channel_disable(tcon, 0);
-        drm_bridge_disable(encoder->bridge);
-        if (!IS_ERR(tcon->panel)) {
+        if (!IS_ERR(tcon->panel))
-                drm_panel_disable(tcon->panel);
                drm_panel_unprepare(tcon->panel);
-        }
 }
 static void sun4i_rgb_encoder_mode_set(struct drm_encoder *encoder,
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 29f0207fa677..873f010d9616 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -98,17 +98,23 @@ success:
 static int udl_select_std_channel(struct udl_device *udl)
 {
        int ret;
-        u8 set_def_chn[] = {0x57, 0xCD, 0xDC, 0xA7,
+        static const u8 set_def_chn[] = {0x57, 0xCD, 0xDC, 0xA7,
-                            0x1C, 0x88, 0x5E, 0x15,
+                                         0x1C, 0x88, 0x5E, 0x15,
-                            0x60, 0xFE, 0xC6, 0x97,
+                                         0x60, 0xFE, 0xC6, 0x97,
-                            0x16, 0x3D, 0x47, 0xF2};
+                                         0x16, 0x3D, 0x47, 0xF2};
+        void *sendbuf;
+        sendbuf = kmemdup(set_def_chn, sizeof(set_def_chn), GFP_KERNEL);
+        if (!sendbuf)
+                return -ENOMEM;
        ret = usb_control_msg(udl->udev,
                              usb_sndctrlpipe(udl->udev, 0),
                              NR_USB_REQUEST_CHANNEL,
                              (USB_DIR_OUT | USB_TYPE_VENDOR), 0, 0,
-                              set_def_chn, sizeof(set_def_chn),
+                              sendbuf, sizeof(set_def_chn),
                              USB_CTRL_SET_TIMEOUT);
+        kfree(sendbuf);
        return ret < 0 ? ret : 0;
 }
diff --git a/drivers/gpu/drm/via/via_dmablit.c b/drivers/gpu/drm/via/via_dmablit.c
index 7e2a12c4fed2..1a3ad769f8c8 100644
--- a/drivers/gpu/drm/via/via_dmablit.c
+++ b/drivers/gpu/drm/via/via_dmablit.c
@@ -241,8 +241,8 @@ via_lock_all_dma_pages(drm_via_sg_info_t *vsg,  drm_via_dmablit_t *xfer)
        down_read(&current->mm->mmap_sem);
        ret = get_user_pages((unsigned long)xfer->mem_addr,
                             vsg->num_pages,
-                             (vsg->direction == DMA_FROM_DEVICE),
+                             (vsg->direction == DMA_FROM_DEVICE) ? FOLL_WRITE : 0,
-                             0, vsg->pages, NULL);
+                             vsg->pages, NULL);
        up_read(&current->mm->mmap_sem);
        if (ret != vsg->num_pages) {
diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c
index 7cf3678623c3..58048709c34e 100644
--- a/drivers/gpu/drm/virtio/virtgpu_display.c
+++ b/drivers/gpu/drm/virtio/virtgpu_display.c
@@ -338,8 +338,7 @@ static void vgdev_atomic_commit_tail(struct drm_atomic_state *state)
        drm_atomic_helper_commit_modeset_disables(dev, state);
        drm_atomic_helper_commit_modeset_enables(dev, state);
-        drm_atomic_helper_commit_planes(dev, state,
+        drm_atomic_helper_commit_planes(dev, state, 0);
-                                        DRM_PLANE_COMMIT_ACTIVE_ONLY);
        drm_atomic_helper_commit_hw_done(state);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index e8ae3dc476d1..18061a4bc2f2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -241,15 +241,15 @@ static int vmwgfx_pm_notifier(struct notifier_block *nb, unsigned long val,
                              void *ptr);
 MODULE_PARM_DESC(enable_fbdev, "Enable vmwgfx fbdev");
-module_param_named(enable_fbdev, enable_fbdev, int, 0600);
+module_param_named(enable_fbdev, enable_fbdev, int, S_IRUSR | S_IWUSR);
 MODULE_PARM_DESC(force_dma_api, "Force using the DMA API for TTM pages");
-module_param_named(force_dma_api, vmw_force_iommu, int, 0600);
+module_param_named(force_dma_api, vmw_force_iommu, int, S_IRUSR | S_IWUSR);
 MODULE_PARM_DESC(restrict_iommu, "Try to limit IOMMU usage for TTM pages");
-module_param_named(restrict_iommu, vmw_restrict_iommu, int, 0600);
+module_param_named(restrict_iommu, vmw_restrict_iommu, int, S_IRUSR | S_IWUSR);
 MODULE_PARM_DESC(force_coherent, "Force coherent TTM pages");
-module_param_named(force_coherent, vmw_force_coherent, int, 0600);
+module_param_named(force_coherent, vmw_force_coherent, int, S_IRUSR | S_IWUSR);
 MODULE_PARM_DESC(restrict_dma_mask, "Restrict DMA mask to 44 bits with IOMMU");
-module_param_named(restrict_dma_mask, vmw_restrict_dma_mask, int, 0600);
+module_param_named(restrict_dma_mask, vmw_restrict_dma_mask, int, S_IRUSR | S_IWUSR);
 MODULE_PARM_DESC(assume_16bpp, "Assume 16-bpp when filtering modes");
 module_param_named(assume_16bpp, vmw_assume_16bpp, int, 0600);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 070d750af16d..1e59a486bba8 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -43,7 +43,7 @@
 #define VMWGFX_DRIVER_DATE "20160210"
 #define VMWGFX_DRIVER_MAJOR 2
-#define VMWGFX_DRIVER_MINOR 10
+#define VMWGFX_DRIVER_MINOR 11
 #define VMWGFX_DRIVER_PATCHLEVEL 0
 #define VMWGFX_FILE_PAGE_OFFSET 0x00100000
 #define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index dc5beff2b4aa..c7b53d987f06 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -35,17 +35,37 @@
 #define VMW_RES_HT_ORDER 12
 /**
+ * enum vmw_resource_relocation_type - Relocation type for resources
+ *
+ * @vmw_res_rel_normal: Traditional relocation. The resource id in the
+ * command stream is replaced with the actual id after validation.
+ * @vmw_res_rel_nop: NOP relocation. The command is unconditionally replaced
+ * with a NOP.
+ * @vmw_res_rel_cond_nop: Conditional NOP relocation. If the resource id
+ * after validation is -1, the command is replaced with a NOP. Otherwise no
+ * action.
+ */
+enum vmw_resource_relocation_type {
+        vmw_res_rel_normal,
+        vmw_res_rel_nop,
+        vmw_res_rel_cond_nop,
+        vmw_res_rel_max
+};
+/**
 * struct vmw_resource_relocation - Relocation info for resources
 *
 * @head: List head for the software context's relocation list.
 * @res: Non-ref-counted pointer to the resource.
- * @offset: Offset of 4 byte entries into the command buffer where the
+ * @offset: Offset of single byte entries into the command buffer where the
 * id that needs fixup is located.
+ * @rel_type: Type of relocation.
 */
 struct vmw_resource_relocation {
        struct list_head head;
        const struct vmw_resource *res;
-        unsigned long offset;
+        u32 offset:29;
+        enum vmw_resource_relocation_type rel_type:3;
 };
 /**
@@ -109,7 +129,18 @@ static int vmw_bo_to_validate_list(struct vmw_sw_context *sw_context,
                                   struct vmw_dma_buffer *vbo,
                                   bool validate_as_mob,
                                   uint32_t *p_val_node);
+/**
+ * vmw_ptr_diff - Compute the offset from a to b in bytes
+ *
+ * @a: A starting pointer.
+ * @b: A pointer offset in the same address space.
+ *
+ * Returns: The offset in bytes between the two pointers.
+ */
+static size_t vmw_ptr_diff(void *a, void *b)
+{
+        return (unsigned long) b - (unsigned long) a;
+}
 /**
 * vmw_resources_unreserve - unreserve resources previously reserved for
@@ -409,11 +440,14 @@ static int vmw_resource_context_res_add(struct vmw_private *dev_priv,
 * @list: Pointer to head of relocation list.
 * @res: The resource.
 * @offset: Offset into the command buffer currently being parsed where the
- * id that needs fixup is located. Granularity is 4 bytes.
+ * id that needs fixup is located. Granularity is one byte.
+ * @rel_type: Relocation type.
 */
 static int vmw_resource_relocation_add(struct list_head *list,
                                       const struct vmw_resource *res,
-                                       unsigned long offset)
+                                       unsigned long offset,
+                                       enum vmw_resource_relocation_type
+                                       rel_type)
 {
        struct vmw_resource_relocation *rel;
@@ -425,6 +459,7 @@ static int vmw_resource_relocation_add(struct list_head *list,
        rel->res = res;
        rel->offset = offset;
+        rel->rel_type = rel_type;
        list_add_tail(&rel->head, list);
        return 0;
@@ -459,11 +494,24 @@ static void vmw_resource_relocations_apply(uint32_t *cb,
 {
        struct vmw_resource_relocation *rel;
+        /* Validate the struct vmw_resource_relocation member size */
+        BUILD_BUG_ON(SVGA_CB_MAX_SIZE >= (1 << 29));
+        BUILD_BUG_ON(vmw_res_rel_max >= (1 << 3));
        list_for_each_entry(rel, list, head) {
-                if (likely(rel->res != NULL))
+                u32 *addr = (u32 *)((unsigned long) cb + rel->offset);
-                        cb[rel->offset] = rel->res->id;
+                switch (rel->rel_type) {
-                else
+                case vmw_res_rel_normal:
-                        cb[rel->offset] = SVGA_3D_CMD_NOP;
+                        *addr = rel->res->id;
+                        break;
+                case vmw_res_rel_nop:
+                        *addr = SVGA_3D_CMD_NOP;
+                        break;
+                default:
+                        if (rel->res->id == -1)
+                                *addr = SVGA_3D_CMD_NOP;
+                        break;
+                }
        }
 }
@@ -655,7 +703,9 @@ static int vmw_cmd_res_reloc_add(struct vmw_private *dev_priv,
        *p_val = NULL;
        ret = vmw_resource_relocation_add(&sw_context->res_relocations,
                                          res,
-                                          id_loc - sw_context->buf_start);
+                                          vmw_ptr_diff(sw_context->buf_start,
+                                                       id_loc),
+                                          vmw_res_rel_normal);
        if (unlikely(ret != 0))
                return ret;
@@ -721,7 +771,8 @@ vmw_cmd_res_check(struct vmw_private *dev_priv,
                return vmw_resource_relocation_add
                        (&sw_context->res_relocations, res,
-                         id_loc - sw_context->buf_start);
+                         vmw_ptr_diff(sw_context->buf_start, id_loc),
+                         vmw_res_rel_normal);
        }
        ret = vmw_user_resource_lookup_handle(dev_priv,
@@ -2143,10 +2194,10 @@ static int vmw_cmd_shader_define(struct vmw_private *dev_priv,
                return ret;
        return vmw_resource_relocation_add(&sw_context->res_relocations,
-                                           NULL, &cmd->header.id -
+                                           NULL,
-                                           sw_context->buf_start);
+                                           vmw_ptr_diff(sw_context->buf_start,
+                                                        &cmd->header.id),
-        return 0;
+                                           vmw_res_rel_nop);
 }
 /**
@@ -2188,10 +2239,10 @@ static int vmw_cmd_shader_destroy(struct vmw_private *dev_priv,
                return ret;
        return vmw_resource_relocation_add(&sw_context->res_relocations,
-                                           NULL, &cmd->header.id -
+                                           NULL,
-                                           sw_context->buf_start);
+                                           vmw_ptr_diff(sw_context->buf_start,
+                                                        &cmd->header.id),
-        return 0;
+                                           vmw_res_rel_nop);
 }
 /**
@@ -2848,8 +2899,7 @@ static int vmw_cmd_dx_cid_check(struct vmw_private *dev_priv,
 * @header: Pointer to the command header in the command stream.
 *
 * Check that the view exists, and if it was not created using this
- * command batch, make sure it's validated (present in the device) so that
+ * command batch, conditionally make this command a NOP.
- * the remove command will not confuse the device.
 */
 static int vmw_cmd_dx_view_remove(struct vmw_private *dev_priv,
                                  struct vmw_sw_context *sw_context,
@@ -2877,10 +2927,16 @@ static int vmw_cmd_dx_view_remove(struct vmw_private *dev_priv,
                return ret;
        /*
-         * Add view to the validate list iff it was not created using this
+         * If the view wasn't created during this command batch, it might
-         * command batch.
+         * have been removed due to a context swapout, so add a
+         * relocation to conditionally make this command a NOP to avoid
+         * device errors.
         */
-        return vmw_view_res_val_add(sw_context, view);
+        return vmw_resource_relocation_add(&sw_context->res_relocations,
+                                           view,
+                                           vmw_ptr_diff(sw_context->buf_start,
+                                                        &cmd->header.id),
+                                           vmw_res_rel_cond_nop);
 }
 /**
@@ -3029,6 +3085,35 @@ static int vmw_cmd_dx_genmips(struct vmw_private *dev_priv,
                                   cmd->body.shaderResourceViewId);
 }
+/**
+ * vmw_cmd_dx_transfer_from_buffer -
+ * Validate an SVGA_3D_CMD_DX_TRANSFER_FROM_BUFFER command
+ *
+ * @dev_priv: Pointer to a device private struct.
+ * @sw_context: The software context being used for this batch.
+ * @header: Pointer to the command header in the command stream.
+ */
+static int vmw_cmd_dx_transfer_from_buffer(struct vmw_private *dev_priv,
+                                           struct vmw_sw_context *sw_context,
+                                           SVGA3dCmdHeader *header)
+{
+        struct {
+                SVGA3dCmdHeader header;
+                SVGA3dCmdDXTransferFromBuffer body;
+        } *cmd = container_of(header, typeof(*cmd), header);
+        int ret;
+        ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
+                                user_surface_converter,
+                                &cmd->body.srcSid, NULL);
+        if (ret != 0)
+                return ret;
+        return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
+                                 user_surface_converter,
+                                 &cmd->body.destSid, NULL);
+}
 static int vmw_cmd_check_not_3d(struct vmw_private *dev_priv,
                                struct vmw_sw_context *sw_context,
                                void *buf, uint32_t *size)
@@ -3379,6 +3464,9 @@ static const struct vmw_cmd_entry vmw_cmd_entries[SVGA_3D_CMD_MAX] = {
                    &vmw_cmd_buffer_copy_check, true, false, true),
        VMW_CMD_DEF(SVGA_3D_CMD_DX_PRED_COPY_REGION,
                    &vmw_cmd_pred_copy_check, true, false, true),
+        VMW_CMD_DEF(SVGA_3D_CMD_DX_TRANSFER_FROM_BUFFER,
+                    &vmw_cmd_dx_transfer_from_buffer,
+                    true, false, true),
 };
 static int vmw_cmd_check(struct vmw_private *dev_priv,
@@ -3848,14 +3936,14 @@ static void *vmw_execbuf_cmdbuf(struct vmw_private *dev_priv,
        int ret;
        *header = NULL;
-        if (!dev_priv->cman || kernel_commands)
-                return kernel_commands;
        if (command_size > SVGA_CB_MAX_SIZE) {
                DRM_ERROR("Command buffer is too large.\n");
                return ERR_PTR(-EINVAL);
        }
+        if (!dev_priv->cman || kernel_commands)
+                return kernel_commands;
        /* If possible, add a little space for fencing. */
        cmdbuf_size = command_size + 512;
        cmdbuf_size = min_t(size_t, cmdbuf_size, SVGA_CB_MAX_SIZE);
@@ -4232,9 +4320,6 @@ void __vmw_execbuf_release_pinned_bo(struct vmw_private *dev_priv,
        ttm_bo_unref(&query_val.bo);
        ttm_bo_unref(&pinned_val.bo);
        vmw_dmabuf_unreference(&dev_priv->pinned_bo);
-        DRM_INFO("Dummy query bo pin count: %d\n",
-                 dev_priv->dummy_query_bo->pin_count);
 out_unlock:
        return;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 6a328d507a28..52ca1c9d070e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -574,10 +574,8 @@ static int vmw_user_dmabuf_synccpu_grab(struct vmw_user_dma_buffer *user_bo,
                bool nonblock = !!(flags & drm_vmw_synccpu_dontblock);
                long lret;
-                if (nonblock)
+                lret = reservation_object_wait_timeout_rcu(bo->resv, true, true,
-                        return reservation_object_test_signaled_rcu(bo->resv, true) ? 0 : -EBUSY;
+                                        nonblock ? 0 : MAX_SCHEDULE_TIMEOUT);
-                lret = reservation_object_wait_timeout_rcu(bo->resv, true, true, MAX_SCHEDULE_TIMEOUT);
                if (!lret)
                        return -EBUSY;
                else if (lret < 0)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index c2a721a8cef9..b445ce9b9757 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -324,7 +324,7 @@ static void vmw_hw_surface_destroy(struct vmw_resource *res)
        if (res->id != -1) {
                cmd = vmw_fifo_reserve(dev_priv, vmw_surface_destroy_size());
-                if (unlikely(cmd == NULL)) {
+                if (unlikely(!cmd)) {
                        DRM_ERROR("Failed reserving FIFO space for surface "
                                  "destruction.\n");
                        return;
@@ -397,7 +397,7 @@ static int vmw_legacy_srf_create(struct vmw_resource *res)
        submit_size = vmw_surface_define_size(srf);
        cmd = vmw_fifo_reserve(dev_priv, submit_size);
-        if (unlikely(cmd == NULL)) {
+        if (unlikely(!cmd)) {
                DRM_ERROR("Failed reserving FIFO space for surface "
                          "creation.\n");
                ret = -ENOMEM;
@@ -446,11 +446,10 @@ static int vmw_legacy_srf_dma(struct vmw_resource *res,
        uint8_t *cmd;
        struct vmw_private *dev_priv = res->dev_priv;
-        BUG_ON(val_buf->bo == NULL);
+        BUG_ON(!val_buf->bo);
        submit_size = vmw_surface_dma_size(srf);
        cmd = vmw_fifo_reserve(dev_priv, submit_size);
-        if (unlikely(cmd == NULL)) {
+        if (unlikely(!cmd)) {
                DRM_ERROR("Failed reserving FIFO space for surface "
                          "DMA.\n");
                return -ENOMEM;
@@ -538,7 +537,7 @@ static int vmw_legacy_srf_destroy(struct vmw_resource *res)
        submit_size = vmw_surface_destroy_size();
        cmd = vmw_fifo_reserve(dev_priv, submit_size);
-        if (unlikely(cmd == NULL)) {
+        if (unlikely(!cmd)) {
                DRM_ERROR("Failed reserving FIFO space for surface "
                          "eviction.\n");
                return -ENOMEM;
@@ -578,7 +577,7 @@ static int vmw_surface_init(struct vmw_private *dev_priv,
        int ret;
        struct vmw_resource *res = &srf->res;
-        BUG_ON(res_free == NULL);
+        BUG_ON(!res_free);
        if (!dev_priv->has_mob)
                vmw_fifo_resource_inc(dev_priv);
        ret = vmw_resource_init(dev_priv, res, true, res_free,
@@ -700,7 +699,6 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
        struct drm_vmw_surface_create_req *req = &arg->req;
        struct drm_vmw_surface_arg *rep = &arg->rep;
        struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
-        struct drm_vmw_size __user *user_sizes;
        int ret;
        int i, j;
        uint32_t cur_bo_offset;
@@ -748,7 +746,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
        }
        user_srf = kzalloc(sizeof(*user_srf), GFP_KERNEL);
-        if (unlikely(user_srf == NULL)) {
+        if (unlikely(!user_srf)) {
                ret = -ENOMEM;
                goto out_no_user_srf;
        }
@@ -763,29 +761,21 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
        memcpy(srf->mip_levels, req->mip_levels, sizeof(srf->mip_levels));
        srf->num_sizes = num_sizes;
        user_srf->size = size;
+        srf->sizes = memdup_user((struct drm_vmw_size __user *)(unsigned long)
-        srf->sizes = kmalloc(srf->num_sizes * sizeof(*srf->sizes), GFP_KERNEL);
+                                 req->size_addr,
-        if (unlikely(srf->sizes == NULL)) {
+                                 sizeof(*srf->sizes) * srf->num_sizes);
-                ret = -ENOMEM;
+        if (IS_ERR(srf->sizes)) {
+                ret = PTR_ERR(srf->sizes);
                goto out_no_sizes;
        }
-        srf->offsets = kmalloc(srf->num_sizes * sizeof(*srf->offsets),
+        srf->offsets = kmalloc_array(srf->num_sizes,
-                               GFP_KERNEL);
+                                     sizeof(*srf->offsets),
-        if (unlikely(srf->offsets == NULL)) {
+                                     GFP_KERNEL);
+        if (unlikely(!srf->offsets)) {
                ret = -ENOMEM;
                goto out_no_offsets;
        }
-        user_sizes = (struct drm_vmw_size __user *)(unsigned long)
-            req->size_addr;
-        ret = copy_from_user(srf->sizes, user_sizes,
-                             srf->num_sizes * sizeof(*srf->sizes));
-        if (unlikely(ret != 0)) {
-                ret = -EFAULT;
-                goto out_no_copy;
-        }
        srf->base_size = *srf->sizes;
        srf->autogen_filter = SVGA3D_TEX_FILTER_NONE;
        srf->multisample_count = 0;
@@ -923,7 +913,7 @@ vmw_surface_handle_reference(struct vmw_private *dev_priv,
        ret = -EINVAL;
        base = ttm_base_object_lookup_for_ref(dev_priv->tdev, handle);
-        if (unlikely(base == NULL)) {
+        if (unlikely(!base)) {
                DRM_ERROR("Could not find surface to reference.\n");
                goto out_no_lookup;
        }
@@ -1069,7 +1059,7 @@ static int vmw_gb_surface_create(struct vmw_resource *res)
        cmd = vmw_fifo_reserve(dev_priv, submit_len);
        cmd2 = (typeof(cmd2))cmd;
-        if (unlikely(cmd == NULL)) {
+        if (unlikely(!cmd)) {
                DRM_ERROR("Failed reserving FIFO space for surface "
                          "creation.\n");
                ret = -ENOMEM;
@@ -1135,7 +1125,7 @@ static int vmw_gb_surface_bind(struct vmw_resource *res,
        submit_size = sizeof(*cmd1) + (res->backup_dirty ? sizeof(*cmd2) : 0);
        cmd1 = vmw_fifo_reserve(dev_priv, submit_size);
-        if (unlikely(cmd1 == NULL)) {
+        if (unlikely(!cmd1)) {
                DRM_ERROR("Failed reserving FIFO space for surface "
                          "binding.\n");
                return -ENOMEM;
@@ -1185,7 +1175,7 @@ static int vmw_gb_surface_unbind(struct vmw_resource *res,
        submit_size = sizeof(*cmd3) + (readback ? sizeof(*cmd1) : sizeof(*cmd2));
        cmd = vmw_fifo_reserve(dev_priv, submit_size);
-        if (unlikely(cmd == NULL)) {
+        if (unlikely(!cmd)) {
                DRM_ERROR("Failed reserving FIFO space for surface "
                          "unbinding.\n");
                return -ENOMEM;
@@ -1244,7 +1234,7 @@ static int vmw_gb_surface_destroy(struct vmw_resource *res)
        vmw_binding_res_list_scrub(&res->binding_head);
        cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
-        if (unlikely(cmd == NULL)) {
+        if (unlikely(!cmd)) {
                DRM_ERROR("Failed reserving FIFO space for surface "
                          "destruction.\n");
                mutex_unlock(&dev_priv->binding_mutex);
@@ -1410,7 +1400,7 @@ int vmw_gb_surface_reference_ioctl(struct drm_device *dev, void *data,
        user_srf = container_of(base, struct vmw_user_surface, prime.base);
        srf = &user_srf->srf;
-        if (srf->res.backup == NULL) {
+        if (!srf->res.backup) {
                DRM_ERROR("Shared GB surface is missing a backup buffer.\n");
                goto out_bad_resource;
        }
@@ -1524,7 +1514,7 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
        }
        user_srf = kzalloc(sizeof(*user_srf), GFP_KERNEL);
-        if (unlikely(user_srf == NULL)) {
+        if (unlikely(!user_srf)) {
                ret = -ENOMEM;
                goto out_no_user_srf;
        }
diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c
index 2ba7d437a2af..805b6fa7b5f4 100644
--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
+++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
@@ -1617,7 +1617,7 @@ ipu_image_convert(struct ipu_soc *ipu, enum ipu_ic_task ic_task,
        ctx = ipu_image_convert_prepare(ipu, ic_task, in, out, rot_mode,
                                        complete, complete_context);
        if (IS_ERR(ctx))
-                return ERR_PTR(PTR_ERR(ctx));
+                return ERR_CAST(ctx);
        run = kzalloc(sizeof(*run), GFP_KERNEL);
        if (!run) {
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index 086d8a507157..60d30203a5fa 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -32,6 +32,11 @@
 #include <linux/usb/ch9.h>
 #include "hid-ids.h"
+#define CP2112_REPORT_MAX_LENGTH                64
+#define CP2112_GPIO_CONFIG_LENGTH               5
+#define CP2112_GPIO_GET_LENGTH                  2
+#define CP2112_GPIO_SET_LENGTH                  3
 enum {
        CP2112_GPIO_CONFIG              = 0x02,
        CP2112_GPIO_GET                 = 0x03,
@@ -161,6 +166,8 @@ struct cp2112_device {
        atomic_t read_avail;
        atomic_t xfer_avail;
        struct gpio_chip gc;
+        u8 *in_out_buffer;
+        spinlock_t lock;
 };
 static int gpio_push_pull = 0xFF;
@@ -171,62 +178,86 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 {
        struct cp2112_device *dev = gpiochip_get_data(chip);
        struct hid_device *hdev = dev->hdev;
-        u8 buf[5];
+        u8 *buf = dev->in_out_buffer;
+        unsigned long flags;
        int ret;
+        spin_lock_irqsave(&dev->lock, flags);
        ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
-                                       sizeof(buf), HID_FEATURE_REPORT,
+                                 CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
-                                       HID_REQ_GET_REPORT);
+                                 HID_REQ_GET_REPORT);
-        if (ret != sizeof(buf)) {
+        if (ret != CP2112_GPIO_CONFIG_LENGTH) {
                hid_err(hdev, "error requesting GPIO config: %d\n", ret);
-                return ret;
+                goto exit;
        }
        buf[1] &= ~(1 << offset);
        buf[2] = gpio_push_pull;
-        ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf, sizeof(buf),
+        ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
-                                 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+                                 CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
+                                 HID_REQ_SET_REPORT);
        if (ret < 0) {
                hid_err(hdev, "error setting GPIO config: %d\n", ret);
-                return ret;
+                goto exit;
        }
-        return 0;
+        ret = 0;
+exit:
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return ret <= 0 ? ret : -EIO;
 }
 static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
 {
        struct cp2112_device *dev = gpiochip_get_data(chip);
        struct hid_device *hdev = dev->hdev;
-        u8 buf[3];
+        u8 *buf = dev->in_out_buffer;
+        unsigned long flags;
        int ret;
+        spin_lock_irqsave(&dev->lock, flags);
        buf[0] = CP2112_GPIO_SET;
        buf[1] = value ? 0xff : 0;
        buf[2] = 1 << offset;
-        ret = hid_hw_raw_request(hdev, CP2112_GPIO_SET, buf, sizeof(buf),
+        ret = hid_hw_raw_request(hdev, CP2112_GPIO_SET, buf,
-                                 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+                                 CP2112_GPIO_SET_LENGTH, HID_FEATURE_REPORT,
+                                 HID_REQ_SET_REPORT);
        if (ret < 0)
                hid_err(hdev, "error setting GPIO values: %d\n", ret);
+        spin_unlock_irqrestore(&dev->lock, flags);
 }
 static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
        struct cp2112_device *dev = gpiochip_get_data(chip);
        struct hid_device *hdev = dev->hdev;
-        u8 buf[2];
+        u8 *buf = dev->in_out_buffer;
+        unsigned long flags;
        int ret;
-        ret = hid_hw_raw_request(hdev, CP2112_GPIO_GET, buf, sizeof(buf),
+        spin_lock_irqsave(&dev->lock, flags);
-                                       HID_FEATURE_REPORT, HID_REQ_GET_REPORT);
-        if (ret != sizeof(buf)) {
+        ret = hid_hw_raw_request(hdev, CP2112_GPIO_GET, buf,
+                                 CP2112_GPIO_GET_LENGTH, HID_FEATURE_REPORT,
+                                 HID_REQ_GET_REPORT);
+        if (ret != CP2112_GPIO_GET_LENGTH) {
                hid_err(hdev, "error requesting GPIO values: %d\n", ret);
-                return ret;
+                ret = ret < 0 ? ret : -EIO;
+                goto exit;
        }
-        return (buf[1] >> offset) & 1;
+        ret = (buf[1] >> offset) & 1;
+exit:
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return ret;
 }
 static int cp2112_gpio_direction_output(struct gpio_chip *chip,
@@ -234,27 +265,33 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
 {
        struct cp2112_device *dev = gpiochip_get_data(chip);
        struct hid_device *hdev = dev->hdev;
-        u8 buf[5];
+        u8 *buf = dev->in_out_buffer;
+        unsigned long flags;
        int ret;
+        spin_lock_irqsave(&dev->lock, flags);
        ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
-                                       sizeof(buf), HID_FEATURE_REPORT,
+                                 CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
-                                       HID_REQ_GET_REPORT);
+                                 HID_REQ_GET_REPORT);
-        if (ret != sizeof(buf)) {
+        if (ret != CP2112_GPIO_CONFIG_LENGTH) {
                hid_err(hdev, "error requesting GPIO config: %d\n", ret);
-                return ret;
+                goto fail;
        }
        buf[1] |= 1 << offset;
        buf[2] = gpio_push_pull;
-        ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf, sizeof(buf),
+        ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
-                                 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+                                 CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
+                                 HID_REQ_SET_REPORT);
        if (ret < 0) {
                hid_err(hdev, "error setting GPIO config: %d\n", ret);
-                return ret;
+                goto fail;
        }
+        spin_unlock_irqrestore(&dev->lock, flags);
        /*
         * Set gpio value when output direction is already set,
         * as specified in AN495, Rev. 0.2, cpt. 4.4
@@ -262,6 +299,10 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
        cp2112_gpio_set(chip, offset, value);
        return 0;
+fail:
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return ret < 0 ? ret : -EIO;
 }
 static int cp2112_hid_get(struct hid_device *hdev, unsigned char report_number,
@@ -1007,6 +1048,17 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
        struct cp2112_smbus_config_report config;
        int ret;
+        dev = devm_kzalloc(&hdev->dev, sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+        dev->in_out_buffer = devm_kzalloc(&hdev->dev, CP2112_REPORT_MAX_LENGTH,
+                                          GFP_KERNEL);
+        if (!dev->in_out_buffer)
+                return -ENOMEM;
+        spin_lock_init(&dev->lock);
        ret = hid_parse(hdev);
        if (ret) {
                hid_err(hdev, "parse failed\n");
@@ -1063,12 +1115,6 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
                goto err_power_normal;
        }
-        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
-        if (!dev) {
-                ret = -ENOMEM;
-                goto err_power_normal;
-        }
        hid_set_drvdata(hdev, (void *)dev);
        dev->hdev               = hdev;
        dev->adap.owner         = THIS_MODULE;
@@ -1087,7 +1133,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
        if (ret) {
                hid_err(hdev, "error registering i2c adapter\n");
-                goto err_free_dev;
+                goto err_power_normal;
        }
        hid_dbg(hdev, "adapter registered\n");
@@ -1123,8 +1169,6 @@ err_gpiochip_remove:
        gpiochip_remove(&dev->gc);
 err_free_i2c:
        i2c_del_adapter(&dev->adap);
-err_free_dev:
-        kfree(dev);
 err_power_normal:
        hid_hw_power(hdev, PM_HINT_NORMAL);
 err_hid_close:
@@ -1149,7 +1193,6 @@ static void cp2112_remove(struct hid_device *hdev)
         */
        hid_hw_close(hdev);
        hid_hw_stop(hdev);
-        kfree(dev);
 }
 static int cp2112_raw_event(struct hid_device *hdev, struct hid_report *report,
diff --git a/drivers/hid/hid-dr.c b/drivers/hid/hid-dr.c
index 8fd4bf77f264..818ea7d93533 100644
--- a/drivers/hid/hid-dr.c
+++ b/drivers/hid/hid-dr.c
@@ -234,58 +234,6 @@ static __u8 pid0011_rdesc_fixed[] = {
        0xC0                /*  End Collection                  */
 };
-static __u8 pid0006_rdesc_fixed[] = {
-        0x05, 0x01,        /* Usage Page (Generic Desktop)      */
-        0x09, 0x04,        /* Usage (Joystick)                  */
-        0xA1, 0x01,        /* Collection (Application)          */
-        0xA1, 0x02,        /*   Collection (Logical)            */
-        0x75, 0x08,        /*     Report Size (8)               */
-        0x95, 0x05,        /*     Report Count (5)              */
-        0x15, 0x00,        /*     Logical Minimum (0)           */
-        0x26, 0xFF, 0x00,  /*     Logical Maximum (255)         */
-        0x35, 0x00,        /*     Physical Minimum (0)          */
-        0x46, 0xFF, 0x00,  /*     Physical Maximum (255)        */
-        0x09, 0x30,        /*     Usage (X)                     */
-        0x09, 0x33,        /*     Usage (Ry)                    */
-        0x09, 0x32,        /*     Usage (Z)                     */
-        0x09, 0x31,        /*     Usage (Y)                     */
-        0x09, 0x34,        /*     Usage (Ry)                    */
-        0x81, 0x02,        /*     Input (Variable)              */
-        0x75, 0x04,        /*     Report Size (4)               */
-        0x95, 0x01,        /*     Report Count (1)              */
-        0x25, 0x07,        /*     Logical Maximum (7)           */
-        0x46, 0x3B, 0x01,  /*     Physical Maximum (315)        */
-        0x65, 0x14,        /*     Unit (Centimeter)             */
-        0x09, 0x39,        /*     Usage (Hat switch)            */
-        0x81, 0x42,        /*     Input (Variable)              */
-        0x65, 0x00,        /*     Unit (None)                   */
-        0x75, 0x01,        /*     Report Size (1)               */
-        0x95, 0x0C,        /*     Report Count (12)             */
-        0x25, 0x01,        /*     Logical Maximum (1)           */
-        0x45, 0x01,        /*     Physical Maximum (1)          */
-        0x05, 0x09,        /*     Usage Page (Button)           */
-        0x19, 0x01,        /*     Usage Minimum (0x01)          */
-        0x29, 0x0C,        /*     Usage Maximum (0x0C)          */
-        0x81, 0x02,        /*     Input (Variable)              */
-        0x06, 0x00, 0xFF,  /*     Usage Page (Vendor Defined)   */
-        0x75, 0x01,        /*     Report Size (1)               */
-        0x95, 0x08,        /*     Report Count (8)              */
-        0x25, 0x01,        /*     Logical Maximum (1)           */
-        0x45, 0x01,        /*     Physical Maximum (1)          */
-        0x09, 0x01,        /*     Usage (0x01)                  */
-        0x81, 0x02,        /*     Input (Variable)              */
-        0xC0,              /*   End Collection                  */
-        0xA1, 0x02,        /*   Collection (Logical)            */
-        0x75, 0x08,        /*     Report Size (8)               */
-        0x95, 0x07,        /*     Report Count (7)              */
-        0x46, 0xFF, 0x00,  /*     Physical Maximum (255)        */
-        0x26, 0xFF, 0x00,  /*     Logical Maximum (255)         */
-        0x09, 0x02,        /*     Usage (0x02)                  */
-        0x91, 0x02,        /*     Output (Variable)             */
-        0xC0,              /*   End Collection                  */
-        0xC0               /* End Collection                    */
-};
 static __u8 *dr_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                                unsigned int *rsize)
 {
@@ -296,16 +244,34 @@ static __u8 *dr_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                        *rsize = sizeof(pid0011_rdesc_fixed);
                }
                break;
-        case 0x0006:
-                if (*rsize == sizeof(pid0006_rdesc_fixed)) {
-                        rdesc = pid0006_rdesc_fixed;
-                        *rsize = sizeof(pid0006_rdesc_fixed);
-                }
-                break;
        }
        return rdesc;
 }
+#define map_abs(c)      hid_map_usage(hi, usage, bit, max, EV_ABS, (c))
+#define map_rel(c)      hid_map_usage(hi, usage, bit, max, EV_REL, (c))
+static int dr_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+                            struct hid_field *field, struct hid_usage *usage,
+                            unsigned long **bit, int *max)
+{
+        switch (usage->hid) {
+        /*
+         * revert to the old hid-input behavior where axes
+         * can be randomly assigned when hid->usage is reused.
+         */
+        case HID_GD_X: case HID_GD_Y: case HID_GD_Z:
+        case HID_GD_RX: case HID_GD_RY: case HID_GD_RZ:
+                if (field->flags & HID_MAIN_ITEM_RELATIVE)
+                        map_rel(usage->hid & 0xf);
+                else
+                        map_abs(usage->hid & 0xf);
+                return 1;
+        }
+        return 0;
+}
 static int dr_probe(struct hid_device *hdev, const struct hid_device_id *id)
 {
        int ret;
@@ -352,6 +318,7 @@ static struct hid_driver dr_driver = {
        .id_table = dr_devices,
        .report_fixup = dr_report_fixup,
        .probe = dr_probe,
+        .input_mapping = dr_input_mapping,
 };
 module_hid_driver(dr_driver);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index cd59c79eebdd..575aa65436d1 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -64,6 +64,9 @@
 #define USB_VENDOR_ID_AKAI              0x2011
 #define USB_DEVICE_ID_AKAI_MPKMINI2     0x0715
+#define USB_VENDOR_ID_AKAI_09E8         0x09E8
+#define USB_DEVICE_ID_AKAI_09E8_MIDIMIX 0x0031
 #define USB_VENDOR_ID_ALCOR             0x058f
 #define USB_DEVICE_ID_ALCOR_USBRS232    0x9720
@@ -176,6 +179,7 @@
 #define USB_DEVICE_ID_ATEN_4PORTKVM     0x2205
 #define USB_DEVICE_ID_ATEN_4PORTKVMC    0x2208
 #define USB_DEVICE_ID_ATEN_CS682        0x2213
+#define USB_DEVICE_ID_ATEN_CS692        0x8021
 #define USB_VENDOR_ID_ATMEL             0x03eb
 #define USB_DEVICE_ID_ATMEL_MULTITOUCH  0x211c
diff --git a/drivers/hid/hid-led.c b/drivers/hid/hid-led.c
index d8d55f37b4f5..d3e1ab162f7c 100644
--- a/drivers/hid/hid-led.c
+++ b/drivers/hid/hid-led.c
@@ -100,6 +100,7 @@ struct hidled_device {
        const struct hidled_config *config;
        struct hid_device       *hdev;
        struct hidled_rgb       *rgb;
+        u8                      *buf;
        struct mutex            lock;
 };
@@ -118,13 +119,19 @@ static int hidled_send(struct hidled_device *ldev, __u8 *buf)
        mutex_lock(&ldev->lock);
+        /*
+         * buffer provided to hid_hw_raw_request must not be on the stack
+         * and must not be part of a data structure
+         */
+        memcpy(ldev->buf, buf, ldev->config->report_size);
        if (ldev->config->report_type == RAW_REQUEST)
-                ret = hid_hw_raw_request(ldev->hdev, buf[0], buf,
+                ret = hid_hw_raw_request(ldev->hdev, buf[0], ldev->buf,
                                         ldev->config->report_size,
                                         HID_FEATURE_REPORT,
                                         HID_REQ_SET_REPORT);
        else if (ldev->config->report_type == OUTPUT_REPORT)
-                ret = hid_hw_output_report(ldev->hdev, buf,
+                ret = hid_hw_output_report(ldev->hdev, ldev->buf,
                                           ldev->config->report_size);
        else
                ret = -EINVAL;
@@ -147,17 +154,21 @@ static int hidled_recv(struct hidled_device *ldev, __u8 *buf)
        mutex_lock(&ldev->lock);
-        ret = hid_hw_raw_request(ldev->hdev, buf[0], buf,
+        memcpy(ldev->buf, buf, ldev->config->report_size);
+        ret = hid_hw_raw_request(ldev->hdev, buf[0], ldev->buf,
                                 ldev->config->report_size,
                                 HID_FEATURE_REPORT,
                                 HID_REQ_SET_REPORT);
        if (ret < 0)
                goto err;
-        ret = hid_hw_raw_request(ldev->hdev, buf[0], buf,
+        ret = hid_hw_raw_request(ldev->hdev, buf[0], ldev->buf,
                                 ldev->config->report_size,
                                 HID_FEATURE_REPORT,
                                 HID_REQ_GET_REPORT);
+        memcpy(buf, ldev->buf, ldev->config->report_size);
 err:
        mutex_unlock(&ldev->lock);
@@ -447,6 +458,10 @@ static int hidled_probe(struct hid_device *hdev, const struct hid_device_id *id)
        if (!ldev)
                return -ENOMEM;
+        ldev->buf = devm_kmalloc(&hdev->dev, MAX_REPORT_SIZE, GFP_KERNEL);
+        if (!ldev->buf)
+                return -ENOMEM;
        ret = hid_parse(hdev);
        if (ret)
                return ret;
diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index 76f644deb0a7..c5c5fbe9d605 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -756,11 +756,16 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
        /* Setup wireless link with Logitech Wii wheel */
        if (hdev->product == USB_DEVICE_ID_LOGITECH_WII_WHEEL) {
-                unsigned char buf[] = { 0x00, 0xAF,  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+                const unsigned char cbuf[] = { 0x00, 0xAF,  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+                u8 *buf = kmemdup(cbuf, sizeof(cbuf), GFP_KERNEL);
-                ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(buf),
+                if (!buf) {
-                                        HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+                        ret = -ENOMEM;
+                        goto err_free;
+                }
+                ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(cbuf),
+                                        HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
                if (ret >= 0) {
                        /* insert a little delay of 10 jiffies ~ 40ms */
                        wait_queue_head_t wait;
@@ -772,9 +777,10 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
                        buf[1] = 0xB2;
                        get_random_bytes(&buf[2], 2);
-                        ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(buf),
+                        ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(cbuf),
                                        HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
                }
+                kfree(buf);
        }
        if (drv_data->quirks & LG_FF)
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index d6fa496d0ca2..20b40ad26325 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -493,7 +493,8 @@ static int magicmouse_input_configured(struct hid_device *hdev,
 static int magicmouse_probe(struct hid_device *hdev,
        const struct hid_device_id *id)
 {
-        __u8 feature[] = { 0xd7, 0x01 };
+        const u8 feature[] = { 0xd7, 0x01 };
+        u8 *buf;
        struct magicmouse_sc *msc;
        struct hid_report *report;
        int ret;
@@ -544,6 +545,12 @@ static int magicmouse_probe(struct hid_device *hdev,
        }
        report->size = 6;
+        buf = kmemdup(feature, sizeof(feature), GFP_KERNEL);
+        if (!buf) {
+                ret = -ENOMEM;
+                goto err_stop_hw;
+        }
        /*
         * Some devices repond with 'invalid report id' when feature
         * report switching it into multitouch mode is sent to it.
@@ -552,8 +559,9 @@ static int magicmouse_probe(struct hid_device *hdev,
         * but there seems to be no other way of switching the mode.
         * Thus the super-ugly hacky success check below.
         */
-        ret = hid_hw_raw_request(hdev, feature[0], feature, sizeof(feature),
+        ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(feature),
                                HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+        kfree(buf);
        if (ret != -EIO && ret != sizeof(feature)) {
                hid_err(hdev, "unable to request touch data (%d)\n", ret);
                goto err_stop_hw;
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index 9cd2ca34a6be..be89bcbf6a71 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -188,10 +188,16 @@ static int rmi_set_page(struct hid_device *hdev, u8 page)
 static int rmi_set_mode(struct hid_device *hdev, u8 mode)
 {
        int ret;
-        u8 txbuf[2] = {RMI_SET_RMI_MODE_REPORT_ID, mode};
+        const u8 txbuf[2] = {RMI_SET_RMI_MODE_REPORT_ID, mode};
+        u8 *buf;
-        ret = hid_hw_raw_request(hdev, RMI_SET_RMI_MODE_REPORT_ID, txbuf,
+        buf = kmemdup(txbuf, sizeof(txbuf), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        ret = hid_hw_raw_request(hdev, RMI_SET_RMI_MODE_REPORT_ID, buf,
                        sizeof(txbuf), HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+        kfree(buf);
        if (ret < 0) {
                dev_err(&hdev->dev, "unable to set rmi mode to %d (%d)\n", mode,
                        ret);
diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index 5614fee82347..3a84aaf1418b 100644
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -292,11 +292,11 @@ static ssize_t show_value(struct device *dev, struct device_attribute *attr,
        bool input = false;
        int value = 0;
-        if (sscanf(attr->attr.name, "feature-%d-%x-%s", &index, &usage,
+        if (sscanf(attr->attr.name, "feature-%x-%x-%s", &index, &usage,
                   name) == 3) {
                feature = true;
                field_index = index + sensor_inst->input_field_count;
-        } else if (sscanf(attr->attr.name, "input-%d-%x-%s", &index, &usage,
+        } else if (sscanf(attr->attr.name, "input-%x-%x-%s", &index, &usage,
                   name) == 3) {
                input = true;
                field_index = index;
@@ -398,7 +398,7 @@ static ssize_t store_value(struct device *dev, struct device_attribute *attr,
        char name[HID_CUSTOM_NAME_LENGTH];
        int value;
-        if (sscanf(attr->attr.name, "feature-%d-%x-%s", &index, &usage,
+        if (sscanf(attr->attr.name, "feature-%x-%x-%s", &index, &usage,
                   name) == 3) {
                field_index = index + sensor_inst->input_field_count;
        } else
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 658a607dc6d9..60875625cbdf 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -212,6 +212,7 @@ int sensor_hub_set_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
        __s32 value;
        int ret = 0;
+        memset(buffer, 0, buffer_size);
        mutex_lock(&data->mutex);
        report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
        if (!report || (field_index >= report->maxfield)) {
@@ -251,6 +252,9 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
        struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
        int report_size;
        int ret = 0;
+        u8 *val_ptr;
+        int buffer_index = 0;
+        int i;
        mutex_lock(&data->mutex);
        report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
@@ -271,7 +275,17 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
                goto done_proc;
        }
        ret = min(report_size, buffer_size);
-        memcpy(buffer, report->field[field_index]->value, ret);
+        val_ptr = (u8 *)report->field[field_index]->value;
+        for (i = 0; i < report->field[field_index]->report_count; ++i) {
+                if (buffer_index >= ret)
+                        break;
+                memcpy(&((u8 *)buffer)[buffer_index], val_ptr,
+                       report->field[field_index]->report_size / 8);
+                val_ptr += sizeof(__s32);
+                buffer_index += (report->field[field_index]->report_size / 8);
+        }
 done_proc:
        mutex_unlock(&data->mutex);
diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c
index e2517c11e0ee..0c9ac4d5d850 100644
--- a/drivers/hid/intel-ish-hid/ipc/ipc.c
+++ b/drivers/hid/intel-ish-hid/ipc/ipc.c
@@ -638,6 +638,58 @@ eoi:
 }
 /**
+ * ish_disable_dma() - disable dma communication between host and ISHFW
+ * @dev: ishtp device pointer
+ *
+ * Clear the dma enable bit and wait for dma inactive.
+ *
+ * Return: 0 for success else error code.
+ */
+static int ish_disable_dma(struct ishtp_device *dev)
+{
+        unsigned int    dma_delay;
+        /* Clear the dma enable bit */
+        ish_reg_write(dev, IPC_REG_ISH_RMP2, 0);
+        /* wait for dma inactive */
+        for (dma_delay = 0; dma_delay < MAX_DMA_DELAY &&
+                _ish_read_fw_sts_reg(dev) & (IPC_ISH_IN_DMA);
+                dma_delay += 5)
+                mdelay(5);
+        if (dma_delay >= MAX_DMA_DELAY) {
+                dev_err(dev->devc,
+                        "Wait for DMA inactive timeout\n");
+                return  -EBUSY;
+        }
+        return 0;
+}
+/**
+ * ish_wakeup() - wakeup ishfw from waiting-for-host state
+ * @dev: ishtp device pointer
+ *
+ * Set the dma enable bit and send a void message to FW,
+ * it wil wakeup FW from waiting-for-host state.
+ */
+static void ish_wakeup(struct ishtp_device *dev)
+{
+        /* Set dma enable bit */
+        ish_reg_write(dev, IPC_REG_ISH_RMP2, IPC_RMP2_DMA_ENABLED);
+        /*
+         * Send 0 IPC message so that ISH FW wakes up if it was already
+         * asleep.
+         */
+        ish_reg_write(dev, IPC_REG_HOST2ISH_DRBL, IPC_DRBL_BUSY_BIT);
+        /* Flush writes to doorbell and REMAP2 */
+        ish_reg_read(dev, IPC_REG_ISH_HOST_FWSTS);
+}
+/**
 * _ish_hw_reset() - HW reset
 * @dev: ishtp device pointer
 *
@@ -649,7 +701,6 @@ static int _ish_hw_reset(struct ishtp_device *dev)
 {
        struct pci_dev *pdev = dev->pdev;
        int     rv;
-        unsigned int    dma_delay;
        uint16_t csr;
        if (!pdev)
@@ -664,15 +715,8 @@ static int _ish_hw_reset(struct ishtp_device *dev)
                return  -EINVAL;
        }
-        /* Now trigger reset to FW */
+        /* Disable dma communication between FW and host */
-        ish_reg_write(dev, IPC_REG_ISH_RMP2, 0);
+        if (ish_disable_dma(dev)) {
-        for (dma_delay = 0; dma_delay < MAX_DMA_DELAY &&
-                _ish_read_fw_sts_reg(dev) & (IPC_ISH_IN_DMA);
-                dma_delay += 5)
-                mdelay(5);
-        if (dma_delay >= MAX_DMA_DELAY) {
                dev_err(&pdev->dev,
                        "Can't reset - stuck with DMA in-progress\n");
                return  -EBUSY;
@@ -690,16 +734,8 @@ static int _ish_hw_reset(struct ishtp_device *dev)
        csr |= PCI_D0;
        pci_write_config_word(pdev, pdev->pm_cap + PCI_PM_CTRL, csr);
-        ish_reg_write(dev, IPC_REG_ISH_RMP2, IPC_RMP2_DMA_ENABLED);
+        /* Now we can enable ISH DMA operation and wakeup ISHFW */
+        ish_wakeup(dev);
-        /*
-         * Send 0 IPC message so that ISH FW wakes up if it was already
-         * asleep
-         */
-        ish_reg_write(dev, IPC_REG_HOST2ISH_DRBL, IPC_DRBL_BUSY_BIT);
-        /* Flush writes to doorbell and REMAP2 */
-        ish_reg_read(dev, IPC_REG_ISH_HOST_FWSTS);
        return  0;
 }
@@ -758,16 +794,9 @@ static int _ish_ipc_reset(struct ishtp_device *dev)
 int ish_hw_start(struct ishtp_device *dev)
 {
        ish_set_host_rdy(dev);
-        /* After that we can enable ISH DMA operation */
-        ish_reg_write(dev, IPC_REG_ISH_RMP2, IPC_RMP2_DMA_ENABLED);
-        /*
+        /* After that we can enable ISH DMA operation and wakeup ISHFW */
-         * Send 0 IPC message so that ISH FW wakes up if it was already
+        ish_wakeup(dev);
-         * asleep
-         */
-        ish_reg_write(dev, IPC_REG_HOST2ISH_DRBL, IPC_DRBL_BUSY_BIT);
-        /* Flush write to doorbell */
-        ish_reg_read(dev, IPC_REG_ISH_HOST_FWSTS);
        set_host_ready(dev);
@@ -876,6 +905,21 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev)
 */
 void    ish_device_disable(struct ishtp_device *dev)
 {
+        struct pci_dev *pdev = dev->pdev;
+        if (!pdev)
+                return;
+        /* Disable dma communication between FW and host */
+        if (ish_disable_dma(dev)) {
+                dev_err(&pdev->dev,
+                        "Can't reset - stuck with DMA in-progress\n");
+                return;
+        }
+        /* Put ISH to D3hot state for power saving */
+        pci_set_power_state(pdev, PCI_D3hot);
        dev->dev_state = ISHTP_DEV_DISABLED;
        ish_clr_host_rdy(dev);
 }
diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
index 42f0beeb09fd..20d647d2dd2c 100644
--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
@@ -146,7 +146,7 @@ static int ish_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        pdev->dev_flags |= PCI_DEV_FLAGS_NO_D3;
        /* request and enable interrupt */
-        ret = request_irq(pdev->irq, ish_irq_handler, IRQF_NO_SUSPEND,
+        ret = request_irq(pdev->irq, ish_irq_handler, IRQF_SHARED,
                          KBUILD_MODNAME, dev);
        if (ret) {
                dev_err(&pdev->dev, "ISH: request IRQ failure (%d)\n",
@@ -202,6 +202,7 @@ static void ish_remove(struct pci_dev *pdev)
        kfree(ishtp_dev);
 }
+#ifdef CONFIG_PM
 static struct device *ish_resume_device;
 /**
@@ -293,7 +294,6 @@ static int ish_resume(struct device *device)
        return 0;
 }
-#ifdef CONFIG_PM
 static const struct dev_pm_ops ish_pm_ops = {
        .suspend = ish_suspend,
        .resume = ish_resume,
@@ -301,7 +301,7 @@ static const struct dev_pm_ops ish_pm_ops = {
 #define ISHTP_ISH_PM_OPS        (&ish_pm_ops)
 #else
 #define ISHTP_ISH_PM_OPS        NULL
-#endif
+#endif /* CONFIG_PM */
 static struct pci_driver ish_driver = {
        .name = KBUILD_MODNAME,
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 0a0eca5da47d..e6cfd323babc 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -56,12 +56,14 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FIGHTERSTICK, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE, HID_QUIRK_NOGET },
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index 4aa3cb63fd41..bcd06306f3e8 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -314,10 +314,14 @@ static void heartbeat_onchannelcallback(void *context)
        u8 *hbeat_txf_buf = util_heartbeat.recv_buffer;
        struct icmsg_negotiate *negop = NULL;
-        vmbus_recvpacket(channel, hbeat_txf_buf,
+        while (1) {
-                         PAGE_SIZE, &recvlen, &requestid);
+                vmbus_recvpacket(channel, hbeat_txf_buf,
+                                 PAGE_SIZE, &recvlen, &requestid);
+                if (!recvlen)
+                        break;
-        if (recvlen > 0) {
                icmsghdrp = (struct icmsg_hdr *)&hbeat_txf_buf[
                                sizeof(struct vmbuspipe_hdr)];
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index a259e18d22d5..0276d2ef06ee 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -961,7 +961,7 @@ int vmbus_device_register(struct hv_device *child_device_obj)
 {
        int ret = 0;
-        dev_set_name(&child_device_obj->device, "vmbus-%pUl",
+        dev_set_name(&child_device_obj->device, "%pUl",
                     child_device_obj->channel->offermsg.offer.if_instance.b);
        child_device_obj->device.bus = &hv_bus;
diff --git a/drivers/hwmon/adm9240.c b/drivers/hwmon/adm9240.c
index 98114cef1e43..2fe1828bd10b 100644
--- a/drivers/hwmon/adm9240.c
+++ b/drivers/hwmon/adm9240.c
@@ -194,10 +194,10 @@ static struct adm9240_data *adm9240_update_device(struct device *dev)
                 * 0.5'C per two measurement cycles thus ignore possible
                 * but unlikely aliasing error on lsb reading. --Grant
                 */
-                data->temp = ((i2c_smbus_read_byte_data(client,
+                data->temp = (i2c_smbus_read_byte_data(client,
                                        ADM9240_REG_TEMP) << 8) |
                                        i2c_smbus_read_byte_data(client,
-                                        ADM9240_REG_TEMP_CONF)) / 128;
+                                        ADM9240_REG_TEMP_CONF);
                for (i = 0; i < 2; i++) { /* read fans */
                        data->fan[i] = i2c_smbus_read_byte_data(client,
@@ -263,7 +263,7 @@ static ssize_t show_temp(struct device *dev, struct device_attribute *dummy,
                char *buf)
 {
        struct adm9240_data *data = adm9240_update_device(dev);
-        return sprintf(buf, "%d\n", data->temp * 500); /* 9-bit value */
+        return sprintf(buf, "%d\n", data->temp / 128 * 500); /* 9-bit value */
 }
 static ssize_t show_max(struct device *dev, struct device_attribute *devattr,
diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
index adae6848ffb2..a74c075a30ec 100644
--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -536,8 +536,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
                hwdev->groups = devm_kcalloc(dev, ngroups, sizeof(*groups),
                                             GFP_KERNEL);
-                if (!hwdev->groups)
+                if (!hwdev->groups) {
-                        return ERR_PTR(-ENOMEM);
+                        err = -ENOMEM;
+                        goto free_hwmon;
+                }
                attrs = __hwmon_create_attrs(dev, drvdata, chip);
                if (IS_ERR(attrs)) {
diff --git a/drivers/hwmon/max31790.c b/drivers/hwmon/max31790.c
index bef84e085973..c1b9275978f9 100644
--- a/drivers/hwmon/max31790.c
+++ b/drivers/hwmon/max31790.c
@@ -268,11 +268,13 @@ static int max31790_read_pwm(struct device *dev, u32 attr, int channel,
                             long *val)
 {
        struct max31790_data *data = max31790_update_device(dev);
-        u8 fan_config = data->fan_config[channel];
+        u8 fan_config;
        if (IS_ERR(data))
                return PTR_ERR(data);
+        fan_config = data->fan_config[channel];
        switch (attr) {
        case hwmon_pwm_input:
                *val = data->pwm[channel] >> 8;
diff --git a/drivers/i2c/Kconfig b/drivers/i2c/Kconfig
index d223650a97e4..11edabf425ae 100644
--- a/drivers/i2c/Kconfig
+++ b/drivers/i2c/Kconfig
@@ -59,7 +59,6 @@ config I2C_CHARDEV
 config I2C_MUX
        tristate "I2C bus multiplexing support"
-        depends on HAS_IOMEM
        help
          Say Y here if you want the I2C core to support the ability to
          handle multiplexed I2C bus topologies, by presenting each
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 6d94e2ec5b4f..d252276feadf 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -79,12 +79,12 @@ config I2C_AMD8111
 config I2C_HIX5HD2
        tristate "Hix5hd2 high-speed I2C driver"
-        depends on ARCH_HIX5HD2 || COMPILE_TEST
+        depends on ARCH_HISI || ARCH_HIX5HD2 || COMPILE_TEST
        help
-          Say Y here to include support for high-speed I2C controller in the
+          Say Y here to include support for the high-speed I2C controller
-          Hisilicon based hix5hd2 SoCs.
+          used in HiSilicon hix5hd2 SoCs.
-          This driver can also be built as a module.  If so, the module
+          This driver can also be built as a module. If so, the module
          will be called i2c-hix5hd2.
 config I2C_I801
@@ -589,10 +589,10 @@ config I2C_IMG
 config I2C_IMX
        tristate "IMX I2C interface"
-        depends on ARCH_MXC || ARCH_LAYERSCAPE
+        depends on ARCH_MXC || ARCH_LAYERSCAPE || COLDFIRE
        help
          Say Y here if you want to use the IIC bus controller on
-          the Freescale i.MX/MXC or Layerscape processors.
+          the Freescale i.MX/MXC, Layerscape or ColdFire processors.
          This driver can also be built as a module.  If so, the module
          will be called i2c-imx.
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 1fe93c43215c..b403fa5ecf49 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -91,9 +91,10 @@
                                         DW_IC_INTR_TX_ABRT | \
                                         DW_IC_INTR_STOP_DET)
-#define DW_IC_STATUS_ACTIVITY           0x1
+#define DW_IC_STATUS_ACTIVITY   0x1
-#define DW_IC_STATUS_TFE                BIT(2)
-#define DW_IC_STATUS_MST_ACTIVITY       BIT(5)
+#define DW_IC_SDA_HOLD_RX_SHIFT         16
+#define DW_IC_SDA_HOLD_RX_MASK          GENMASK(23, DW_IC_SDA_HOLD_RX_SHIFT)
 #define DW_IC_ERR_TX_ABRT       0x1
@@ -420,12 +421,20 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
        /* Configure SDA Hold Time if required */
        reg = dw_readl(dev, DW_IC_COMP_VERSION);
        if (reg >= DW_IC_SDA_HOLD_MIN_VERS) {
-                if (dev->sda_hold_time) {
+                if (!dev->sda_hold_time) {
-                        dw_writel(dev, dev->sda_hold_time, DW_IC_SDA_HOLD);
-                } else {
                        /* Keep previous hold time setting if no one set it */
                        dev->sda_hold_time = dw_readl(dev, DW_IC_SDA_HOLD);
                }
+                /*
+                 * Workaround for avoiding TX arbitration lost in case I2C
+                 * slave pulls SDA down "too quickly" after falling egde of
+                 * SCL by enabling non-zero SDA RX hold. Specification says it
+                 * extends incoming SDA low to high transition while SCL is
+                 * high but it apprears to help also above issue.
+                 */
+                if (!(dev->sda_hold_time & DW_IC_SDA_HOLD_RX_MASK))
+                        dev->sda_hold_time |= 1 << DW_IC_SDA_HOLD_RX_SHIFT;
+                dw_writel(dev, dev->sda_hold_time, DW_IC_SDA_HOLD);
        } else {
                dev_warn(dev->dev,
                        "Hardware too old to adjust SDA hold time.\n");
@@ -467,25 +476,9 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
 {
        struct i2c_msg *msgs = dev->msgs;
        u32 ic_tar = 0;
-        bool enabled;
-        enabled = dw_readl(dev, DW_IC_ENABLE_STATUS) & 1;
-        if (enabled) {
-                u32 ic_status;
-                /*
+        /* Disable the adapter */
-                 * Only disable adapter if ic_tar and ic_con can't be
+        __i2c_dw_enable_and_wait(dev, false);
-                 * dynamically updated
-                 */
-                ic_status = dw_readl(dev, DW_IC_STATUS);
-                if (!dev->dynamic_tar_update_enabled ||
-                    (ic_status & DW_IC_STATUS_MST_ACTIVITY) ||
-                    !(ic_status & DW_IC_STATUS_TFE)) {
-                        __i2c_dw_enable_and_wait(dev, false);
-                        enabled = false;
-                }
-        }
        /* if the slave address is ten bit address, enable 10BITADDR */
        if (dev->dynamic_tar_update_enabled) {
@@ -515,8 +508,8 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
        /* enforce disabled interrupts (due to HW issues) */
        i2c_dw_disable_int(dev);
-        if (!enabled)
+        /* Enable the adapter */
-                __i2c_dw_enable(dev, true);
+        __i2c_dw_enable(dev, true);
        /* Clear and enable interrupts */
        dw_readl(dev, DW_IC_CLR_INTR);
@@ -600,7 +593,7 @@ i2c_dw_xfer_msg(struct dw_i2c_dev *dev)
                        if (msgs[dev->msg_write_idx].flags & I2C_M_RD) {
                                /* avoid rx buffer overrun */
-                                if (rx_limit - dev->rx_outstanding <= 0)
+                                if (dev->rx_outstanding >= dev->rx_fifo_depth)
                                        break;
                                dw_writel(dev, cmd | 0x100, DW_IC_DATA_CMD);
@@ -697,8 +690,7 @@ static int i2c_dw_handle_tx_abort(struct dw_i2c_dev *dev)
 }
 /*
- * Prepare controller for a transaction and start transfer by calling
+ * Prepare controller for a transaction and call i2c_dw_xfer_msg
- * i2c_dw_xfer_init()
 */
 static int
 i2c_dw_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
@@ -741,13 +733,23 @@ i2c_dw_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
                goto done;
        }
+        /*
+         * We must disable the adapter before returning and signaling the end
+         * of the current transfer. Otherwise the hardware might continue
+         * generating interrupts which in turn causes a race condition with
+         * the following transfer.  Needs some more investigation if the
+         * additional interrupts are a hardware bug or this driver doesn't
+         * handle them correctly yet.
+         */
+        __i2c_dw_enable(dev, false);
        if (dev->msg_err) {
                ret = dev->msg_err;
                goto done;
        }
        /* no error */
-        if (likely(!dev->cmd_err)) {
+        if (likely(!dev->cmd_err && !dev->status)) {
                ret = num;
                goto done;
        }
@@ -757,6 +759,11 @@ i2c_dw_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
                ret = i2c_dw_handle_tx_abort(dev);
                goto done;
        }
+        if (dev->status)
+                dev_err(dev->dev,
+                        "transfer terminated early - interrupt latency too high?\n");
        ret = -EIO;
 done:
@@ -877,19 +884,9 @@ static irqreturn_t i2c_dw_isr(int this_irq, void *dev_id)
         */
 tx_aborted:
-        if ((stat & (DW_IC_INTR_TX_ABRT | DW_IC_INTR_STOP_DET))
+        if ((stat & (DW_IC_INTR_TX_ABRT | DW_IC_INTR_STOP_DET)) || dev->msg_err)
-                        || dev->msg_err) {
-                /*
-                 * We must disable interruts before returning and signaling
-                 * the end of the current transfer. Otherwise the hardware
-                 * might continue generating interrupts for non-existent
-                 * transfers.
-                 */
-                i2c_dw_disable_int(dev);
-                dw_readl(dev, DW_IC_CLR_INTR);
                complete(&dev->cmd_complete);
-        } else if (unlikely(dev->accessor_flags & ACCESS_INTR_MASK)) {
+        else if (unlikely(dev->accessor_flags & ACCESS_INTR_MASK)) {
                /* workaround to trigger pending interrupt */
                stat = dw_readl(dev, DW_IC_INTR_MASK);
                i2c_dw_disable_int(dev);
diff --git a/drivers/i2c/busses/i2c-digicolor.c b/drivers/i2c/busses/i2c-digicolor.c
index 9604024e0eb0..50813a24c541 100644
--- a/drivers/i2c/busses/i2c-digicolor.c
+++ b/drivers/i2c/busses/i2c-digicolor.c
@@ -347,7 +347,7 @@ static int dc_i2c_probe(struct platform_device *pdev)
        ret = i2c_add_adapter(&i2c->adap);
        if (ret < 0) {
-                clk_unprepare(i2c->clk);
+                clk_disable_unprepare(i2c->clk);
                return ret;
        }
@@ -368,6 +368,7 @@ static const struct of_device_id dc_i2c_match[] = {
        { .compatible = "cnxt,cx92755-i2c" },
        { },
 };
+MODULE_DEVICE_TABLE(of, dc_i2c_match);
 static struct platform_driver dc_i2c_driver = {
        .probe   = dc_i2c_probe,
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 08847e8b8998..eb3627f35d12 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -146,6 +146,7 @@
 #define SMBHSTCFG_HST_EN        1
 #define SMBHSTCFG_SMB_SMI_EN    2
 #define SMBHSTCFG_I2C_EN        4
+#define SMBHSTCFG_SPD_WD        0x10
 /* TCO configuration bits for TCOCTL */
 #define TCOCTL_EN               0x0100
@@ -865,9 +866,16 @@ static s32 i801_access(struct i2c_adapter *adap, u16 addr,
                block = 1;
                break;
        case I2C_SMBUS_I2C_BLOCK_DATA:
-                /* NB: page 240 of ICH5 datasheet shows that the R/#W
+                /*
-                 * bit should be cleared here, even when reading */
+                 * NB: page 240 of ICH5 datasheet shows that the R/#W
-                outb_p((addr & 0x7f) << 1, SMBHSTADD(priv));
+                 * bit should be cleared here, even when reading.
+                 * However if SPD Write Disable is set (Lynx Point and later),
+                 * the read will fail if we don't set the R/#W bit.
+                 */
+                outb_p(((addr & 0x7f) << 1) |
+                       ((priv->original_hstcfg & SMBHSTCFG_SPD_WD) ?
+                        (read_write & 0x01) : 0),
+                       SMBHSTADD(priv));
                if (read_write == I2C_SMBUS_READ) {
                        /* NB: page 240 of ICH5 datasheet also shows
                         * that DATA1 is the cmd field when reading */
@@ -1573,6 +1581,8 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
                /* Disable SMBus interrupt feature if SMBus using SMI# */
                priv->features &= ~FEATURE_IRQ;
        }
+        if (temp & SMBHSTCFG_SPD_WD)
+                dev_info(&dev->dev, "SPD Write Disable is set\n");
        /* Clear special mode bits */
        if (priv->features & (FEATURE_SMBUS_PEC | FEATURE_BLOCK_BUFFER))
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 592a8f26a708..47fc1f1acff7 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -1009,10 +1009,13 @@ static int i2c_imx_init_recovery_info(struct imx_i2c_struct *i2c_imx,
        rinfo->sda_gpio = of_get_named_gpio(pdev->dev.of_node, "sda-gpios", 0);
        rinfo->scl_gpio = of_get_named_gpio(pdev->dev.of_node, "scl-gpios", 0);
-        if (!gpio_is_valid(rinfo->sda_gpio) ||
+        if (rinfo->sda_gpio == -EPROBE_DEFER ||
-            !gpio_is_valid(rinfo->scl_gpio) ||
+            rinfo->scl_gpio == -EPROBE_DEFER) {
-            IS_ERR(i2c_imx->pinctrl_pins_default) ||
+                return -EPROBE_DEFER;
-            IS_ERR(i2c_imx->pinctrl_pins_gpio)) {
+        } else if (!gpio_is_valid(rinfo->sda_gpio) ||
+                   !gpio_is_valid(rinfo->scl_gpio) ||
+                   IS_ERR(i2c_imx->pinctrl_pins_default) ||
+                   IS_ERR(i2c_imx->pinctrl_pins_gpio)) {
                dev_dbg(&pdev->dev, "recovery information incomplete\n");
                return 0;
        }
diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c
index b8ea62105f42..30132c3957cd 100644
--- a/drivers/i2c/busses/i2c-jz4780.c
+++ b/drivers/i2c/busses/i2c-jz4780.c
@@ -729,6 +729,7 @@ static const struct of_device_id jz4780_i2c_of_matches[] = {
        { .compatible = "ingenic,jz4780-i2c", },
        { /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, jz4780_i2c_of_matches);
 static int jz4780_i2c_probe(struct platform_device *pdev)
 {
diff --git a/drivers/i2c/busses/i2c-octeon-core.c b/drivers/i2c/busses/i2c-octeon-core.c
index 419b54bfc7c7..5e63b17f935d 100644
--- a/drivers/i2c/busses/i2c-octeon-core.c
+++ b/drivers/i2c/busses/i2c-octeon-core.c
@@ -381,9 +381,7 @@ static int octeon_i2c_read(struct octeon_i2c *i2c, int target,
                if (result)
                        return result;
-                data[i] = octeon_i2c_data_read(i2c, &result);
+                data[i] = octeon_i2c_data_read(i2c);
-                if (result)
-                        return result;
                if (recv_len && i == 0) {
                        if (data[i] > I2C_SMBUS_BLOCK_MAX + 1)
                                return -EPROTO;
diff --git a/drivers/i2c/busses/i2c-octeon-core.h b/drivers/i2c/busses/i2c-octeon-core.h
index 1db7c835a454..87151ea74acd 100644
--- a/drivers/i2c/busses/i2c-octeon-core.h
+++ b/drivers/i2c/busses/i2c-octeon-core.h
@@ -5,7 +5,6 @@
 #include <linux/i2c.h>
 #include <linux/i2c-smbus.h>
 #include <linux/io.h>
-#include <linux/iopoll.h>
 #include <linux/kernel.h>
 #include <linux/pci.h>
@@ -145,9 +144,9 @@ static inline void octeon_i2c_reg_write(struct octeon_i2c *i2c, u64 eop_reg, u8
        u64 tmp;
        __raw_writeq(SW_TWSI_V | eop_reg | data, i2c->twsi_base + SW_TWSI(i2c));
+        do {
-        readq_poll_timeout(i2c->twsi_base + SW_TWSI(i2c), tmp, tmp & SW_TWSI_V,
+                tmp = __raw_readq(i2c->twsi_base + SW_TWSI(i2c));
-                           I2C_OCTEON_EVENT_WAIT, i2c->adap.timeout);
+        } while ((tmp & SW_TWSI_V) != 0);
 }
 #define octeon_i2c_ctl_write(i2c, val)                                  \
@@ -164,28 +163,24 @@ static inline void octeon_i2c_reg_write(struct octeon_i2c *i2c, u64 eop_reg, u8
 *
 * The I2C core registers are accessed indirectly via the SW_TWSI CSR.
 */
-static inline int octeon_i2c_reg_read(struct octeon_i2c *i2c, u64 eop_reg,
+static inline u8 octeon_i2c_reg_read(struct octeon_i2c *i2c, u64 eop_reg)
-                                      int *error)
 {
        u64 tmp;
-        int ret;
        __raw_writeq(SW_TWSI_V | eop_reg | SW_TWSI_R, i2c->twsi_base + SW_TWSI(i2c));
+        do {
+                tmp = __raw_readq(i2c->twsi_base + SW_TWSI(i2c));
+        } while ((tmp & SW_TWSI_V) != 0);
-        ret = readq_poll_timeout(i2c->twsi_base + SW_TWSI(i2c), tmp,
-                                 tmp & SW_TWSI_V, I2C_OCTEON_EVENT_WAIT,
-                                 i2c->adap.timeout);
-        if (error)
-                *error = ret;
        return tmp & 0xFF;
 }
 #define octeon_i2c_ctl_read(i2c)                                        \
-        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_CTL, NULL)
+        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_CTL)
-#define octeon_i2c_data_read(i2c, error)                                \
+#define octeon_i2c_data_read(i2c)                                       \
-        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_DATA, error)
+        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_DATA)
 #define octeon_i2c_stat_read(i2c)                                       \
-        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_STAT, NULL)
+        octeon_i2c_reg_read(i2c, SW_TWSI_EOP_TWSI_STAT)
 /**
 * octeon_i2c_read_int - read the TWSI_INT register
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index 50702c7bb244..df220666d627 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -694,6 +694,8 @@ static int rk3x_i2c_v0_calc_timings(unsigned long clk_rate,
        t_calc->div_low--;
        t_calc->div_high--;
+        /* Give the tuning value 0, that would not update con register */
+        t_calc->tuning = 0;
        /* Maximum divider supported by hw is 0xffff */
        if (t_calc->div_low > 0xffff) {
                t_calc->div_low = 0xffff;
diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c
index 263685c7a512..05cf192ef1ac 100644
--- a/drivers/i2c/busses/i2c-xgene-slimpro.c
+++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
@@ -105,7 +105,7 @@ struct slimpro_i2c_dev {
        struct mbox_chan *mbox_chan;
        struct mbox_client mbox_client;
        struct completion rd_complete;
-        u8 dma_buffer[I2C_SMBUS_BLOCK_MAX];
+        u8 dma_buffer[I2C_SMBUS_BLOCK_MAX + 1]; /* dma_buffer[0] is used for length */
        u32 *resp_msg;
 };
diff --git a/drivers/i2c/busses/i2c-xlp9xx.c b/drivers/i2c/busses/i2c-xlp9xx.c
index 2a972ed7aa0d..e29ff37a43bd 100644
--- a/drivers/i2c/busses/i2c-xlp9xx.c
+++ b/drivers/i2c/busses/i2c-xlp9xx.c
@@ -426,6 +426,7 @@ static const struct of_device_id xlp9xx_i2c_of_match[] = {
        { .compatible = "netlogic,xlp980-i2c", },
        { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(of, xlp9xx_i2c_of_match);
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id xlp9xx_i2c_acpi_ids[] = {
diff --git a/drivers/i2c/busses/i2c-xlr.c b/drivers/i2c/busses/i2c-xlr.c
index 0968f59b6df5..ad17d88d8573 100644
--- a/drivers/i2c/busses/i2c-xlr.c
+++ b/drivers/i2c/busses/i2c-xlr.c
@@ -358,6 +358,7 @@ static const struct of_device_id xlr_i2c_dt_ids[] = {
        },
        { }
 };
+MODULE_DEVICE_TABLE(of, xlr_i2c_dt_ids);
 static int xlr_i2c_probe(struct platform_device *pdev)
 {
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 5ab67219f71e..b432b64e307a 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -1681,6 +1681,7 @@ static struct i2c_client *of_i2c_register_device(struct i2c_adapter *adap,
 static void of_i2c_register_devices(struct i2c_adapter *adap)
 {
        struct device_node *bus, *node;
+        struct i2c_client *client;
        /* Only register child devices if the adapter has a node pointer set */
        if (!adap->dev.of_node)
@@ -1695,7 +1696,14 @@ static void of_i2c_register_devices(struct i2c_adapter *adap)
        for_each_available_child_of_node(bus, node) {
                if (of_node_test_and_set_flag(node, OF_POPULATED))
                        continue;
-                of_i2c_register_device(adap, node);
+                client = of_i2c_register_device(adap, node);
+                if (IS_ERR(client)) {
+                        dev_warn(&adap->dev,
+                                 "Failed to create I2C device for %s\n",
+                                 node->full_name);
+                        of_node_clear_flag(node, OF_POPULATED);
+                }
        }
        of_node_put(bus);
@@ -2171,6 +2179,7 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver)
        /* add the driver to the list of i2c drivers in the driver core */
        driver->driver.owner = owner;
        driver->driver.bus = &i2c_bus_type;
+        INIT_LIST_HEAD(&driver->clients);
        /* When registration returns, the driver core
         * will have called probe() for all matching-but-unbound devices.
@@ -2181,7 +2190,6 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver)
        pr_debug("driver [%s] registered\n", driver->driver.name);
-        INIT_LIST_HEAD(&driver->clients);
        /* Walk the adapters that are already present */
        i2c_for_each_dev(driver, __process_new_driver);
@@ -2299,6 +2307,7 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
                if (IS_ERR(client)) {
                        dev_err(&adap->dev, "failed to create client for '%s'\n",
                                 rd->dn->full_name);
+                        of_node_clear_flag(rd->dn, OF_POPULATED);
                        return notifier_from_errno(PTR_ERR(client));
                }
                break;
diff --git a/drivers/i2c/muxes/Kconfig b/drivers/i2c/muxes/Kconfig
index e280c8ecc0b5..96de9ce5669b 100644
--- a/drivers/i2c/muxes/Kconfig
+++ b/drivers/i2c/muxes/Kconfig
@@ -63,6 +63,7 @@ config I2C_MUX_PINCTRL
 config I2C_MUX_REG
        tristate "Register-based I2C multiplexer"
+        depends on HAS_IOMEM
        help
          If you say yes to this option, support will be included for a
          register based I2C multiplexer. This driver provides access to
diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
index b3893f6282ba..3e6fe1760d82 100644
--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
@@ -69,10 +69,28 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
                goto err_with_revert;
        }
-        p = devm_pinctrl_get_select(adap->dev.parent, priv->bus_name);
+        /*
+         * Check if there are pinctrl states at all. Note: we cant' use
+         * devm_pinctrl_get_select() because we need to distinguish between
+         * the -ENODEV from devm_pinctrl_get() and pinctrl_lookup_state().
+         */
+        p = devm_pinctrl_get(adap->dev.parent);
        if (IS_ERR(p)) {
                ret = PTR_ERR(p);
-                goto err_with_put;
+                /* continue if just no pinctrl states (e.g. i2c-gpio), otherwise exit */
+                if (ret != -ENODEV)
+                        goto err_with_put;
+        } else {
+                /* there are states. check and use them */
+                struct pinctrl_state *s = pinctrl_lookup_state(p, priv->bus_name);
+                if (IS_ERR(s)) {
+                        ret = PTR_ERR(s);
+                        goto err_with_put;
+                }
+                ret = pinctrl_select_state(p, s);
+                if (ret < 0)
+                        goto err_with_put;
        }
        priv->chan[new_chan].parent_adap = adap;
diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c
index 1091346f2480..8bc3d36d2837 100644
--- a/drivers/i2c/muxes/i2c-mux-pca954x.c
+++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
@@ -268,9 +268,9 @@ static int pca954x_probe(struct i2c_client *client,
                                /* discard unconfigured channels */
                                break;
                        idle_disconnect_pd = pdata->modes[num].deselect_on_exit;
-                        data->deselect |= (idle_disconnect_pd
-                                           || idle_disconnect_dt) << num;
                }
+                data->deselect |= (idle_disconnect_pd ||
+                                   idle_disconnect_dt) << num;
                ret = i2c_mux_add_adapter(muxc, force, num, class);
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index da3fb069ec5c..ce69048c88e9 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -743,8 +743,8 @@ static int st_accel_read_raw(struct iio_dev *indio_dev,
                return IIO_VAL_INT;
        case IIO_CHAN_INFO_SCALE:
-                *val = 0;
+                *val = adata->current_fullscale->gain / 1000000;
-                *val2 = adata->current_fullscale->gain;
+                *val2 = adata->current_fullscale->gain % 1000000;
                return IIO_VAL_INT_PLUS_MICRO;
        case IIO_CHAN_INFO_SAMP_FREQ:
                *val = adata->odr;
@@ -763,9 +763,13 @@ static int st_accel_write_raw(struct iio_dev *indio_dev,
        int err;
        switch (mask) {
-        case IIO_CHAN_INFO_SCALE:
+        case IIO_CHAN_INFO_SCALE: {
-                err = st_sensors_set_fullscale_by_gain(indio_dev, val2);
+                int gain;
+                gain = val * 1000000 + val2;
+                err = st_sensors_set_fullscale_by_gain(indio_dev, gain);
                break;
+        }
        case IIO_CHAN_INFO_SAMP_FREQ:
                if (val2)
                        return -EINVAL;
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 7edcf3238620..99c051490eff 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -437,6 +437,8 @@ config STX104
 config TI_ADC081C
        tristate "Texas Instruments ADC081C/ADC101C/ADC121C family"
        depends on I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
        help
          If you say yes here you get support for Texas Instruments ADC081C,
          ADC101C and ADC121C ADC chips.
diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
index bd321b305a0a..ef761a508630 100644
--- a/drivers/iio/chemical/atlas-ph-sensor.c
+++ b/drivers/iio/chemical/atlas-ph-sensor.c
@@ -213,13 +213,14 @@ static int atlas_check_ec_calibration(struct atlas_data *data)
        struct device *dev = &data->client->dev;
        int ret;
        unsigned int val;
+        __be16  rval;
-        ret = regmap_bulk_read(data->regmap, ATLAS_REG_EC_PROBE, &val, 2);
+        ret = regmap_bulk_read(data->regmap, ATLAS_REG_EC_PROBE, &rval, 2);
        if (ret)
                return ret;
-        dev_info(dev, "probe set to K = %d.%.2d", be16_to_cpu(val) / 100,
+        val = be16_to_cpu(rval);
-                                                 be16_to_cpu(val) % 100);
+        dev_info(dev, "probe set to K = %d.%.2d", val / 100, val % 100);
        ret = regmap_read(data->regmap, ATLAS_REG_EC_CALIB_STATUS, &val);
        if (ret)
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index dc33c1dd5191..b5beea53d6f6 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -30,26 +30,26 @@ static struct {
        u32 usage_id;
        int unit; /* 0 for default others from HID sensor spec */
        int scale_val0; /* scale, whole number */
-        int scale_val1; /* scale, fraction in micros */
+        int scale_val1; /* scale, fraction in nanos */
 } unit_conversion[] = {
-        {HID_USAGE_SENSOR_ACCEL_3D, 0, 9, 806650},
+        {HID_USAGE_SENSOR_ACCEL_3D, 0, 9, 806650000},
        {HID_USAGE_SENSOR_ACCEL_3D,
                HID_USAGE_SENSOR_UNITS_METERS_PER_SEC_SQRD, 1, 0},
        {HID_USAGE_SENSOR_ACCEL_3D,
-                HID_USAGE_SENSOR_UNITS_G, 9, 806650},
+                HID_USAGE_SENSOR_UNITS_G, 9, 806650000},
-        {HID_USAGE_SENSOR_GYRO_3D, 0, 0, 17453},
+        {HID_USAGE_SENSOR_GYRO_3D, 0, 0, 17453293},
        {HID_USAGE_SENSOR_GYRO_3D,
                HID_USAGE_SENSOR_UNITS_RADIANS_PER_SECOND, 1, 0},
        {HID_USAGE_SENSOR_GYRO_3D,
-                HID_USAGE_SENSOR_UNITS_DEGREES_PER_SECOND, 0, 17453},
+                HID_USAGE_SENSOR_UNITS_DEGREES_PER_SECOND, 0, 17453293},
-        {HID_USAGE_SENSOR_COMPASS_3D, 0, 0, 1000},
+        {HID_USAGE_SENSOR_COMPASS_3D, 0, 0, 1000000},
        {HID_USAGE_SENSOR_COMPASS_3D, HID_USAGE_SENSOR_UNITS_GAUSS, 1, 0},
-        {HID_USAGE_SENSOR_INCLINOMETER_3D, 0, 0, 17453},
+        {HID_USAGE_SENSOR_INCLINOMETER_3D, 0, 0, 17453293},
        {HID_USAGE_SENSOR_INCLINOMETER_3D,
-                HID_USAGE_SENSOR_UNITS_DEGREES, 0, 17453},
+                HID_USAGE_SENSOR_UNITS_DEGREES, 0, 17453293},
        {HID_USAGE_SENSOR_INCLINOMETER_3D,
                HID_USAGE_SENSOR_UNITS_RADIANS, 1, 0},
@@ -57,7 +57,7 @@ static struct {
        {HID_USAGE_SENSOR_ALS, HID_USAGE_SENSOR_UNITS_LUX, 1, 0},
        {HID_USAGE_SENSOR_PRESSURE, 0, 100, 0},
-        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000},
+        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000000},
 };
 static int pow_10(unsigned power)
@@ -266,15 +266,15 @@ EXPORT_SYMBOL(hid_sensor_write_raw_hyst_value);
 /*
 * This fuction applies the unit exponent to the scale.
 * For example:
- * 9.806650 ->exp:2-> val0[980]val1[665000]
+ * 9.806650000 ->exp:2-> val0[980]val1[665000000]
- * 9.000806 ->exp:2-> val0[900]val1[80600]
+ * 9.000806000 ->exp:2-> val0[900]val1[80600000]
- * 0.174535 ->exp:2-> val0[17]val1[453500]
+ * 0.174535293 ->exp:2-> val0[17]val1[453529300]
- * 1.001745 ->exp:0-> val0[1]val1[1745]
+ * 1.001745329 ->exp:0-> val0[1]val1[1745329]
- * 1.001745 ->exp:2-> val0[100]val1[174500]
+ * 1.001745329 ->exp:2-> val0[100]val1[174532900]
- * 1.001745 ->exp:4-> val0[10017]val1[450000]
+ * 1.001745329 ->exp:4-> val0[10017]val1[453290000]
- * 9.806650 ->exp:-2-> val0[0]val1[98066]
+ * 9.806650000 ->exp:-2-> val0[0]val1[98066500]
 */
-static void adjust_exponent_micro(int *val0, int *val1, int scale0,
+static void adjust_exponent_nano(int *val0, int *val1, int scale0,
                                  int scale1, int exp)
 {
        int i;
@@ -285,32 +285,32 @@ static void adjust_exponent_micro(int *val0, int *val1, int scale0,
        if (exp > 0) {
                *val0 = scale0 * pow_10(exp);
                res = 0;
-                if (exp > 6) {
+                if (exp > 9) {
                        *val1 = 0;
                        return;
                }
                for (i = 0; i < exp; ++i) {
-                        x = scale1 / pow_10(5 - i);
+                        x = scale1 / pow_10(8 - i);
                        res += (pow_10(exp - 1 - i) * x);
-                        scale1 = scale1 % pow_10(5 - i);
+                        scale1 = scale1 % pow_10(8 - i);
                }
                *val0 += res;
                        *val1 = scale1 * pow_10(exp);
        } else if (exp < 0) {
                exp = abs(exp);
-                if (exp > 6) {
+                if (exp > 9) {
                        *val0 = *val1 = 0;
                        return;
                }
                *val0 = scale0 / pow_10(exp);
                rem = scale0 % pow_10(exp);
                res = 0;
-                for (i = 0; i < (6 - exp); ++i) {
+                for (i = 0; i < (9 - exp); ++i) {
-                        x = scale1 / pow_10(5 - i);
+                        x = scale1 / pow_10(8 - i);
-                        res += (pow_10(5 - exp - i) * x);
+                        res += (pow_10(8 - exp - i) * x);
-                        scale1 = scale1 % pow_10(5 - i);
+                        scale1 = scale1 % pow_10(8 - i);
                }
-                *val1 = rem * pow_10(6 - exp) + res;
+                *val1 = rem * pow_10(9 - exp) + res;
        } else {
                *val0 = scale0;
                *val1 = scale1;
@@ -332,14 +332,14 @@ int hid_sensor_format_scale(u32 usage_id,
                        unit_conversion[i].unit == attr_info->units) {
                        exp  = hid_sensor_convert_exponent(
                                                attr_info->unit_expo);
-                        adjust_exponent_micro(val0, val1,
+                        adjust_exponent_nano(val0, val1,
                                        unit_conversion[i].scale_val0,
                                        unit_conversion[i].scale_val1, exp);
                        break;
                }
        }
-        return IIO_VAL_INT_PLUS_MICRO;
+        return IIO_VAL_INT_PLUS_NANO;
 }
 EXPORT_SYMBOL(hid_sensor_format_scale);
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index 285a64a589d7..975a1f19f747 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -612,7 +612,7 @@ EXPORT_SYMBOL(st_sensors_sysfs_sampling_frequency_avail);
 ssize_t st_sensors_sysfs_scale_avail(struct device *dev,
                                struct device_attribute *attr, char *buf)
 {
-        int i, len = 0;
+        int i, len = 0, q, r;
        struct iio_dev *indio_dev = dev_get_drvdata(dev);
        struct st_sensor_data *sdata = iio_priv(indio_dev);
@@ -621,8 +621,10 @@ ssize_t st_sensors_sysfs_scale_avail(struct device *dev,
                if (sdata->sensor_settings->fs.fs_avl[i].num == 0)
                        break;
-                len += scnprintf(buf + len, PAGE_SIZE - len, "0.%06u ",
+                q = sdata->sensor_settings->fs.fs_avl[i].gain / 1000000;
-                                sdata->sensor_settings->fs.fs_avl[i].gain);
+                r = sdata->sensor_settings->fs.fs_avl[i].gain % 1000000;
+                len += scnprintf(buf + len, PAGE_SIZE - len, "%u.%06u ", q, r);
        }
        mutex_unlock(&indio_dev->mlock);
        buf[len - 1] = '\n';
diff --git a/drivers/iio/orientation/hid-sensor-rotation.c b/drivers/iio/orientation/hid-sensor-rotation.c
index b98b9d94d184..a97e802ca523 100644
--- a/drivers/iio/orientation/hid-sensor-rotation.c
+++ b/drivers/iio/orientation/hid-sensor-rotation.c
@@ -335,6 +335,7 @@ static struct platform_driver hid_dev_rot_platform_driver = {
        .id_table = hid_dev_rot_ids,
        .driver = {
                .name   = KBUILD_MODNAME,
+                .pm     = &hid_sensor_pm_ops,
        },
        .probe          = hid_dev_rot_probe,
        .remove         = hid_dev_rot_remove,
diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c
index 39dd2026ccc9..f962f31a5eb2 100644
--- a/drivers/iio/temperature/maxim_thermocouple.c
+++ b/drivers/iio/temperature/maxim_thermocouple.c
@@ -123,22 +123,26 @@ static int maxim_thermocouple_read(struct maxim_thermocouple_data *data,
 {
        unsigned int storage_bytes = data->chip->read_size;
        unsigned int shift = chan->scan_type.shift + (chan->address * 8);
-        unsigned int buf;
+        __be16 buf16;
+        __be32 buf32;
        int ret;
-        ret = spi_read(data->spi, (void *) &buf, storage_bytes);
-        if (ret)
-                return ret;
        switch (storage_bytes) {
        case 2:
-                *val = be16_to_cpu(buf);
+                ret = spi_read(data->spi, (void *)&buf16, storage_bytes);
+                *val = be16_to_cpu(buf16);
                break;
        case 4:
-                *val = be32_to_cpu(buf);
+                ret = spi_read(data->spi, (void *)&buf32, storage_bytes);
+                *val = be32_to_cpu(buf32);
                break;
+        default:
+                ret = -EINVAL;
        }
+        if (ret)
+                return ret;
        /* check to be sure this is a valid reading */
        if (*val & data->chip->status_bit)
                return -EINVAL;
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index b136d3acc5bd..0f58f46dbad7 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -699,13 +699,16 @@ EXPORT_SYMBOL(rdma_addr_cancel);
 struct resolve_cb_context {
        struct rdma_dev_addr *addr;
        struct completion comp;
+        int status;
 };
 static void resolve_cb(int status, struct sockaddr *src_addr,
             struct rdma_dev_addr *addr, void *context)
 {
-        memcpy(((struct resolve_cb_context *)context)->addr, addr, sizeof(struct
+        if (!status)
-                                rdma_dev_addr));
+                memcpy(((struct resolve_cb_context *)context)->addr,
+                       addr, sizeof(struct rdma_dev_addr));
+        ((struct resolve_cb_context *)context)->status = status;
        complete(&((struct resolve_cb_context *)context)->comp);
 }
@@ -743,6 +746,10 @@ int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid,
        wait_for_completion(&ctx.comp);
+        ret = ctx.status;
+        if (ret)
+                return ret;
        memcpy(dmac, dev_addr.dst_dev_addr, ETH_ALEN);
        dev = dev_get_by_index(&init_net, dev_addr.bound_dev_if);
        if (!dev)
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index c99525512b34..71c7c4c328ef 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -80,6 +80,8 @@ static struct ib_cm {
        __be32 random_id_operand;
        struct list_head timewait_list;
        struct workqueue_struct *wq;
+        /* Sync on cm change port state */
+        spinlock_t state_lock;
 } cm;
 /* Counter indexes ordered by attribute ID */
@@ -161,6 +163,8 @@ struct cm_port {
        struct ib_mad_agent *mad_agent;
        struct kobject port_obj;
        u8 port_num;
+        struct list_head cm_priv_prim_list;
+        struct list_head cm_priv_altr_list;
        struct cm_counter_group counter_group[CM_COUNTER_GROUPS];
 };
@@ -241,6 +245,12 @@ struct cm_id_private {
        u8 service_timeout;
        u8 target_ack_delay;
+        struct list_head prim_list;
+        struct list_head altr_list;
+        /* Indicates that the send port mad is registered and av is set */
+        int prim_send_port_not_ready;
+        int altr_send_port_not_ready;
        struct list_head work_list;
        atomic_t work_count;
 };
@@ -259,20 +269,47 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
        struct ib_mad_agent *mad_agent;
        struct ib_mad_send_buf *m;
        struct ib_ah *ah;
+        struct cm_av *av;
+        unsigned long flags, flags2;
+        int ret = 0;
+        /* don't let the port to be released till the agent is down */
+        spin_lock_irqsave(&cm.state_lock, flags2);
+        spin_lock_irqsave(&cm.lock, flags);
+        if (!cm_id_priv->prim_send_port_not_ready)
+                av = &cm_id_priv->av;
+        else if (!cm_id_priv->altr_send_port_not_ready &&
+                 (cm_id_priv->alt_av.port))
+                av = &cm_id_priv->alt_av;
+        else {
+                pr_info("%s: not valid CM id\n", __func__);
+                ret = -ENODEV;
+                spin_unlock_irqrestore(&cm.lock, flags);
+                goto out;
+        }
+        spin_unlock_irqrestore(&cm.lock, flags);
+        /* Make sure the port haven't released the mad yet */
        mad_agent = cm_id_priv->av.port->mad_agent;
-        ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr);
+        if (!mad_agent) {
-        if (IS_ERR(ah))
+                pr_info("%s: not a valid MAD agent\n", __func__);
-                return PTR_ERR(ah);
+                ret = -ENODEV;
+                goto out;
+        }
+        ah = ib_create_ah(mad_agent->qp->pd, &av->ah_attr);
+        if (IS_ERR(ah)) {
+                ret = PTR_ERR(ah);
+                goto out;
+        }
        m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn,
-                               cm_id_priv->av.pkey_index,
+                               av->pkey_index,
                               0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
                               GFP_ATOMIC,
                               IB_MGMT_BASE_VERSION);
        if (IS_ERR(m)) {
                ib_destroy_ah(ah);
-                return PTR_ERR(m);
+                ret = PTR_ERR(m);
+                goto out;
        }
        /* Timeout set by caller if response is expected. */
@@ -282,7 +319,10 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
        atomic_inc(&cm_id_priv->refcount);
        m->context[0] = cm_id_priv;
        *msg = m;
-        return 0;
+out:
+        spin_unlock_irqrestore(&cm.state_lock, flags2);
+        return ret;
 }
 static int cm_alloc_response_msg(struct cm_port *port,
@@ -352,7 +392,8 @@ static void cm_init_av_for_response(struct cm_port *port, struct ib_wc *wc,
                           grh, &av->ah_attr);
 }
-static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
+static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av,
+                              struct cm_id_private *cm_id_priv)
 {
        struct cm_device *cm_dev;
        struct cm_port *port = NULL;
@@ -387,7 +428,17 @@ static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
                             &av->ah_attr);
        av->timeout = path->packet_life_time + 1;
-        return 0;
+        spin_lock_irqsave(&cm.lock, flags);
+        if (&cm_id_priv->av == av)
+                list_add_tail(&cm_id_priv->prim_list, &port->cm_priv_prim_list);
+        else if (&cm_id_priv->alt_av == av)
+                list_add_tail(&cm_id_priv->altr_list, &port->cm_priv_altr_list);
+        else
+                ret = -EINVAL;
+        spin_unlock_irqrestore(&cm.lock, flags);
+        return ret;
 }
 static int cm_alloc_id(struct cm_id_private *cm_id_priv)
@@ -677,6 +728,8 @@ struct ib_cm_id *ib_create_cm_id(struct ib_device *device,
        spin_lock_init(&cm_id_priv->lock);
        init_completion(&cm_id_priv->comp);
        INIT_LIST_HEAD(&cm_id_priv->work_list);
+        INIT_LIST_HEAD(&cm_id_priv->prim_list);
+        INIT_LIST_HEAD(&cm_id_priv->altr_list);
        atomic_set(&cm_id_priv->work_count, -1);
        atomic_set(&cm_id_priv->refcount, 1);
        return &cm_id_priv->id;
@@ -892,6 +945,15 @@ retest:
                break;
        }
+        spin_lock_irq(&cm.lock);
+        if (!list_empty(&cm_id_priv->altr_list) &&
+            (!cm_id_priv->altr_send_port_not_ready))
+                list_del(&cm_id_priv->altr_list);
+        if (!list_empty(&cm_id_priv->prim_list) &&
+            (!cm_id_priv->prim_send_port_not_ready))
+                list_del(&cm_id_priv->prim_list);
+        spin_unlock_irq(&cm.lock);
        cm_free_id(cm_id->local_id);
        cm_deref_id(cm_id_priv);
        wait_for_completion(&cm_id_priv->comp);
@@ -1192,12 +1254,13 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
                goto out;
        }
-        ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av);
+        ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av,
+                                 cm_id_priv);
        if (ret)
                goto error1;
        if (param->alternate_path) {
                ret = cm_init_av_by_path(param->alternate_path,
-                                         &cm_id_priv->alt_av);
+                                         &cm_id_priv->alt_av, cm_id_priv);
                if (ret)
                        goto error1;
        }
@@ -1653,7 +1716,8 @@ static int cm_req_handler(struct cm_work *work)
                        dev_put(gid_attr.ndev);
                }
                work->path[0].gid_type = gid_attr.gid_type;
-                ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);
+                ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av,
+                                         cm_id_priv);
        }
        if (ret) {
                int err = ib_get_cached_gid(work->port->cm_dev->ib_device,
@@ -1672,7 +1736,8 @@ static int cm_req_handler(struct cm_work *work)
                goto rejected;
        }
        if (req_msg->alt_local_lid) {
-                ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av);
+                ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av,
+                                         cm_id_priv);
                if (ret) {
                        ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_ALT_GID,
                                       &work->path[0].sgid,
@@ -2727,7 +2792,8 @@ int ib_send_cm_lap(struct ib_cm_id *cm_id,
                goto out;
        }
-        ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av);
+        ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av,
+                                 cm_id_priv);
        if (ret)
                goto out;
        cm_id_priv->alt_av.timeout =
@@ -2839,7 +2905,8 @@ static int cm_lap_handler(struct cm_work *work)
        cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
                                work->mad_recv_wc->recv_buf.grh,
                                &cm_id_priv->av);
-        cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av);
+        cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av,
+                           cm_id_priv);
        ret = atomic_inc_and_test(&cm_id_priv->work_count);
        if (!ret)
                list_add_tail(&work->list, &cm_id_priv->work_list);
@@ -3031,7 +3098,7 @@ int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
                return -EINVAL;
        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
-        ret = cm_init_av_by_path(param->path, &cm_id_priv->av);
+        ret = cm_init_av_by_path(param->path, &cm_id_priv->av, cm_id_priv);
        if (ret)
                goto out;
@@ -3468,7 +3535,9 @@ out:
 static int cm_migrate(struct ib_cm_id *cm_id)
 {
        struct cm_id_private *cm_id_priv;
+        struct cm_av tmp_av;
        unsigned long flags;
+        int tmp_send_port_not_ready;
        int ret = 0;
        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
@@ -3477,7 +3546,14 @@ static int cm_migrate(struct ib_cm_id *cm_id)
            (cm_id->lap_state == IB_CM_LAP_UNINIT ||
             cm_id->lap_state == IB_CM_LAP_IDLE)) {
                cm_id->lap_state = IB_CM_LAP_IDLE;
+                /* Swap address vector */
+                tmp_av = cm_id_priv->av;
                cm_id_priv->av = cm_id_priv->alt_av;
+                cm_id_priv->alt_av = tmp_av;
+                /* Swap port send ready state */
+                tmp_send_port_not_ready = cm_id_priv->prim_send_port_not_ready;
+                cm_id_priv->prim_send_port_not_ready = cm_id_priv->altr_send_port_not_ready;
+                cm_id_priv->altr_send_port_not_ready = tmp_send_port_not_ready;
        } else
                ret = -EINVAL;
        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
@@ -3888,6 +3964,9 @@ static void cm_add_one(struct ib_device *ib_device)
                port->cm_dev = cm_dev;
                port->port_num = i;
+                INIT_LIST_HEAD(&port->cm_priv_prim_list);
+                INIT_LIST_HEAD(&port->cm_priv_altr_list);
                ret = cm_create_port_fs(port);
                if (ret)
                        goto error1;
@@ -3945,6 +4024,8 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
 {
        struct cm_device *cm_dev = client_data;
        struct cm_port *port;
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_agent *cur_mad_agent;
        struct ib_port_modify port_modify = {
                .clr_port_cap_mask = IB_PORT_CM_SUP
        };
@@ -3968,15 +4049,27 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
                port = cm_dev->port[i-1];
                ib_modify_port(ib_device, port->port_num, 0, &port_modify);
+                /* Mark all the cm_id's as not valid */
+                spin_lock_irq(&cm.lock);
+                list_for_each_entry(cm_id_priv, &port->cm_priv_altr_list, altr_list)
+                        cm_id_priv->altr_send_port_not_ready = 1;
+                list_for_each_entry(cm_id_priv, &port->cm_priv_prim_list, prim_list)
+                        cm_id_priv->prim_send_port_not_ready = 1;
+                spin_unlock_irq(&cm.lock);
                /*
                 * We flush the queue here after the going_down set, this
                 * verify that no new works will be queued in the recv handler,
                 * after that we can call the unregister_mad_agent
                 */
                flush_workqueue(cm.wq);
-                ib_unregister_mad_agent(port->mad_agent);
+                spin_lock_irq(&cm.state_lock);
+                cur_mad_agent = port->mad_agent;
+                port->mad_agent = NULL;
+                spin_unlock_irq(&cm.state_lock);
+                ib_unregister_mad_agent(cur_mad_agent);
                cm_remove_port_fs(port);
        }
        device_unregister(cm_dev->device);
        kfree(cm_dev);
 }
@@ -3989,6 +4082,7 @@ static int __init ib_cm_init(void)
        INIT_LIST_HEAD(&cm.device_list);
        rwlock_init(&cm.device_lock);
        spin_lock_init(&cm.lock);
+        spin_lock_init(&cm.state_lock);
        cm.listen_service_table = RB_ROOT;
        cm.listen_service_id = be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID);
        cm.remote_id_table = RB_ROOT;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 36bf50ebb187..2a6fc47a1dfb 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1094,47 +1094,47 @@ static void cma_save_ib_info(struct sockaddr *src_addr,
        }
 }
-static void cma_save_ip4_info(struct sockaddr *src_addr,
+static void cma_save_ip4_info(struct sockaddr_in *src_addr,
-                              struct sockaddr *dst_addr,
+                              struct sockaddr_in *dst_addr,
                              struct cma_hdr *hdr,
                              __be16 local_port)
 {
-        struct sockaddr_in *ip4;
        if (src_addr) {
-                ip4 = (struct sockaddr_in *)src_addr;
+                *src_addr = (struct sockaddr_in) {
-                ip4->sin_family = AF_INET;
+                        .sin_family = AF_INET,
-                ip4->sin_addr.s_addr = hdr->dst_addr.ip4.addr;
+                        .sin_addr.s_addr = hdr->dst_addr.ip4.addr,
-                ip4->sin_port = local_port;
+                        .sin_port = local_port,
+                };
        }
        if (dst_addr) {
-                ip4 = (struct sockaddr_in *)dst_addr;
+                *dst_addr = (struct sockaddr_in) {
-                ip4->sin_family = AF_INET;
+                        .sin_family = AF_INET,
-                ip4->sin_addr.s_addr = hdr->src_addr.ip4.addr;
+                        .sin_addr.s_addr = hdr->src_addr.ip4.addr,
-                ip4->sin_port = hdr->port;
+                        .sin_port = hdr->port,
+                };
        }
 }
-static void cma_save_ip6_info(struct sockaddr *src_addr,
+static void cma_save_ip6_info(struct sockaddr_in6 *src_addr,
-                              struct sockaddr *dst_addr,
+                              struct sockaddr_in6 *dst_addr,
                              struct cma_hdr *hdr,
                              __be16 local_port)
 {
-        struct sockaddr_in6 *ip6;
        if (src_addr) {
-                ip6 = (struct sockaddr_in6 *)src_addr;
+                *src_addr = (struct sockaddr_in6) {
-                ip6->sin6_family = AF_INET6;
+                        .sin6_family = AF_INET6,
-                ip6->sin6_addr = hdr->dst_addr.ip6;
+                        .sin6_addr = hdr->dst_addr.ip6,
-                ip6->sin6_port = local_port;
+                        .sin6_port = local_port,
+                };
        }
        if (dst_addr) {
-                ip6 = (struct sockaddr_in6 *)dst_addr;
+                *dst_addr = (struct sockaddr_in6) {
-                ip6->sin6_family = AF_INET6;
+                        .sin6_family = AF_INET6,
-                ip6->sin6_addr = hdr->src_addr.ip6;
+                        .sin6_addr = hdr->src_addr.ip6,
-                ip6->sin6_port = hdr->port;
+                        .sin6_port = hdr->port,
+                };
        }
 }
@@ -1159,10 +1159,12 @@ static int cma_save_ip_info(struct sockaddr *src_addr,
        switch (cma_get_ip_ver(hdr)) {
        case 4:
-                cma_save_ip4_info(src_addr, dst_addr, hdr, port);
+                cma_save_ip4_info((struct sockaddr_in *)src_addr,
+                                  (struct sockaddr_in *)dst_addr, hdr, port);
                break;
        case 6:
-                cma_save_ip6_info(src_addr, dst_addr, hdr, port);
+                cma_save_ip6_info((struct sockaddr_in6 *)src_addr,
+                                  (struct sockaddr_in6 *)dst_addr, hdr, port);
                break;
        default:
                return -EAFNOSUPPORT;
@@ -2436,6 +2438,18 @@ static int iboe_tos_to_sl(struct net_device *ndev, int tos)
        return 0;
 }
+static enum ib_gid_type cma_route_gid_type(enum rdma_network_type network_type,
+                                           unsigned long supported_gids,
+                                           enum ib_gid_type default_gid)
+{
+        if ((network_type == RDMA_NETWORK_IPV4 ||
+             network_type == RDMA_NETWORK_IPV6) &&
+            test_bit(IB_GID_TYPE_ROCE_UDP_ENCAP, &supported_gids))
+                return IB_GID_TYPE_ROCE_UDP_ENCAP;
+        return default_gid;
+}
 static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
 {
        struct rdma_route *route = &id_priv->id.route;
@@ -2461,6 +2475,8 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
        route->num_paths = 1;
        if (addr->dev_addr.bound_dev_if) {
+                unsigned long supported_gids;
                ndev = dev_get_by_index(&init_net, addr->dev_addr.bound_dev_if);
                if (!ndev) {
                        ret = -ENODEV;
@@ -2484,7 +2500,12 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
                route->path_rec->net = &init_net;
                route->path_rec->ifindex = ndev->ifindex;
-                route->path_rec->gid_type = id_priv->gid_type;
+                supported_gids = roce_gid_type_mask_support(id_priv->id.device,
+                                                            id_priv->id.port_num);
+                route->path_rec->gid_type =
+                        cma_route_gid_type(addr->dev_addr.network,
+                                           supported_gids,
+                                           id_priv->gid_type);
        }
        if (!ndev) {
                ret = -ENODEV;
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index c68746ce6624..84b4eff90395 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -94,6 +94,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
        unsigned long dma_attrs = 0;
        struct scatterlist *sg, *sg_list_start;
        int need_release = 0;
+        unsigned int gup_flags = FOLL_WRITE;
        if (dmasync)
                dma_attrs |= DMA_ATTR_WRITE_BARRIER;
@@ -174,7 +175,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
        cur_base = addr & PAGE_MASK;
-        if (npages == 0) {
+        if (npages == 0 || npages > UINT_MAX) {
                ret = -EINVAL;
                goto out;
        }
@@ -183,6 +184,9 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
        if (ret)
                goto out;
+        if (!umem->writable)
+                gup_flags |= FOLL_FORCE;
        need_release = 1;
        sg_list_start = umem->sg_head.sgl;
@@ -190,7 +194,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
                ret = get_user_pages(cur_base,
                                     min_t(unsigned long, npages,
                                           PAGE_SIZE / sizeof (struct page *)),
-                                     1, !umem->writable, page_list, vma_list);
+                                     gup_flags, page_list, vma_list);
                if (ret < 0)
                        goto out;
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 75077a018675..1f0fe3217f23 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -527,6 +527,7 @@ int ib_umem_odp_map_dma_pages(struct ib_umem *umem, u64 user_virt, u64 bcnt,
        u64 off;
        int j, k, ret = 0, start_idx, npages = 0;
        u64 base_virt_addr;
+        unsigned int flags = 0;
        if (access_mask == 0)
                return -EINVAL;
@@ -556,6 +557,9 @@ int ib_umem_odp_map_dma_pages(struct ib_umem *umem, u64 user_virt, u64 bcnt,
                goto out_put_task;
        }
+        if (access_mask & ODP_WRITE_ALLOWED_BIT)
+                flags |= FOLL_WRITE;
        start_idx = (user_virt - ib_umem_start(umem)) >> PAGE_SHIFT;
        k = start_idx;
@@ -574,8 +578,7 @@ int ib_umem_odp_map_dma_pages(struct ib_umem *umem, u64 user_virt, u64 bcnt,
                 */
                npages = get_user_pages_remote(owning_process, owning_mm,
                                user_virt, gup_num_pages,
-                                access_mask & ODP_WRITE_ALLOWED_BIT,
+                                flags, local_page_list, NULL);
-                                0, local_page_list, NULL);
                up_read(&owning_mm->mmap_sem);
                if (npages < 0)
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 0012fa58c105..44b1104eb168 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -262,12 +262,9 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
                        container_of(uobj, struct ib_uqp_object, uevent.uobject);
                idr_remove_uobj(&ib_uverbs_qp_idr, uobj);
-                if (qp != qp->real_qp) {
+                if (qp == qp->real_qp)
-                        ib_close_qp(qp);
-                } else {
                        ib_uverbs_detach_umcast(qp, uqp);
-                        ib_destroy_qp(qp);
+                ib_destroy_qp(qp);
-                }
                ib_uverbs_release_uevent(file, &uqp->uevent);
                kfree(uqp);
        }
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 867b8cf82be8..19c6477af19f 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -666,18 +666,6 @@ skip_cqe:
        return ret;
 }
-static void invalidate_mr(struct c4iw_dev *rhp, u32 rkey)
-{
-        struct c4iw_mr *mhp;
-        unsigned long flags;
-        spin_lock_irqsave(&rhp->lock, flags);
-        mhp = get_mhp(rhp, rkey >> 8);
-        if (mhp)
-                mhp->attr.state = 0;
-        spin_unlock_irqrestore(&rhp->lock, flags);
-}
 /*
 * Get one cq entry from c4iw and map it to openib.
 *
@@ -733,7 +721,7 @@ static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
                    CQE_OPCODE(&cqe) == FW_RI_SEND_WITH_SE_INV) {
                        wc->ex.invalidate_rkey = CQE_WRID_STAG(&cqe);
                        wc->wc_flags |= IB_WC_WITH_INVALIDATE;
-                        invalidate_mr(qhp->rhp, wc->ex.invalidate_rkey);
+                        c4iw_invalidate_mr(qhp->rhp, wc->ex.invalidate_rkey);
                }
        } else {
                switch (CQE_OPCODE(&cqe)) {
@@ -762,7 +750,8 @@ static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
                        /* Invalidate the MR if the fastreg failed */
                        if (CQE_STATUS(&cqe) != T4_ERR_SUCCESS)
-                                invalidate_mr(qhp->rhp, CQE_WRID_FR_STAG(&cqe));
+                                c4iw_invalidate_mr(qhp->rhp,
+                                                   CQE_WRID_FR_STAG(&cqe));
                        break;
                default:
                        printk(KERN_ERR MOD "Unexpected opcode %d "
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index 7e7f79e55006..4788e1a46fde 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -999,6 +999,6 @@ extern int db_coalescing_threshold;
 extern int use_dsgl;
 void c4iw_drain_rq(struct ib_qp *qp);
 void c4iw_drain_sq(struct ib_qp *qp);
+void c4iw_invalidate_mr(struct c4iw_dev *rhp, u32 rkey);
 #endif
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 80e27749420a..410408f886c1 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -770,3 +770,15 @@ int c4iw_dereg_mr(struct ib_mr *ib_mr)
        kfree(mhp);
        return 0;
 }
+void c4iw_invalidate_mr(struct c4iw_dev *rhp, u32 rkey)
+{
+        struct c4iw_mr *mhp;
+        unsigned long flags;
+        spin_lock_irqsave(&rhp->lock, flags);
+        mhp = get_mhp(rhp, rkey >> 8);
+        if (mhp)
+                mhp->attr.state = 0;
+        spin_unlock_irqrestore(&rhp->lock, flags);
+}
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index f57deba6717c..b7ac97b27c88 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -706,12 +706,8 @@ static int build_memreg(struct t4_sq *sq, union t4_wr *wqe,
        return 0;
 }
-static int build_inv_stag(struct c4iw_dev *dev, union t4_wr *wqe,
+static int build_inv_stag(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
-                          struct ib_send_wr *wr, u8 *len16)
 {
-        struct c4iw_mr *mhp = get_mhp(dev, wr->ex.invalidate_rkey >> 8);
-        mhp->attr.state = 0;
        wqe->inv.stag_inv = cpu_to_be32(wr->ex.invalidate_rkey);
        wqe->inv.r2 = 0;
        *len16 = DIV_ROUND_UP(sizeof wqe->inv, 16);
@@ -797,11 +793,13 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
        spin_lock_irqsave(&qhp->lock, flag);
        if (t4_wq_in_error(&qhp->wq)) {
                spin_unlock_irqrestore(&qhp->lock, flag);
+                *bad_wr = wr;
                return -EINVAL;
        }
        num_wrs = t4_sq_avail(&qhp->wq);
        if (num_wrs == 0) {
                spin_unlock_irqrestore(&qhp->lock, flag);
+                *bad_wr = wr;
                return -ENOMEM;
        }
        while (wr) {
@@ -840,10 +838,13 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                case IB_WR_RDMA_READ_WITH_INV:
                        fw_opcode = FW_RI_RDMA_READ_WR;
                        swsqe->opcode = FW_RI_READ_REQ;
-                        if (wr->opcode == IB_WR_RDMA_READ_WITH_INV)
+                        if (wr->opcode == IB_WR_RDMA_READ_WITH_INV) {
+                                c4iw_invalidate_mr(qhp->rhp,
+                                                   wr->sg_list[0].lkey);
                                fw_flags = FW_RI_RDMA_READ_INVALIDATE;
-                        else
+                        } else {
                                fw_flags = 0;
+                        }
                        err = build_rdma_read(wqe, wr, &len16);
                        if (err)
                                break;
@@ -876,7 +877,8 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                fw_flags |= FW_RI_LOCAL_FENCE_FLAG;
                        fw_opcode = FW_RI_INV_LSTAG_WR;
                        swsqe->opcode = FW_RI_LOCAL_INV;
-                        err = build_inv_stag(qhp->rhp, wqe, wr, &len16);
+                        err = build_inv_stag(wqe, wr, &len16);
+                        c4iw_invalidate_mr(qhp->rhp, wr->ex.invalidate_rkey);
                        break;
                default:
                        PDBG("%s post of type=%d TBD!\n", __func__,
@@ -934,11 +936,13 @@ int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
        spin_lock_irqsave(&qhp->lock, flag);
        if (t4_wq_in_error(&qhp->wq)) {
                spin_unlock_irqrestore(&qhp->lock, flag);
+                *bad_wr = wr;
                return -EINVAL;
        }
        num_wrs = t4_rq_avail(&qhp->wq);
        if (num_wrs == 0) {
                spin_unlock_irqrestore(&qhp->lock, flag);
+                *bad_wr = wr;
                return -ENOMEM;
        }
        while (wr) {
diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
index a26a9a0bfc41..67ea85a56945 100644
--- a/drivers/infiniband/hw/hfi1/affinity.c
+++ b/drivers/infiniband/hw/hfi1/affinity.c
@@ -775,75 +775,3 @@ void hfi1_put_proc_affinity(int cpu)
        }
        mutex_unlock(&affinity->lock);
 }
-int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
-                           size_t count)
-{
-        struct hfi1_affinity_node *entry;
-        cpumask_var_t mask;
-        int ret, i;
-        mutex_lock(&node_affinity.lock);
-        entry = node_affinity_lookup(dd->node);
-        if (!entry) {
-                ret = -EINVAL;
-                goto unlock;
-        }
-        ret = zalloc_cpumask_var(&mask, GFP_KERNEL);
-        if (!ret) {
-                ret = -ENOMEM;
-                goto unlock;
-        }
-        ret = cpulist_parse(buf, mask);
-        if (ret)
-                goto out;
-        if (!cpumask_subset(mask, cpu_online_mask) || cpumask_empty(mask)) {
-                dd_dev_warn(dd, "Invalid CPU mask\n");
-                ret = -EINVAL;
-                goto out;
-        }
-        /* reset the SDMA interrupt affinity details */
-        init_cpu_mask_set(&entry->def_intr);
-        cpumask_copy(&entry->def_intr.mask, mask);
-        /* Reassign the affinity for each SDMA interrupt. */
-        for (i = 0; i < dd->num_msix_entries; i++) {
-                struct hfi1_msix_entry *msix;
-                msix = &dd->msix_entries[i];
-                if (msix->type != IRQ_SDMA)
-                        continue;
-                ret = get_irq_affinity(dd, msix);
-                if (ret)
-                        break;
-        }
-out:
-        free_cpumask_var(mask);
-unlock:
-        mutex_unlock(&node_affinity.lock);
-        return ret ? ret : strnlen(buf, PAGE_SIZE);
-}
-int hfi1_get_sdma_affinity(struct hfi1_devdata *dd, char *buf)
-{
-        struct hfi1_affinity_node *entry;
-        mutex_lock(&node_affinity.lock);
-        entry = node_affinity_lookup(dd->node);
-        if (!entry) {
-                mutex_unlock(&node_affinity.lock);
-                return -EINVAL;
-        }
-        cpumap_print_to_pagebuf(true, buf, &entry->def_intr.mask);
-        mutex_unlock(&node_affinity.lock);
-        return strnlen(buf, PAGE_SIZE);
-}
diff --git a/drivers/infiniband/hw/hfi1/affinity.h b/drivers/infiniband/hw/hfi1/affinity.h
index b89ea3c0ee1a..42e63316afd1 100644
--- a/drivers/infiniband/hw/hfi1/affinity.h
+++ b/drivers/infiniband/hw/hfi1/affinity.h
@@ -102,10 +102,6 @@ int hfi1_get_proc_affinity(int);
 /* Release a CPU used by a user process. */
 void hfi1_put_proc_affinity(int);
-int hfi1_get_sdma_affinity(struct hfi1_devdata *dd, char *buf);
-int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
-                           size_t count);
 struct hfi1_affinity_node {
        int node;
        struct cpu_mask_set def_intr;
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 9bf5f23544d4..24d0820873cf 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -6301,19 +6301,8 @@ void set_up_vl15(struct hfi1_devdata *dd, u8 vau, u16 vl15buf)
        /* leave shared count at zero for both global and VL15 */
        write_global_credit(dd, vau, vl15buf, 0);
-        /* We may need some credits for another VL when sending packets
+        write_csr(dd, SEND_CM_CREDIT_VL15, (u64)vl15buf
-         * with the snoop interface. Dividing it down the middle for VL15
+                  << SEND_CM_CREDIT_VL15_DEDICATED_LIMIT_VL_SHIFT);
-         * and VL0 should suffice.
-         */
-        if (unlikely(dd->hfi1_snoop.mode_flag == HFI1_PORT_SNOOP_MODE)) {
-                write_csr(dd, SEND_CM_CREDIT_VL15, (u64)(vl15buf >> 1)
-                    << SEND_CM_CREDIT_VL15_DEDICATED_LIMIT_VL_SHIFT);
-                write_csr(dd, SEND_CM_CREDIT_VL, (u64)(vl15buf >> 1)
-                    << SEND_CM_CREDIT_VL_DEDICATED_LIMIT_VL_SHIFT);
-        } else {
-                write_csr(dd, SEND_CM_CREDIT_VL15, (u64)vl15buf
-                        << SEND_CM_CREDIT_VL15_DEDICATED_LIMIT_VL_SHIFT);
-        }
 }
 /*
@@ -9915,9 +9904,6 @@ static void set_lidlmc(struct hfi1_pportdata *ppd)
        u32 mask = ~((1U << ppd->lmc) - 1);
        u64 c1 = read_csr(ppd->dd, DCC_CFG_PORT_CONFIG1);
-        if (dd->hfi1_snoop.mode_flag)
-                dd_dev_info(dd, "Set lid/lmc while snooping");
        c1 &= ~(DCC_CFG_PORT_CONFIG1_TARGET_DLID_SMASK
                | DCC_CFG_PORT_CONFIG1_DLID_MASK_SMASK);
        c1 |= ((ppd->lid & DCC_CFG_PORT_CONFIG1_TARGET_DLID_MASK)
@@ -12112,7 +12098,7 @@ static void update_synth_timer(unsigned long opaque)
        mod_timer(&dd->synth_stats_timer, jiffies + HZ * SYNTH_CNT_TIME);
 }
-#define C_MAX_NAME 13 /* 12 chars + one for /0 */
+#define C_MAX_NAME 16 /* 15 chars + one for /0 */
 static int init_cntrs(struct hfi1_devdata *dd)
 {
        int i, rcv_ctxts, j;
@@ -14463,7 +14449,7 @@ struct hfi1_devdata *hfi1_init_dd(struct pci_dev *pdev,
         * Any error printing is already done by the init code.
         * On return, we have the chip mapped.
         */
-        ret = hfi1_pcie_ddinit(dd, pdev, ent);
+        ret = hfi1_pcie_ddinit(dd, pdev);
        if (ret < 0)
                goto bail_free;
@@ -14691,6 +14677,11 @@ struct hfi1_devdata *hfi1_init_dd(struct pci_dev *pdev,
        if (ret)
                goto bail_free_cntrs;
+        init_completion(&dd->user_comp);
+        /* The user refcount starts with one to inidicate an active device */
+        atomic_set(&dd->user_refcount, 1);
        goto bail;
 bail_free_rcverr:
diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
index 92345259a8f4..043fd21dc5f3 100644
--- a/drivers/infiniband/hw/hfi1/chip.h
+++ b/drivers/infiniband/hw/hfi1/chip.h
@@ -320,6 +320,9 @@
 /* DC_DC8051_CFG_MODE.GENERAL bits */
 #define DISABLE_SELF_GUID_CHECK 0x2
+/* Bad L2 frame error code */
+#define BAD_L2_ERR      0x6
 /*
 * Eager buffer minimum and maximum sizes supported by the hardware.
 * All power-of-two sizes in between are supported as well.
diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
index 6563e4d38b80..c5efff29c147 100644
--- a/drivers/infiniband/hw/hfi1/driver.c
+++ b/drivers/infiniband/hw/hfi1/driver.c
@@ -599,7 +599,6 @@ static void __prescan_rxq(struct hfi1_packet *packet)
                                         dd->rhf_offset;
                struct rvt_qp *qp;
                struct ib_header *hdr;
-                struct ib_other_headers *ohdr;
                struct rvt_dev_info *rdi = &dd->verbs_dev.rdi;
                u64 rhf = rhf_to_cpu(rhf_addr);
                u32 etype = rhf_rcv_type(rhf), qpn, bth1;
@@ -615,18 +614,21 @@ static void __prescan_rxq(struct hfi1_packet *packet)
                if (etype != RHF_RCV_TYPE_IB)
                        goto next;
-                hdr = hfi1_get_msgheader(dd, rhf_addr);
+                packet->hdr = hfi1_get_msgheader(dd, rhf_addr);
+                hdr = packet->hdr;
                lnh = be16_to_cpu(hdr->lrh[0]) & 3;
-                if (lnh == HFI1_LRH_BTH)
+                if (lnh == HFI1_LRH_BTH) {
-                        ohdr = &hdr->u.oth;
+                        packet->ohdr = &hdr->u.oth;
-                else if (lnh == HFI1_LRH_GRH)
+                } else if (lnh == HFI1_LRH_GRH) {
-                        ohdr = &hdr->u.l.oth;
+                        packet->ohdr = &hdr->u.l.oth;
-                else
+                        packet->rcv_flags |= HFI1_HAS_GRH;
+                } else {
                        goto next; /* just in case */
+                }
-                bth1 = be32_to_cpu(ohdr->bth[1]);
+                bth1 = be32_to_cpu(packet->ohdr->bth[1]);
                is_ecn = !!(bth1 & (HFI1_FECN_SMASK | HFI1_BECN_SMASK));
                if (!is_ecn)
@@ -646,7 +648,7 @@ static void __prescan_rxq(struct hfi1_packet *packet)
                /* turn off BECN, FECN */
                bth1 &= ~(HFI1_FECN_SMASK | HFI1_BECN_SMASK);
-                ohdr->bth[1] = cpu_to_be32(bth1);
+                packet->ohdr->bth[1] = cpu_to_be32(bth1);
 next:
                update_ps_mdata(&mdata, rcd);
        }
@@ -1360,12 +1362,25 @@ int process_receive_ib(struct hfi1_packet *packet)
 int process_receive_bypass(struct hfi1_packet *packet)
 {
+        struct hfi1_devdata *dd = packet->rcd->dd;
        if (unlikely(rhf_err_flags(packet->rhf)))
                handle_eflags(packet);
-        dd_dev_err(packet->rcd->dd,
+        dd_dev_err(dd,
                   "Bypass packets are not supported in normal operation. Dropping\n");
-        incr_cntr64(&packet->rcd->dd->sw_rcv_bypass_packet_errors);
+        incr_cntr64(&dd->sw_rcv_bypass_packet_errors);
+        if (!(dd->err_info_rcvport.status_and_code & OPA_EI_STATUS_SMASK)) {
+                u64 *flits = packet->ebuf;
+                if (flits && !(packet->rhf & RHF_LEN_ERR)) {
+                        dd->err_info_rcvport.packet_flit1 = flits[0];
+                        dd->err_info_rcvport.packet_flit2 =
+                                packet->tlen > sizeof(flits[0]) ? flits[1] : 0;
+                }
+                dd->err_info_rcvport.status_and_code |=
+                        (OPA_EI_STATUS_SMASK | BAD_L2_ERR);
+        }
        return RHF_RCV_CONTINUE;
 }
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 677efa0e8cd6..bd786b7bd30b 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -172,6 +172,9 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
                                               struct hfi1_devdata,
                                               user_cdev);
+        if (!atomic_inc_not_zero(&dd->user_refcount))
+                return -ENXIO;
        /* Just take a ref now. Not all opens result in a context assign */
        kobject_get(&dd->kobj);
@@ -183,11 +186,17 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
                fd->rec_cpu_num = -1; /* no cpu affinity by default */
                fd->mm = current->mm;
                atomic_inc(&fd->mm->mm_count);
-        }
+                fp->private_data = fd;
+        } else {
+                fp->private_data = NULL;
+                if (atomic_dec_and_test(&dd->user_refcount))
+                        complete(&dd->user_comp);
-        fp->private_data = fd;
+                return -ENOMEM;
+        }
-        return fd ? 0 : -ENOMEM;
+        return 0;
 }
 static long hfi1_file_ioctl(struct file *fp, unsigned int cmd,
@@ -798,6 +807,10 @@ static int hfi1_file_close(struct inode *inode, struct file *fp)
 done:
        mmdrop(fdata->mm);
        kobject_put(&dd->kobj);
+        if (atomic_dec_and_test(&dd->user_refcount))
+                complete(&dd->user_comp);
        kfree(fdata);
        return 0;
 }
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 7eef11b316ff..cc87fd4e534b 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -367,26 +367,6 @@ struct hfi1_packet {
        u8 etype;
 };
-/*
- * Private data for snoop/capture support.
- */
-struct hfi1_snoop_data {
-        int mode_flag;
-        struct cdev cdev;
-        struct device *class_dev;
-        /* protect snoop data */
-        spinlock_t snoop_lock;
-        struct list_head queue;
-        wait_queue_head_t waitq;
-        void *filter_value;
-        int (*filter_callback)(void *hdr, void *data, void *value);
-        u64 dcc_cfg; /* saved value of DCC Cfg register */
-};
-/* snoop mode_flag values */
-#define HFI1_PORT_SNOOP_MODE     1U
-#define HFI1_PORT_CAPTURE_MODE   2U
 struct rvt_sge_state;
 /*
@@ -613,8 +593,6 @@ struct hfi1_pportdata {
        struct mutex hls_lock;
        u32 host_link_state;
-        spinlock_t            sdma_alllock ____cacheline_aligned_in_smp;
        u32 lstate;     /* logical link state */
        /* these are the "32 bit" regs */
@@ -1104,8 +1082,6 @@ struct hfi1_devdata {
        char *portcntrnames;
        size_t portcntrnameslen;
-        struct hfi1_snoop_data hfi1_snoop;
        struct err_info_rcvport err_info_rcvport;
        struct err_info_constraint err_info_rcv_constraint;
        struct err_info_constraint err_info_xmit_constraint;
@@ -1141,8 +1117,8 @@ struct hfi1_devdata {
        rhf_rcv_function_ptr normal_rhf_rcv_functions[8];
        /*
-         * Handlers for outgoing data so that snoop/capture does not
+         * Capability to have different send engines simply by changing a
-         * have to have its hooks in the send path
+         * pointer value.
         */
        send_routine process_pio_send;
        send_routine process_dma_send;
@@ -1174,6 +1150,10 @@ struct hfi1_devdata {
        spinlock_t aspm_lock;
        /* Number of verbs contexts which have disabled ASPM */
        atomic_t aspm_disabled_cnt;
+        /* Keeps track of user space clients */
+        atomic_t user_refcount;
+        /* Used to wait for outstanding user space clients before dev removal */
+        struct completion user_comp;
        struct hfi1_affinity *affinity;
        struct rhashtable sdma_rht;
@@ -1221,8 +1201,6 @@ struct hfi1_devdata *hfi1_lookup(int unit);
 extern u32 hfi1_cpulist_count;
 extern unsigned long *hfi1_cpulist;
-extern unsigned int snoop_drop_send;
-extern unsigned int snoop_force_capture;
 int hfi1_init(struct hfi1_devdata *, int);
 int hfi1_count_units(int *npresentp, int *nupp);
 int hfi1_count_active_units(void);
@@ -1557,13 +1535,6 @@ void set_up_vl15(struct hfi1_devdata *dd, u8 vau, u16 vl15buf);
 void reset_link_credits(struct hfi1_devdata *dd);
 void assign_remote_cm_au_table(struct hfi1_devdata *dd, u8 vcu);
-int snoop_recv_handler(struct hfi1_packet *packet);
-int snoop_send_dma_handler(struct rvt_qp *qp, struct hfi1_pkt_state *ps,
-                           u64 pbc);
-int snoop_send_pio_handler(struct rvt_qp *qp, struct hfi1_pkt_state *ps,
-                           u64 pbc);
-void snoop_inline_pio_send(struct hfi1_devdata *dd, struct pio_buf *pbuf,
-                           u64 pbc, const void *from, size_t count);
 int set_buffer_control(struct hfi1_pportdata *ppd, struct buffer_control *bc);
 static inline struct hfi1_devdata *dd_from_ppd(struct hfi1_pportdata *ppd)
@@ -1763,8 +1734,7 @@ int qsfp_dump(struct hfi1_pportdata *ppd, char *buf, int len);
 int hfi1_pcie_init(struct pci_dev *, const struct pci_device_id *);
 void hfi1_pcie_cleanup(struct pci_dev *);
-int hfi1_pcie_ddinit(struct hfi1_devdata *, struct pci_dev *,
+int hfi1_pcie_ddinit(struct hfi1_devdata *, struct pci_dev *);
-                     const struct pci_device_id *);
 void hfi1_pcie_ddcleanup(struct hfi1_devdata *);
 void hfi1_pcie_flr(struct hfi1_devdata *);
 int pcie_speeds(struct hfi1_devdata *);
@@ -1799,8 +1769,6 @@ int kdeth_process_expected(struct hfi1_packet *packet);
 int kdeth_process_eager(struct hfi1_packet *packet);
 int process_receive_invalid(struct hfi1_packet *packet);
-extern rhf_rcv_function_ptr snoop_rhf_rcv_functions[8];
 void update_sge(struct rvt_sge_state *ss, u32 length);
 /* global module parameter variables */
@@ -1827,9 +1795,6 @@ extern struct mutex hfi1_mutex;
 #define DRIVER_NAME             "hfi1"
 #define HFI1_USER_MINOR_BASE     0
 #define HFI1_TRACE_MINOR         127
-#define HFI1_DIAGPKT_MINOR       128
-#define HFI1_DIAG_MINOR_BASE     129
-#define HFI1_SNOOP_CAPTURE_BASE  200
 #define HFI1_NMINORS             255
 #define PCI_VENDOR_ID_INTEL 0x8086
@@ -1848,7 +1813,13 @@ extern struct mutex hfi1_mutex;
 static inline u64 hfi1_pkt_default_send_ctxt_mask(struct hfi1_devdata *dd,
                                                  u16 ctxt_type)
 {
-        u64 base_sc_integrity =
+        u64 base_sc_integrity;
+        /* No integrity checks if HFI1_CAP_NO_INTEGRITY is set */
+        if (HFI1_CAP_IS_KSET(NO_INTEGRITY))
+                return 0;
+        base_sc_integrity =
        SEND_CTXT_CHECK_ENABLE_DISALLOW_BYPASS_BAD_PKT_LEN_SMASK
        | SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK
        | SEND_CTXT_CHECK_ENABLE_DISALLOW_TOO_LONG_BYPASS_PACKETS_SMASK
@@ -1863,7 +1834,6 @@ static inline u64 hfi1_pkt_default_send_ctxt_mask(struct hfi1_devdata *dd,
        | SEND_CTXT_CHECK_ENABLE_CHECK_VL_MAPPING_SMASK
        | SEND_CTXT_CHECK_ENABLE_CHECK_OPCODE_SMASK
        | SEND_CTXT_CHECK_ENABLE_CHECK_SLID_SMASK
-        | SEND_CTXT_CHECK_ENABLE_CHECK_JOB_KEY_SMASK
        | SEND_CTXT_CHECK_ENABLE_CHECK_VL_SMASK
        | SEND_CTXT_CHECK_ENABLE_CHECK_ENABLE_SMASK;
@@ -1872,18 +1842,23 @@ static inline u64 hfi1_pkt_default_send_ctxt_mask(struct hfi1_devdata *dd,
        else
                base_sc_integrity |= HFI1_PKT_KERNEL_SC_INTEGRITY;
-        if (is_ax(dd))
+        /* turn on send-side job key checks if !A0 */
-                /* turn off send-side job key checks - A0 */
+        if (!is_ax(dd))
-                return base_sc_integrity &
+                base_sc_integrity |= SEND_CTXT_CHECK_ENABLE_CHECK_JOB_KEY_SMASK;
-                       ~SEND_CTXT_CHECK_ENABLE_CHECK_JOB_KEY_SMASK;
        return base_sc_integrity;
 }
 static inline u64 hfi1_pkt_base_sdma_integrity(struct hfi1_devdata *dd)
 {
-        u64 base_sdma_integrity =
+        u64 base_sdma_integrity;
+        /* No integrity checks if HFI1_CAP_NO_INTEGRITY is set */
+        if (HFI1_CAP_IS_KSET(NO_INTEGRITY))
+                return 0;
+        base_sdma_integrity =
        SEND_DMA_CHECK_ENABLE_DISALLOW_BYPASS_BAD_PKT_LEN_SMASK
-        | SEND_DMA_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK
        | SEND_DMA_CHECK_ENABLE_DISALLOW_TOO_LONG_BYPASS_PACKETS_SMASK
        | SEND_DMA_CHECK_ENABLE_DISALLOW_TOO_LONG_IB_PACKETS_SMASK
        | SEND_DMA_CHECK_ENABLE_DISALLOW_BAD_PKT_LEN_SMASK
@@ -1895,14 +1870,18 @@ static inline u64 hfi1_pkt_base_sdma_integrity(struct hfi1_devdata *dd)
        | SEND_DMA_CHECK_ENABLE_CHECK_VL_MAPPING_SMASK
        | SEND_DMA_CHECK_ENABLE_CHECK_OPCODE_SMASK
        | SEND_DMA_CHECK_ENABLE_CHECK_SLID_SMASK
-        | SEND_DMA_CHECK_ENABLE_CHECK_JOB_KEY_SMASK
        | SEND_DMA_CHECK_ENABLE_CHECK_VL_SMASK
        | SEND_DMA_CHECK_ENABLE_CHECK_ENABLE_SMASK;
-        if (is_ax(dd))
+        if (!HFI1_CAP_IS_KSET(STATIC_RATE_CTRL))
-                /* turn off send-side job key checks - A0 */
+                base_sdma_integrity |=
-                return base_sdma_integrity &
+                SEND_DMA_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK;
-                       ~SEND_DMA_CHECK_ENABLE_CHECK_JOB_KEY_SMASK;
+        /* turn on send-side job key checks if !A0 */
+        if (!is_ax(dd))
+                base_sdma_integrity |=
+                        SEND_DMA_CHECK_ENABLE_CHECK_JOB_KEY_SMASK;
        return base_sdma_integrity;
 }
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index 60db61536fed..e3b5bc93bc70 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -144,6 +144,8 @@ int hfi1_create_ctxts(struct hfi1_devdata *dd)
                struct hfi1_ctxtdata *rcd;
                ppd = dd->pport + (i % dd->num_pports);
+                /* dd->rcd[i] gets assigned inside the callee */
                rcd = hfi1_create_ctxtdata(ppd, i, dd->node);
                if (!rcd) {
                        dd_dev_err(dd,
@@ -169,8 +171,6 @@ int hfi1_create_ctxts(struct hfi1_devdata *dd)
                if (!rcd->sc) {
                        dd_dev_err(dd,
                                   "Unable to allocate kernel send context, failing\n");
-                        dd->rcd[rcd->ctxt] = NULL;
-                        hfi1_free_ctxtdata(dd, rcd);
                        goto nomem;
                }
@@ -178,9 +178,6 @@ int hfi1_create_ctxts(struct hfi1_devdata *dd)
                if (ret < 0) {
                        dd_dev_err(dd,
                                   "Failed to setup kernel receive context, failing\n");
-                        sc_free(rcd->sc);
-                        dd->rcd[rcd->ctxt] = NULL;
-                        hfi1_free_ctxtdata(dd, rcd);
                        ret = -EFAULT;
                        goto bail;
                }
@@ -196,6 +193,10 @@ int hfi1_create_ctxts(struct hfi1_devdata *dd)
 nomem:
        ret = -ENOMEM;
 bail:
+        if (dd->rcd) {
+                for (i = 0; i < dd->num_rcv_contexts; ++i)
+                        hfi1_free_ctxtdata(dd, dd->rcd[i]);
+        }
        kfree(dd->rcd);
        dd->rcd = NULL;
        return ret;
@@ -216,7 +217,7 @@ struct hfi1_ctxtdata *hfi1_create_ctxtdata(struct hfi1_pportdata *ppd, u32 ctxt,
            dd->num_rcv_contexts - dd->first_user_ctxt)
                kctxt_ngroups = (dd->rcv_entries.nctxt_extra -
                                 (dd->num_rcv_contexts - dd->first_user_ctxt));
-        rcd = kzalloc(sizeof(*rcd), GFP_KERNEL);
+        rcd = kzalloc_node(sizeof(*rcd), GFP_KERNEL, numa);
        if (rcd) {
                u32 rcvtids, max_entries;
@@ -261,13 +262,6 @@ struct hfi1_ctxtdata *hfi1_create_ctxtdata(struct hfi1_pportdata *ppd, u32 ctxt,
                }
                rcd->eager_base = base * dd->rcv_entries.group_size;
-                /* Validate and initialize Rcv Hdr Q variables */
-                if (rcvhdrcnt % HDRQ_INCREMENT) {
-                        dd_dev_err(dd,
-                                   "ctxt%u: header queue count %d must be divisible by %lu\n",
-                                   rcd->ctxt, rcvhdrcnt, HDRQ_INCREMENT);
-                        goto bail;
-                }
                rcd->rcvhdrq_cnt = rcvhdrcnt;
                rcd->rcvhdrqentsize = hfi1_hdrq_entsize;
                /*
@@ -506,7 +500,6 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd,
        INIT_WORK(&ppd->qsfp_info.qsfp_work, qsfp_event);
        mutex_init(&ppd->hls_lock);
-        spin_lock_init(&ppd->sdma_alllock);
        spin_lock_init(&ppd->qsfp_info.qsfp_lock);
        ppd->qsfp_info.ppd = ppd;
@@ -1399,28 +1392,43 @@ static void postinit_cleanup(struct hfi1_devdata *dd)
        hfi1_free_devdata(dd);
 }
+static int init_validate_rcvhdrcnt(struct device *dev, uint thecnt)
+{
+        if (thecnt <= HFI1_MIN_HDRQ_EGRBUF_CNT) {
+                hfi1_early_err(dev, "Receive header queue count too small\n");
+                return -EINVAL;
+        }
+        if (thecnt > HFI1_MAX_HDRQ_EGRBUF_CNT) {
+                hfi1_early_err(dev,
+                               "Receive header queue count cannot be greater than %u\n",
+                               HFI1_MAX_HDRQ_EGRBUF_CNT);
+                return -EINVAL;
+        }
+        if (thecnt % HDRQ_INCREMENT) {
+                hfi1_early_err(dev, "Receive header queue count %d must be divisible by %lu\n",
+                               thecnt, HDRQ_INCREMENT);
+                return -EINVAL;
+        }
+        return 0;
+}
 static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        int ret = 0, j, pidx, initfail;
-        struct hfi1_devdata *dd = ERR_PTR(-EINVAL);
+        struct hfi1_devdata *dd;
        struct hfi1_pportdata *ppd;
        /* First, lock the non-writable module parameters */
        HFI1_CAP_LOCK();
        /* Validate some global module parameters */
-        if (rcvhdrcnt <= HFI1_MIN_HDRQ_EGRBUF_CNT) {
+        ret = init_validate_rcvhdrcnt(&pdev->dev, rcvhdrcnt);
-                hfi1_early_err(&pdev->dev, "Header queue  count too small\n");
+        if (ret)
-                ret = -EINVAL;
-                goto bail;
-        }
-        if (rcvhdrcnt > HFI1_MAX_HDRQ_EGRBUF_CNT) {
-                hfi1_early_err(&pdev->dev,
-                               "Receive header queue count cannot be greater than %u\n",
-                               HFI1_MAX_HDRQ_EGRBUF_CNT);
-                ret = -EINVAL;
                goto bail;
-        }
        /* use the encoding function as a sanitization check */
        if (!encode_rcv_header_entry_size(hfi1_hdrq_entsize)) {
                hfi1_early_err(&pdev->dev, "Invalid HdrQ Entry size %u\n",
@@ -1461,26 +1469,25 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (ret)
                goto bail;
-        /*
+        if (!(ent->device == PCI_DEVICE_ID_INTEL0 ||
-         * Do device-specific initialization, function table setup, dd
+              ent->device == PCI_DEVICE_ID_INTEL1)) {
-         * allocation, etc.
-         */
-        switch (ent->device) {
-        case PCI_DEVICE_ID_INTEL0:
-        case PCI_DEVICE_ID_INTEL1:
-                dd = hfi1_init_dd(pdev, ent);
-                break;
-        default:
                hfi1_early_err(&pdev->dev,
                               "Failing on unknown Intel deviceid 0x%x\n",
                               ent->device);
                ret = -ENODEV;
+                goto clean_bail;
        }
-        if (IS_ERR(dd))
+        /*
+         * Do device-specific initialization, function table setup, dd
+         * allocation, etc.
+         */
+        dd = hfi1_init_dd(pdev, ent);
+        if (IS_ERR(dd)) {
                ret = PTR_ERR(dd);
-        if (ret)
                goto clean_bail; /* error already printed */
+        }
        ret = create_workqueues(dd);
        if (ret)
@@ -1538,12 +1545,31 @@ bail:
        return ret;
 }
+static void wait_for_clients(struct hfi1_devdata *dd)
+{
+        /*
+         * Remove the device init value and complete the device if there is
+         * no clients or wait for active clients to finish.
+         */
+        if (atomic_dec_and_test(&dd->user_refcount))
+                complete(&dd->user_comp);
+        wait_for_completion(&dd->user_comp);
+}
 static void remove_one(struct pci_dev *pdev)
 {
        struct hfi1_devdata *dd = pci_get_drvdata(pdev);
        /* close debugfs files before ib unregister */
        hfi1_dbg_ibdev_exit(&dd->verbs_dev);
+        /* remove the /dev hfi1 interface */
+        hfi1_device_remove(dd);
+        /* wait for existing user space clients to finish */
+        wait_for_clients(dd);
        /* unregister from IB core */
        hfi1_unregister_ib_device(dd);
@@ -1558,8 +1584,6 @@ static void remove_one(struct pci_dev *pdev)
        /* wait until all of our (qsfp) queue_work() calls complete */
        flush_workqueue(ib_wq);
-        hfi1_device_remove(dd);
        postinit_cleanup(dd);
 }
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 89c68da1c273..4ac8f330c5cb 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -157,8 +157,7 @@ void hfi1_pcie_cleanup(struct pci_dev *pdev)
 * fields required to re-initialize after a chip reset, or for
 * various other purposes
 */
-int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev,
+int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev)
-                     const struct pci_device_id *ent)
 {
        unsigned long len;
        resource_size_t addr;
diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
index 50a3a36d9363..d89b8745d4c1 100644
--- a/drivers/infiniband/hw/hfi1/pio.c
+++ b/drivers/infiniband/hw/hfi1/pio.c
@@ -668,19 +668,12 @@ void sc_set_cr_threshold(struct send_context *sc, u32 new_threshold)
 void set_pio_integrity(struct send_context *sc)
 {
        struct hfi1_devdata *dd = sc->dd;
-        u64 reg = 0;
        u32 hw_context = sc->hw_context;
        int type = sc->type;
-        /*
+        write_kctxt_csr(dd, hw_context,
-         * No integrity checks if HFI1_CAP_NO_INTEGRITY is set, or if
+                        SC(CHECK_ENABLE),
-         * we're snooping.
+                        hfi1_pkt_default_send_ctxt_mask(dd, type));
-         */
-        if (likely(!HFI1_CAP_IS_KSET(NO_INTEGRITY)) &&
-            dd->hfi1_snoop.mode_flag != HFI1_PORT_SNOOP_MODE)
-                reg = hfi1_pkt_default_send_ctxt_mask(dd, type);
-        write_kctxt_csr(dd, hw_context, SC(CHECK_ENABLE), reg);
 }
 static u32 get_buffers_allocated(struct send_context *sc)
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 8bc5013f39a1..83198a8a8797 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -89,7 +89,7 @@ void hfi1_add_rnr_timer(struct rvt_qp *qp, u32 to)
        lockdep_assert_held(&qp->s_lock);
        qp->s_flags |= RVT_S_WAIT_RNR;
-        qp->s_timer.expires = jiffies + usecs_to_jiffies(to);
+        priv->s_rnr_timer.expires = jiffies + usecs_to_jiffies(to);
        add_timer(&priv->s_rnr_timer);
 }
diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
index fd39bcaa062d..9cbe52d21077 100644
--- a/drivers/infiniband/hw/hfi1/sdma.c
+++ b/drivers/infiniband/hw/hfi1/sdma.c
@@ -2009,11 +2009,6 @@ static void sdma_hw_start_up(struct sdma_engine *sde)
        write_sde_csr(sde, SD(ENG_ERR_CLEAR), reg);
 }
-#define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \
-(r &= ~SEND_DMA_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
-#define SET_STATIC_RATE_CONTROL_SMASK(r) \
-(r |= SEND_DMA_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
 /*
 * set_sdma_integrity
 *
@@ -2022,19 +2017,9 @@ static void sdma_hw_start_up(struct sdma_engine *sde)
 static void set_sdma_integrity(struct sdma_engine *sde)
 {
        struct hfi1_devdata *dd = sde->dd;
-        u64 reg;
-        if (unlikely(HFI1_CAP_IS_KSET(NO_INTEGRITY)))
-                return;
-        reg = hfi1_pkt_base_sdma_integrity(dd);
-        if (HFI1_CAP_IS_KSET(STATIC_RATE_CTRL))
-                CLEAR_STATIC_RATE_CONTROL_SMASK(reg);
-        else
-                SET_STATIC_RATE_CONTROL_SMASK(reg);
-        write_sde_csr(sde, SD(CHECK_ENABLE), reg);
+        write_sde_csr(sde, SD(CHECK_ENABLE),
+                      hfi1_pkt_base_sdma_integrity(dd));
 }
 static void init_sdma_regs(
diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c
index edba22461a9c..919a5474e651 100644
--- a/drivers/infiniband/hw/hfi1/sysfs.c
+++ b/drivers/infiniband/hw/hfi1/sysfs.c
@@ -49,7 +49,6 @@
 #include "hfi.h"
 #include "mad.h"
 #include "trace.h"
-#include "affinity.h"
 /*
 * Start of per-port congestion control structures and support code
@@ -623,27 +622,6 @@ static ssize_t show_tempsense(struct device *device,
        return ret;
 }
-static ssize_t show_sdma_affinity(struct device *device,
-                                  struct device_attribute *attr, char *buf)
-{
-        struct hfi1_ibdev *dev =
-                container_of(device, struct hfi1_ibdev, rdi.ibdev.dev);
-        struct hfi1_devdata *dd = dd_from_dev(dev);
-        return hfi1_get_sdma_affinity(dd, buf);
-}
-static ssize_t store_sdma_affinity(struct device *device,
-                                   struct device_attribute *attr,
-                                   const char *buf, size_t count)
-{
-        struct hfi1_ibdev *dev =
-                container_of(device, struct hfi1_ibdev, rdi.ibdev.dev);
-        struct hfi1_devdata *dd = dd_from_dev(dev);
-        return hfi1_set_sdma_affinity(dd, buf, count);
-}
 /*
 * end of per-unit (or driver, in some cases, but replicated
 * per unit) functions
@@ -658,8 +636,6 @@ static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL);
 static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL);
 static DEVICE_ATTR(tempsense, S_IRUGO, show_tempsense, NULL);
 static DEVICE_ATTR(chip_reset, S_IWUSR, NULL, store_chip_reset);
-static DEVICE_ATTR(sdma_affinity, S_IWUSR | S_IRUGO, show_sdma_affinity,
-                   store_sdma_affinity);
 static struct device_attribute *hfi1_attributes[] = {
        &dev_attr_hw_rev,
@@ -670,7 +646,6 @@ static struct device_attribute *hfi1_attributes[] = {
        &dev_attr_boardversion,
        &dev_attr_tempsense,
        &dev_attr_chip_reset,
-        &dev_attr_sdma_affinity,
 };
 int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num,
diff --git a/drivers/infiniband/hw/hfi1/trace_rx.h b/drivers/infiniband/hw/hfi1/trace_rx.h
index 11e02b228922..f77e59fb43fe 100644
--- a/drivers/infiniband/hw/hfi1/trace_rx.h
+++ b/drivers/infiniband/hw/hfi1/trace_rx.h
@@ -253,66 +253,6 @@ TRACE_EVENT(hfi1_mmu_invalidate,
                      )
            );
-#define SNOOP_PRN \
-        "slid %.4x dlid %.4x qpn 0x%.6x opcode 0x%.2x,%s " \
-        "svc lvl %d pkey 0x%.4x [header = %d bytes] [data = %d bytes]"
-TRACE_EVENT(snoop_capture,
-            TP_PROTO(struct hfi1_devdata *dd,
-                     int hdr_len,
-                     struct ib_header *hdr,
-                     int data_len,
-                     void *data),
-            TP_ARGS(dd, hdr_len, hdr, data_len, data),
-            TP_STRUCT__entry(
-                             DD_DEV_ENTRY(dd)
-                             __field(u16, slid)
-                             __field(u16, dlid)
-                             __field(u32, qpn)
-                             __field(u8, opcode)
-                             __field(u8, sl)
-                             __field(u16, pkey)
-                             __field(u32, hdr_len)
-                             __field(u32, data_len)
-                             __field(u8, lnh)
-                             __dynamic_array(u8, raw_hdr, hdr_len)
-                             __dynamic_array(u8, raw_pkt, data_len)
-                             ),
-            TP_fast_assign(
-                struct ib_other_headers *ohdr;
-                __entry->lnh = (u8)(be16_to_cpu(hdr->lrh[0]) & 3);
-                if (__entry->lnh == HFI1_LRH_BTH)
-                ohdr = &hdr->u.oth;
-                else
-                ohdr = &hdr->u.l.oth;
-                DD_DEV_ASSIGN(dd);
-                __entry->slid = be16_to_cpu(hdr->lrh[3]);
-                __entry->dlid = be16_to_cpu(hdr->lrh[1]);
-                __entry->qpn = be32_to_cpu(ohdr->bth[1]) & RVT_QPN_MASK;
-                __entry->opcode = (be32_to_cpu(ohdr->bth[0]) >> 24) & 0xff;
-                __entry->sl = (u8)(be16_to_cpu(hdr->lrh[0]) >> 4) & 0xf;
-                __entry->pkey = be32_to_cpu(ohdr->bth[0]) & 0xffff;
-                __entry->hdr_len = hdr_len;
-                __entry->data_len = data_len;
-                memcpy(__get_dynamic_array(raw_hdr), hdr, hdr_len);
-                memcpy(__get_dynamic_array(raw_pkt), data, data_len);
-                ),
-            TP_printk(
-                "[%s] " SNOOP_PRN,
-                __get_str(dev),
-                __entry->slid,
-                __entry->dlid,
-                __entry->qpn,
-                __entry->opcode,
-                show_ib_opcode(__entry->opcode),
-                __entry->sl,
-                __entry->pkey,
-                __entry->hdr_len,
-                __entry->data_len
-                )
-);
 #endif /* __HFI1_TRACE_RX_H */
 #undef TRACE_INCLUDE_PATH
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index a761f804111e..77697d690f3e 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -1144,7 +1144,7 @@ static int pin_vector_pages(struct user_sdma_request *req,
        rb_node = hfi1_mmu_rb_extract(pq->handler,
                                      (unsigned long)iovec->iov.iov_base,
                                      iovec->iov.iov_len);
-        if (rb_node && !IS_ERR(rb_node))
+        if (rb_node)
                node = container_of(rb_node, struct sdma_mmu_node, rb);
        else
                rb_node = NULL;
diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
index 5fc623362731..b9bf0759f10a 100644
--- a/drivers/infiniband/hw/mlx4/ah.c
+++ b/drivers/infiniband/hw/mlx4/ah.c
@@ -102,7 +102,10 @@ static struct ib_ah *create_iboe_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr
        if (vlan_tag < 0x1000)
                vlan_tag |= (ah_attr->sl & 7) << 13;
        ah->av.eth.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24));
-        ah->av.eth.gid_index = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index);
+        ret = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index);
+        if (ret < 0)
+                return ERR_PTR(ret);
+        ah->av.eth.gid_index = ret;
        ah->av.eth.vlan = cpu_to_be16(vlan_tag);
        ah->av.eth.hop_limit = ah_attr->grh.hop_limit;
        if (ah_attr->static_rate) {
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 1ea686b9e0f9..6a0fec357dae 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -253,11 +253,14 @@ struct ib_cq *mlx4_ib_create_cq(struct ib_device *ibdev,
        if (context)
                if (ib_copy_to_udata(udata, &cq->mcq.cqn, sizeof (__u32))) {
                        err = -EFAULT;
-                        goto err_dbmap;
+                        goto err_cq_free;
                }
        return &cq->ibcq;
+err_cq_free:
+        mlx4_cq_free(dev->dev, &cq->mcq);
 err_dbmap:
        if (context)
                mlx4_ib_db_unmap_user(to_mucontext(context), &cq->db);
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 79d017baf6f4..fcd04b881ec1 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -932,8 +932,7 @@ struct ib_cq *mlx5_ib_create_cq(struct ib_device *ibdev,
                if (err)
                        goto err_create;
        } else {
-                /* for now choose 64 bytes till we have a proper interface */
+                cqe_size = cache_line_size() == 128 ? 128 : 64;
-                cqe_size = 64;
                err = create_cq_kernel(dev, cq, entries, cqe_size, &cqb,
                                       &index, &inlen);
                if (err)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 22174774dbb8..32b09f059c84 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1019,7 +1019,7 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
        resp.qp_tab_size = 1 << MLX5_CAP_GEN(dev->mdev, log_max_qp);
        if (mlx5_core_is_pf(dev->mdev) && MLX5_CAP_GEN(dev->mdev, bf))
                resp.bf_reg_size = 1 << MLX5_CAP_GEN(dev->mdev, log_bf_reg_size);
-        resp.cache_line_size = L1_CACHE_BYTES;
+        resp.cache_line_size = cache_line_size();
        resp.max_sq_desc_sz = MLX5_CAP_GEN(dev->mdev, max_wqe_sz_sq);
        resp.max_rq_desc_sz = MLX5_CAP_GEN(dev->mdev, max_wqe_sz_rq);
        resp.max_send_wqebb = 1 << MLX5_CAP_GEN(dev->mdev, log_max_qp_sz);
@@ -2311,14 +2311,14 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context,
 {
        struct mlx5_ib_dev *ibdev = (struct mlx5_ib_dev *)context;
        struct ib_event ibev;
+        bool fatal = false;
        u8 port = 0;
        switch (event) {
        case MLX5_DEV_EVENT_SYS_ERROR:
-                ibdev->ib_active = false;
                ibev.event = IB_EVENT_DEVICE_FATAL;
                mlx5_ib_handle_internal_error(ibdev);
+                fatal = true;
                break;
        case MLX5_DEV_EVENT_PORT_UP:
@@ -2370,6 +2370,9 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context,
        if (ibdev->ib_active)
                ib_dispatch_event(&ibev);
+        if (fatal)
+                ibdev->ib_active = false;
 }
 static void get_ext_port_caps(struct mlx5_ib_dev *dev)
@@ -3115,7 +3118,7 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
        }
        err = init_node_data(dev);
        if (err)
-                goto err_dealloc;
+                goto err_free_port;
        mutex_init(&dev->flow_db.lock);
        mutex_init(&dev->cap_mask_mutex);
@@ -3125,7 +3128,7 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
        if (ll == IB_LINK_LAYER_ETHERNET) {
                err = mlx5_enable_roce(dev);
                if (err)
-                        goto err_dealloc;
+                        goto err_free_port;
        }
        err = create_dev_resources(&dev->devr);
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index dcdcd195fe53..7d689903c87c 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -626,6 +626,8 @@ struct mlx5_ib_dev {
        struct mlx5_ib_resources        devr;
        struct mlx5_mr_cache            cache;
        struct timer_list               delay_timer;
+        /* Prevents soft lock on massive reg MRs */
+        struct mutex                    slow_path_mutex;
        int                             fill_delay;
 #ifdef CONFIG_INFINIBAND_ON_DEMAND_PAGING
        struct ib_odp_caps      odp_caps;
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index d4ad672b905b..4e9012463c37 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -610,6 +610,7 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
        int err;
        int i;
+        mutex_init(&dev->slow_path_mutex);
        cache->wq = alloc_ordered_workqueue("mkey_cache", WQ_MEM_RECLAIM);
        if (!cache->wq) {
                mlx5_ib_warn(dev, "failed to create work queue\n");
@@ -1182,9 +1183,12 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
                goto error;
        }
-        if (!mr)
+        if (!mr) {
+                mutex_lock(&dev->slow_path_mutex);
                mr = reg_create(NULL, pd, virt_addr, length, umem, ncont,
                                page_shift, access_flags);
+                mutex_unlock(&dev->slow_path_mutex);
+        }
        if (IS_ERR(mr)) {
                err = PTR_ERR(mr);
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 41f4c2afbcdd..d1e921816bfe 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -52,7 +52,6 @@ enum {
 enum {
        MLX5_IB_SQ_STRIDE       = 6,
-        MLX5_IB_CACHE_LINE_SIZE = 64,
 };
 static const u32 mlx5_ib_opcode[] = {
@@ -2052,8 +2051,8 @@ struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd,
                mlx5_ib_dbg(dev, "ib qpnum 0x%x, mlx qpn 0x%x, rcqn 0x%x, scqn 0x%x\n",
                            qp->ibqp.qp_num, qp->trans_qp.base.mqp.qpn,
-                            to_mcq(init_attr->recv_cq)->mcq.cqn,
+                            init_attr->recv_cq ? to_mcq(init_attr->recv_cq)->mcq.cqn : -1,
-                            to_mcq(init_attr->send_cq)->mcq.cqn);
+                            init_attr->send_cq ? to_mcq(init_attr->send_cq)->mcq.cqn : -1);
                qp->trans_qp.xrcdn = xrcdn;
@@ -4815,6 +4814,14 @@ struct ib_rwq_ind_table *mlx5_ib_create_rwq_ind_table(struct ib_device *device,
                                 udata->inlen))
                return ERR_PTR(-EOPNOTSUPP);
+        if (init_attr->log_ind_tbl_size >
+            MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)) {
+                mlx5_ib_dbg(dev, "log_ind_tbl_size = %d is bigger than supported = %d\n",
+                            init_attr->log_ind_tbl_size,
+                            MLX5_CAP_GEN(dev->mdev, log_max_rqt_size));
+                return ERR_PTR(-EINVAL);
+        }
        min_resp_len = offsetof(typeof(resp), reserved) + sizeof(resp.reserved);
        if (udata->outlen && udata->outlen < min_resp_len)
                return ERR_PTR(-EINVAL);
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 6c00d04b8b28..c6fe89d79248 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -472,7 +472,7 @@ int mthca_map_user_db(struct mthca_dev *dev, struct mthca_uar *uar,
                goto out;
        }
-        ret = get_user_pages(uaddr & PAGE_MASK, 1, 1, 0, pages, NULL);
+        ret = get_user_pages(uaddr & PAGE_MASK, 1, FOLL_WRITE, pages, NULL);
        if (ret < 0)
                goto out;
diff --git a/drivers/infiniband/hw/qedr/Kconfig b/drivers/infiniband/hw/qedr/Kconfig
index 7c06d85568d4..6c9f3923e838 100644
--- a/drivers/infiniband/hw/qedr/Kconfig
+++ b/drivers/infiniband/hw/qedr/Kconfig
@@ -2,6 +2,7 @@ config INFINIBAND_QEDR
        tristate "QLogic RoCE driver"
        depends on 64BIT && QEDE
        select QED_LL2
+        select QED_RDMA
        ---help---
          This driver provides low-level InfiniBand over Ethernet
          support for QLogic QED host channel adapters (HCAs).
diff --git a/drivers/infiniband/hw/qib/qib_user_pages.c b/drivers/infiniband/hw/qib/qib_user_pages.c
index 2d2b94fd3633..75f08624ac05 100644
--- a/drivers/infiniband/hw/qib/qib_user_pages.c
+++ b/drivers/infiniband/hw/qib/qib_user_pages.c
@@ -67,7 +67,8 @@ static int __qib_get_user_pages(unsigned long start_page, size_t num_pages,
        for (got = 0; got < num_pages; got += ret) {
                ret = get_user_pages(start_page + got * PAGE_SIZE,
-                                     num_pages - got, 1, 1,
+                                     num_pages - got,
+                                     FOLL_WRITE | FOLL_FORCE,
                                     p + got, NULL);
                if (ret < 0)
                        goto bail_release;
diff --git a/drivers/infiniband/hw/usnic/usnic_uiom.c b/drivers/infiniband/hw/usnic/usnic_uiom.c
index a0b6ebee4d8a..1ccee6ea5bc3 100644
--- a/drivers/infiniband/hw/usnic/usnic_uiom.c
+++ b/drivers/infiniband/hw/usnic/usnic_uiom.c
@@ -111,6 +111,7 @@ static int usnic_uiom_get_pages(unsigned long addr, size_t size, int writable,
        int i;
        int flags;
        dma_addr_t pa;
+        unsigned int gup_flags;
        if (!can_do_mlock())
                return -EPERM;
@@ -135,6 +136,8 @@ static int usnic_uiom_get_pages(unsigned long addr, size_t size, int writable,
        flags = IOMMU_READ | IOMMU_CACHE;
        flags |= (writable) ? IOMMU_WRITE : 0;
+        gup_flags = FOLL_WRITE;
+        gup_flags |= (writable) ? 0 : FOLL_FORCE;
        cur_base = addr & PAGE_MASK;
        ret = 0;
@@ -142,7 +145,7 @@ static int usnic_uiom_get_pages(unsigned long addr, size_t size, int writable,
                ret = get_user_pages(cur_base,
                                        min_t(unsigned long, npages,
                                        PAGE_SIZE / sizeof(struct page *)),
-                                        1, !writable, page_list, NULL);
+                                        gup_flags, page_list, NULL);
                if (ret < 0)
                        goto out;
diff --git a/drivers/infiniband/sw/rdmavt/dma.c b/drivers/infiniband/sw/rdmavt/dma.c
index 01f71caa3ac4..f2cefb0d9180 100644
--- a/drivers/infiniband/sw/rdmavt/dma.c
+++ b/drivers/infiniband/sw/rdmavt/dma.c
@@ -90,9 +90,6 @@ static u64 rvt_dma_map_page(struct ib_device *dev, struct page *page,
        if (WARN_ON(!valid_dma_direction(direction)))
                return BAD_DMA_ADDRESS;
-        if (offset + size > PAGE_SIZE)
-                return BAD_DMA_ADDRESS;
        addr = (u64)page_address(page);
        if (addr)
                addr += offset;
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index b8258e4f0aea..ffff5a54cb34 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -243,10 +243,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,
 {
        int err;
        struct socket *sock;
-        struct udp_port_cfg udp_cfg;
+        struct udp_port_cfg udp_cfg = {0};
-        struct udp_tunnel_sock_cfg tnl_cfg;
+        struct udp_tunnel_sock_cfg tnl_cfg = {0};
-        memset(&udp_cfg, 0, sizeof(udp_cfg));
        if (ipv6) {
                udp_cfg.family = AF_INET6;
@@ -264,10 +262,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,
                return ERR_PTR(err);
        }
-        tnl_cfg.sk_user_data = NULL;
        tnl_cfg.encap_type = 1;
        tnl_cfg.encap_rcv = rxe_udp_encap_recv;
-        tnl_cfg.encap_destroy = NULL;
        /* Setup UDP tunnel */
        setup_udp_tunnel_sock(net, sock, &tnl_cfg);
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index b8036cfbce04..c3e60e4bde6e 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -522,6 +522,7 @@ static void rxe_qp_reset(struct rxe_qp *qp)
        if (qp->sq.queue) {
                __rxe_do_task(&qp->comp.task);
                __rxe_do_task(&qp->req.task);
+                rxe_queue_reset(qp->sq.queue);
        }
        /* cleanup attributes */
@@ -573,6 +574,7 @@ void rxe_qp_error(struct rxe_qp *qp)
 {
        qp->req.state = QP_STATE_ERROR;
        qp->resp.state = QP_STATE_ERROR;
+        qp->attr.qp_state = IB_QPS_ERR;
        /* drain work and packet queues */
        rxe_run_task(&qp->resp.task, 1);
diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c
index 08274254eb88..d14bf496d62d 100644
--- a/drivers/infiniband/sw/rxe/rxe_queue.c
+++ b/drivers/infiniband/sw/rxe/rxe_queue.c
@@ -84,6 +84,15 @@ err1:
        return -EINVAL;
 }
+inline void rxe_queue_reset(struct rxe_queue *q)
+{
+        /* queue is comprised from header and the memory
+         * of the actual queue. See "struct rxe_queue_buf" in rxe_queue.h
+         * reset only the queue itself and not the management header
+         */
+        memset(q->buf->data, 0, q->buf_size - sizeof(struct rxe_queue_buf));
+}
 struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe,
                                 int *num_elem,
                                 unsigned int elem_size)
diff --git a/drivers/infiniband/sw/rxe/rxe_queue.h b/drivers/infiniband/sw/rxe/rxe_queue.h
index 239fd609c31e..8c8641c87817 100644
--- a/drivers/infiniband/sw/rxe/rxe_queue.h
+++ b/drivers/infiniband/sw/rxe/rxe_queue.h
@@ -84,6 +84,8 @@ int do_mmap_info(struct rxe_dev *rxe,
                 size_t buf_size,
                 struct rxe_mmap_info **ip_p);
+void rxe_queue_reset(struct rxe_queue *q);
 struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe,
                                 int *num_elem,
                                 unsigned int elem_size);
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 832846b73ea0..22bd9630dcd9 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -696,7 +696,8 @@ next_wqe:
                                                       qp->req.wqe_index);
                        wqe->state = wqe_state_done;
                        wqe->status = IB_WC_SUCCESS;
-                        goto complete;
+                        __rxe_do_task(&qp->comp.task);
+                        return 0;
                }
                payload = mtu;
        }
@@ -745,13 +746,17 @@ err:
        wqe->status = IB_WC_LOC_PROT_ERR;
        wqe->state = wqe_state_error;
-complete:
+        /*
-        if (qp_type(qp) != IB_QPT_RC) {
+         * IBA Spec. Section 10.7.3.1 SIGNALED COMPLETIONS
-                while (rxe_completer(qp) == 0)
+         * ---------8<---------8<-------------
-                        ;
+         * ...Note that if a completion error occurs, a Work Completion
-        }
+         * will always be generated, even if the signaling
+         * indicator requests an Unsignaled Completion.
-        return 0;
+         * ---------8<---------8<-------------
+         */
+        wqe->wr.send_flags |= IB_SEND_SIGNALED;
+        __rxe_do_task(&qp->comp.task);
+        return -EAGAIN;
 exit:
        return -EAGAIN;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 7b8d2d9e2263..da12717a3eb7 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -63,6 +63,8 @@ enum ipoib_flush_level {
 enum {
        IPOIB_ENCAP_LEN           = 4,
+        IPOIB_PSEUDO_LEN          = 20,
+        IPOIB_HARD_LEN            = IPOIB_ENCAP_LEN + IPOIB_PSEUDO_LEN,
        IPOIB_UD_HEAD_SIZE        = IB_GRH_BYTES + IPOIB_ENCAP_LEN,
        IPOIB_UD_RX_SG            = 2, /* max buffer needed for 4K mtu */
@@ -134,15 +136,21 @@ struct ipoib_header {
        u16     reserved;
 };
-struct ipoib_cb {
+struct ipoib_pseudo_header {
-        struct qdisc_skb_cb     qdisc_cb;
+        u8      hwaddr[INFINIBAND_ALEN];
-        u8                      hwaddr[INFINIBAND_ALEN];
 };
-static inline struct ipoib_cb *ipoib_skb_cb(const struct sk_buff *skb)
+static inline void skb_add_pseudo_hdr(struct sk_buff *skb)
 {
-        BUILD_BUG_ON(sizeof(skb->cb) < sizeof(struct ipoib_cb));
+        char *data = skb_push(skb, IPOIB_PSEUDO_LEN);
-        return (struct ipoib_cb *)skb->cb;
+        /*
+         * only the ipoib header is present now, make room for a dummy
+         * pseudo header and set skb field accordingly
+         */
+        memset(data, 0, IPOIB_PSEUDO_LEN);
+        skb_reset_mac_header(skb);
+        skb_pull(skb, IPOIB_HARD_LEN);
 }
 /* Used for all multicast joins (broadcast, IPv4 mcast and IPv6 mcast) */
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 4ad297d3de89..339a1eecdfe3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -63,6 +63,8 @@ MODULE_PARM_DESC(cm_data_debug_level,
 #define IPOIB_CM_RX_DELAY       (3 * 256 * HZ)
 #define IPOIB_CM_RX_UPDATE_MASK (0x3)
+#define IPOIB_CM_RX_RESERVE     (ALIGN(IPOIB_HARD_LEN, 16) - IPOIB_ENCAP_LEN)
 static struct ib_qp_attr ipoib_cm_err_attr = {
        .qp_state = IB_QPS_ERR
 };
@@ -146,15 +148,15 @@ static struct sk_buff *ipoib_cm_alloc_rx_skb(struct net_device *dev,
        struct sk_buff *skb;
        int i;
-        skb = dev_alloc_skb(IPOIB_CM_HEAD_SIZE + 12);
+        skb = dev_alloc_skb(ALIGN(IPOIB_CM_HEAD_SIZE + IPOIB_PSEUDO_LEN, 16));
        if (unlikely(!skb))
                return NULL;
        /*
-         * IPoIB adds a 4 byte header. So we need 12 more bytes to align the
+         * IPoIB adds a IPOIB_ENCAP_LEN byte header, this will align the
         * IP header to a multiple of 16.
         */
-        skb_reserve(skb, 12);
+        skb_reserve(skb, IPOIB_CM_RX_RESERVE);
        mapping[0] = ib_dma_map_single(priv->ca, skb->data, IPOIB_CM_HEAD_SIZE,
                                       DMA_FROM_DEVICE);
@@ -624,9 +626,9 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
        if (wc->byte_len < IPOIB_CM_COPYBREAK) {
                int dlen = wc->byte_len;
-                small_skb = dev_alloc_skb(dlen + 12);
+                small_skb = dev_alloc_skb(dlen + IPOIB_CM_RX_RESERVE);
                if (small_skb) {
-                        skb_reserve(small_skb, 12);
+                        skb_reserve(small_skb, IPOIB_CM_RX_RESERVE);
                        ib_dma_sync_single_for_cpu(priv->ca, rx_ring[wr_id].mapping[0],
                                                   dlen, DMA_FROM_DEVICE);
                        skb_copy_from_linear_data(skb, small_skb->data, dlen);
@@ -663,8 +665,7 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
 copied:
        skb->protocol = ((struct ipoib_header *) skb->data)->proto;
-        skb_reset_mac_header(skb);
+        skb_add_pseudo_hdr(skb);
-        skb_pull(skb, IPOIB_ENCAP_LEN);
        ++dev->stats.rx_packets;
        dev->stats.rx_bytes += skb->len;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index be11d5d5b8c1..830fecb6934c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -128,16 +128,15 @@ static struct sk_buff *ipoib_alloc_rx_skb(struct net_device *dev, int id)
        buf_size = IPOIB_UD_BUF_SIZE(priv->max_ib_mtu);
-        skb = dev_alloc_skb(buf_size + IPOIB_ENCAP_LEN);
+        skb = dev_alloc_skb(buf_size + IPOIB_HARD_LEN);
        if (unlikely(!skb))
                return NULL;
        /*
-         * IB will leave a 40 byte gap for a GRH and IPoIB adds a 4 byte
+         * the IP header will be at IPOIP_HARD_LEN + IB_GRH_BYTES, that is
-         * header.  So we need 4 more bytes to get to 48 and align the
+         * 64 bytes aligned
-         * IP header to a multiple of 16.
         */
-        skb_reserve(skb, 4);
+        skb_reserve(skb, sizeof(struct ipoib_pseudo_header));
        mapping = priv->rx_ring[id].mapping;
        mapping[0] = ib_dma_map_single(priv->ca, skb->data, buf_size,
@@ -253,8 +252,7 @@ static void ipoib_ib_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
        skb_pull(skb, IB_GRH_BYTES);
        skb->protocol = ((struct ipoib_header *) skb->data)->proto;
-        skb_reset_mac_header(skb);
+        skb_add_pseudo_hdr(skb);
-        skb_pull(skb, IPOIB_ENCAP_LEN);
        ++dev->stats.rx_packets;
        dev->stats.rx_bytes += skb->len;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 5636fc3da6b8..b58d9dca5c93 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -925,9 +925,12 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
                                ipoib_neigh_free(neigh);
                                goto err_drop;
                        }
-                        if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE)
+                        if (skb_queue_len(&neigh->queue) <
+                            IPOIB_MAX_PATH_REC_QUEUE) {
+                                /* put pseudoheader back on for next time */
+                                skb_push(skb, IPOIB_PSEUDO_LEN);
                                __skb_queue_tail(&neigh->queue, skb);
-                        else {
+                        } else {
                                ipoib_warn(priv, "queue length limit %d. Packet drop.\n",
                                           skb_queue_len(&neigh->queue));
                                goto err_drop;
@@ -964,7 +967,7 @@ err_drop:
 }
 static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
-                             struct ipoib_cb *cb)
+                             struct ipoib_pseudo_header *phdr)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ipoib_path *path;
@@ -972,16 +975,18 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
        spin_lock_irqsave(&priv->lock, flags);
-        path = __path_find(dev, cb->hwaddr + 4);
+        path = __path_find(dev, phdr->hwaddr + 4);
        if (!path || !path->valid) {
                int new_path = 0;
                if (!path) {
-                        path = path_rec_create(dev, cb->hwaddr + 4);
+                        path = path_rec_create(dev, phdr->hwaddr + 4);
                        new_path = 1;
                }
                if (path) {
                        if (skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
+                                /* put pseudoheader back on for next time */
+                                skb_push(skb, IPOIB_PSEUDO_LEN);
                                __skb_queue_tail(&path->queue, skb);
                        } else {
                                ++dev->stats.tx_dropped;
@@ -1009,10 +1014,12 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
                          be16_to_cpu(path->pathrec.dlid));
                spin_unlock_irqrestore(&priv->lock, flags);
-                ipoib_send(dev, skb, path->ah, IPOIB_QPN(cb->hwaddr));
+                ipoib_send(dev, skb, path->ah, IPOIB_QPN(phdr->hwaddr));
                return;
        } else if ((path->query || !path_rec_start(dev, path)) &&
                   skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
+                /* put pseudoheader back on for next time */
+                skb_push(skb, IPOIB_PSEUDO_LEN);
                __skb_queue_tail(&path->queue, skb);
        } else {
                ++dev->stats.tx_dropped;
@@ -1026,13 +1033,15 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ipoib_neigh *neigh;
-        struct ipoib_cb *cb = ipoib_skb_cb(skb);
+        struct ipoib_pseudo_header *phdr;
        struct ipoib_header *header;
        unsigned long flags;
+        phdr = (struct ipoib_pseudo_header *) skb->data;
+        skb_pull(skb, sizeof(*phdr));
        header = (struct ipoib_header *) skb->data;
-        if (unlikely(cb->hwaddr[4] == 0xff)) {
+        if (unlikely(phdr->hwaddr[4] == 0xff)) {
                /* multicast, arrange "if" according to probability */
                if ((header->proto != htons(ETH_P_IP)) &&
                    (header->proto != htons(ETH_P_IPV6)) &&
@@ -1045,13 +1054,13 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        return NETDEV_TX_OK;
                }
                /* Add in the P_Key for multicast*/
-                cb->hwaddr[8] = (priv->pkey >> 8) & 0xff;
+                phdr->hwaddr[8] = (priv->pkey >> 8) & 0xff;
-                cb->hwaddr[9] = priv->pkey & 0xff;
+                phdr->hwaddr[9] = priv->pkey & 0xff;
-                neigh = ipoib_neigh_get(dev, cb->hwaddr);
+                neigh = ipoib_neigh_get(dev, phdr->hwaddr);
                if (likely(neigh))
                        goto send_using_neigh;
-                ipoib_mcast_send(dev, cb->hwaddr, skb);
+                ipoib_mcast_send(dev, phdr->hwaddr, skb);
                return NETDEV_TX_OK;
        }
@@ -1060,16 +1069,16 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
        case htons(ETH_P_IP):
        case htons(ETH_P_IPV6):
        case htons(ETH_P_TIPC):
-                neigh = ipoib_neigh_get(dev, cb->hwaddr);
+                neigh = ipoib_neigh_get(dev, phdr->hwaddr);
                if (unlikely(!neigh)) {
-                        neigh_add_path(skb, cb->hwaddr, dev);
+                        neigh_add_path(skb, phdr->hwaddr, dev);
                        return NETDEV_TX_OK;
                }
                break;
        case htons(ETH_P_ARP):
        case htons(ETH_P_RARP):
                /* for unicast ARP and RARP should always perform path find */
-                unicast_arp_send(skb, dev, cb);
+                unicast_arp_send(skb, dev, phdr);
                return NETDEV_TX_OK;
        default:
                /* ethertype not supported by IPoIB */
@@ -1086,11 +1095,13 @@ send_using_neigh:
                        goto unref;
                }
        } else if (neigh->ah) {
-                ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(cb->hwaddr));
+                ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(phdr->hwaddr));
                goto unref;
        }
        if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
+                /* put pseudoheader back on for next time */
+                skb_push(skb, sizeof(*phdr));
                spin_lock_irqsave(&priv->lock, flags);
                __skb_queue_tail(&neigh->queue, skb);
                spin_unlock_irqrestore(&priv->lock, flags);
@@ -1122,8 +1133,8 @@ static int ipoib_hard_header(struct sk_buff *skb,
                             unsigned short type,
                             const void *daddr, const void *saddr, unsigned len)
 {
+        struct ipoib_pseudo_header *phdr;
        struct ipoib_header *header;
-        struct ipoib_cb *cb = ipoib_skb_cb(skb);
        header = (struct ipoib_header *) skb_push(skb, sizeof *header);
@@ -1132,12 +1143,13 @@ static int ipoib_hard_header(struct sk_buff *skb,
        /*
         * we don't rely on dst_entry structure,  always stuff the
-         * destination address into skb->cb so we can figure out where
+         * destination address into skb hard header so we can figure out where
         * to send the packet later.
         */
-        memcpy(cb->hwaddr, daddr, INFINIBAND_ALEN);
+        phdr = (struct ipoib_pseudo_header *) skb_push(skb, sizeof(*phdr));
+        memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN);
-        return sizeof *header;
+        return IPOIB_HARD_LEN;
 }
 static void ipoib_set_mcast_list(struct net_device *dev)
@@ -1759,7 +1771,7 @@ void ipoib_setup(struct net_device *dev)
        dev->flags              |= IFF_BROADCAST | IFF_MULTICAST;
-        dev->hard_header_len     = IPOIB_ENCAP_LEN;
+        dev->hard_header_len     = IPOIB_HARD_LEN;
        dev->addr_len            = INFINIBAND_ALEN;
        dev->type                = ARPHRD_INFINIBAND;
        dev->tx_queue_len        = ipoib_sendq_size * 2;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index d3394b6add24..1909dd252c94 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -796,9 +796,11 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb)
                        __ipoib_mcast_add(dev, mcast);
                        list_add_tail(&mcast->list, &priv->multicast_list);
                }
-                if (skb_queue_len(&mcast->pkt_queue) < IPOIB_MAX_MCAST_QUEUE)
+                if (skb_queue_len(&mcast->pkt_queue) < IPOIB_MAX_MCAST_QUEUE) {
+                        /* put pseudoheader back on for next time */
+                        skb_push(skb, sizeof(struct ipoib_pseudo_header));
                        skb_queue_tail(&mcast->pkt_queue, skb);
-                else {
+                } else {
                        ++dev->stats.tx_dropped;
                        dev_kfree_skb_any(skb);
                }
diff --git a/drivers/input/misc/arizona-haptics.c b/drivers/input/misc/arizona-haptics.c
index 982936334537..07ec465f1095 100644
--- a/drivers/input/misc/arizona-haptics.c
+++ b/drivers/input/misc/arizona-haptics.c
@@ -37,6 +37,8 @@ static void arizona_haptics_work(struct work_struct *work)
                                                       struct arizona_haptics,
                                                       work);
        struct arizona *arizona = haptics->arizona;
+        struct snd_soc_component *component =
+                snd_soc_dapm_to_component(arizona->dapm);
        int ret;
        if (!haptics->arizona->dapm) {
@@ -66,7 +68,7 @@ static void arizona_haptics_work(struct work_struct *work)
                        return;
                }
-                ret = snd_soc_dapm_enable_pin(arizona->dapm, "HAPTICS");
+                ret = snd_soc_component_enable_pin(component, "HAPTICS");
                if (ret != 0) {
                        dev_err(arizona->dev, "Failed to start HAPTICS: %d\n",
                                ret);
@@ -81,7 +83,7 @@ static void arizona_haptics_work(struct work_struct *work)
                }
        } else {
                /* This disable sequence will be a noop if already enabled */
-                ret = snd_soc_dapm_disable_pin(arizona->dapm, "HAPTICS");
+                ret = snd_soc_component_disable_pin(component, "HAPTICS");
                if (ret != 0) {
                        dev_err(arizona->dev, "Failed to disable HAPTICS: %d\n",
                                ret);
@@ -140,11 +142,14 @@ static int arizona_haptics_play(struct input_dev *input, void *data,
 static void arizona_haptics_close(struct input_dev *input)
 {
        struct arizona_haptics *haptics = input_get_drvdata(input);
+        struct snd_soc_component *component;
        cancel_work_sync(&haptics->work);
-        if (haptics->arizona->dapm)
+        if (haptics->arizona->dapm) {
-                snd_soc_dapm_disable_pin(haptics->arizona->dapm, "HAPTICS");
+                component = snd_soc_dapm_to_component(haptics->arizona->dapm);
+                snd_soc_component_disable_pin(component, "HAPTICS");
+        }
 }
 static int arizona_haptics_probe(struct platform_device *pdev)
diff --git a/drivers/input/mouse/focaltech.c b/drivers/input/mouse/focaltech.c
index 54eceb30ede5..a7d39689bbfb 100644
--- a/drivers/input/mouse/focaltech.c
+++ b/drivers/input/mouse/focaltech.c
@@ -43,7 +43,7 @@ int focaltech_detect(struct psmouse *psmouse, bool set_properties)
        if (set_properties) {
                psmouse->vendor = "FocalTech";
-                psmouse->name = "FocalTech Touchpad";
+                psmouse->name = "Touchpad";
        }
        return 0;
@@ -146,8 +146,8 @@ static void focaltech_report_state(struct psmouse *psmouse)
        }
        input_mt_report_pointer_emulation(dev, true);
-        input_report_key(psmouse->dev, BTN_LEFT, state->pressed);
+        input_report_key(dev, BTN_LEFT, state->pressed);
-        input_sync(psmouse->dev);
+        input_sync(dev);
 }
 static void focaltech_process_touch_packet(struct psmouse *psmouse,
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index fb4b185dea96..bee267424972 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1115,10 +1115,6 @@ static int psmouse_extensions(struct psmouse *psmouse,
                if (psmouse_try_protocol(psmouse, PSMOUSE_TOUCHKIT_PS2,
                                         &max_proto, set_properties, true))
                        return PSMOUSE_TOUCHKIT_PS2;
-                if (psmouse_try_protocol(psmouse, PSMOUSE_BYD,
-                                         &max_proto, set_properties, true))
-                        return PSMOUSE_BYD;
        }
        /*
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index f4bfb4b2d50a..073246c7d163 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -877,6 +877,13 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
                },
        },
+        {
+                /* Schenker XMG C504 - Elantech touchpad */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "XMG"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "C504"),
+                },
+        },
        { }
 };
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 15c01c3cd540..e6f9b2d745ca 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -2636,17 +2636,26 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
        /* And we're up. Go go go! */
        of_iommu_set_ops(dev->of_node, &arm_smmu_ops);
 #ifdef CONFIG_PCI
-        pci_request_acs();
+        if (pci_bus_type.iommu_ops != &arm_smmu_ops) {
-        ret = bus_set_iommu(&pci_bus_type, &arm_smmu_ops);
+                pci_request_acs();
-        if (ret)
+                ret = bus_set_iommu(&pci_bus_type, &arm_smmu_ops);
-                return ret;
+                if (ret)
+                        return ret;
+        }
 #endif
 #ifdef CONFIG_ARM_AMBA
-        ret = bus_set_iommu(&amba_bustype, &arm_smmu_ops);
+        if (amba_bustype.iommu_ops != &arm_smmu_ops) {
-        if (ret)
+                ret = bus_set_iommu(&amba_bustype, &arm_smmu_ops);
-                return ret;
+                if (ret)
+                        return ret;
+        }
 #endif
-        return bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
+        if (platform_bus_type.iommu_ops != &arm_smmu_ops) {
+                ret = bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
+                if (ret)
+                        return ret;
+        }
+        return 0;
 }
 static int arm_smmu_device_remove(struct platform_device *pdev)
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index c841eb7a1a74..8f7281444551 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -324,8 +324,10 @@ struct arm_smmu_master_cfg {
 #define INVALID_SMENDX                  -1
 #define __fwspec_cfg(fw) ((struct arm_smmu_master_cfg *)fw->iommu_priv)
 #define fwspec_smmu(fw)  (__fwspec_cfg(fw)->smmu)
+#define fwspec_smendx(fw, i) \
+        (i >= fw->num_ids ? INVALID_SMENDX : __fwspec_cfg(fw)->smendx[i])
 #define for_each_cfg_sme(fw, i, idx) \
-        for (i = 0; idx = __fwspec_cfg(fw)->smendx[i], i < fw->num_ids; ++i)
+        for (i = 0; idx = fwspec_smendx(fw, i), i < fw->num_ids; ++i)
 struct arm_smmu_device {
        struct device                   *dev;
@@ -1228,6 +1230,16 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
                return -ENXIO;
        }
+        /*
+         * FIXME: The arch/arm DMA API code tries to attach devices to its own
+         * domains between of_xlate() and add_device() - we have no way to cope
+         * with that, so until ARM gets converted to rely on groups and default
+         * domains, just say no (but more politely than by dereferencing NULL).
+         * This should be at least a WARN_ON once that's sorted.
+         */
+        if (!fwspec->iommu_priv)
+                return -ENODEV;
        smmu = fwspec_smmu(fwspec);
        /* Ensure that the domain is finalised */
        ret = arm_smmu_init_domain_context(domain, smmu);
@@ -1390,7 +1402,7 @@ static int arm_smmu_add_device(struct device *dev)
                fwspec = dev->iommu_fwspec;
                if (ret)
                        goto out_free;
-        } else if (fwspec) {
+        } else if (fwspec && fwspec->ops == &arm_smmu_ops) {
                smmu = arm_smmu_get_by_node(to_of_node(fwspec->iommu_fwnode));
        } else {
                return -ENODEV;
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 58470f5ced04..8c53748a769d 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -338,7 +338,9 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb,
        struct pci_dev *pdev = to_pci_dev(data);
        struct dmar_pci_notify_info *info;
-        /* Only care about add/remove events for physical functions */
+        /* Only care about add/remove events for physical functions.
+         * For VFs we actually do the lookup based on the corresponding
+         * PF in device_to_iommu() anyway. */
        if (pdev->is_virtfn)
                return NOTIFY_DONE;
        if (action != BUS_NOTIFY_ADD_DEVICE &&
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index a4407eabf0e6..d8376c2d18b3 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -892,7 +892,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
                return NULL;
        if (dev_is_pci(dev)) {
+                struct pci_dev *pf_pdev;
                pdev = to_pci_dev(dev);
+                /* VFs aren't listed in scope tables; we need to look up
+                 * the PF instead to find the IOMMU. */
+                pf_pdev = pci_physfn(pdev);
+                dev = &pf_pdev->dev;
                segment = pci_domain_nr(pdev->bus);
        } else if (has_acpi_companion(dev))
                dev = &ACPI_COMPANION(dev)->dev;
@@ -905,6 +911,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
                for_each_active_dev_scope(drhd->devices,
                                          drhd->devices_cnt, i, tmp) {
                        if (tmp == dev) {
+                                /* For a VF use its original BDF# not that of the PF
+                                 * which we used for the IOMMU lookup. Strictly speaking
+                                 * we could do this for all PCI devices; we only need to
+                                 * get the BDF# from the scope table for ACPI matches. */
+                                if (pdev->is_virtfn)
+                                        goto got_pdev;
                                *bus = drhd->devices[i].bus;
                                *devfn = drhd->devices[i].devfn;
                                goto out;
@@ -1711,6 +1724,7 @@ static void disable_dmar_iommu(struct intel_iommu *iommu)
        if (!iommu->domains || !iommu->domain_ids)
                return;
+again:
        spin_lock_irqsave(&device_domain_lock, flags);
        list_for_each_entry_safe(info, tmp, &device_domain_list, global) {
                struct dmar_domain *domain;
@@ -1723,10 +1737,19 @@ static void disable_dmar_iommu(struct intel_iommu *iommu)
                domain = info->domain;
-                dmar_remove_one_dev_info(domain, info->dev);
+                __dmar_remove_one_dev_info(info);
-                if (!domain_type_is_vm_or_si(domain))
+                if (!domain_type_is_vm_or_si(domain)) {
+                        /*
+                         * The domain_exit() function  can't be called under
+                         * device_domain_lock, as it takes this lock itself.
+                         * So release the lock here and re-run the loop
+                         * afterwards.
+                         */
+                        spin_unlock_irqrestore(&device_domain_lock, flags);
                        domain_exit(domain);
+                        goto again;
+                }
        }
        spin_unlock_irqrestore(&device_domain_lock, flags);
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index 8ebb3530afa7..cb72e0011310 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -39,10 +39,18 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu)
        struct page *pages;
        int order;
-        order = ecap_pss(iommu->ecap) + 7 - PAGE_SHIFT;
+        /* Start at 2 because it's defined as 2^(1+PSS) */
-        if (order < 0)
+        iommu->pasid_max = 2 << ecap_pss(iommu->ecap);
-                order = 0;
+        /* Eventually I'm promised we will get a multi-level PASID table
+         * and it won't have to be physically contiguous. Until then,
+         * limit the size because 8MiB contiguous allocations can be hard
+         * to come by. The limit of 0x20000, which is 1MiB for each of
+         * the PASID and PASID-state tables, is somewhat arbitrary. */
+        if (iommu->pasid_max > 0x20000)
+                iommu->pasid_max = 0x20000;
+        order = get_order(sizeof(struct pasid_entry) * iommu->pasid_max);
        pages = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
        if (!pages) {
                pr_warn("IOMMU: %s: Failed to allocate PASID table\n",
@@ -53,6 +61,8 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu)
        pr_info("%s: Allocated order %d PASID table.\n", iommu->name, order);
        if (ecap_dis(iommu->ecap)) {
+                /* Just making it explicit... */
+                BUILD_BUG_ON(sizeof(struct pasid_entry) != sizeof(struct pasid_state_entry));
                pages = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
                if (pages)
                        iommu->pasid_state_table = page_address(pages);
@@ -68,11 +78,7 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu)
 int intel_svm_free_pasid_tables(struct intel_iommu *iommu)
 {
-        int order;
+        int order = get_order(sizeof(struct pasid_entry) * iommu->pasid_max);
-        order = ecap_pss(iommu->ecap) + 7 - PAGE_SHIFT;
-        if (order < 0)
-                order = 0;
        if (iommu->pasid_table) {
                free_pages((unsigned long)iommu->pasid_table, order);
@@ -371,8 +377,8 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
                }
                svm->iommu = iommu;
-                if (pasid_max > 2 << ecap_pss(iommu->ecap))
+                if (pasid_max > iommu->pasid_max)
-                        pasid_max = 2 << ecap_pss(iommu->ecap);
+                        pasid_max = iommu->pasid_max;
                /* Do not use PASID 0 in caching mode (virtualised IOMMU) */
                ret = idr_alloc(&iommu->pasid_idr, svm,
diff --git a/drivers/ipack/ipack.c b/drivers/ipack/ipack.c
index c0e7b624ce54..12102448fddd 100644
--- a/drivers/ipack/ipack.c
+++ b/drivers/ipack/ipack.c
@@ -178,7 +178,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
                       idev->id_vendor, idev->id_device);
 }
-ipack_device_attr(id_format, "0x%hhu\n");
+ipack_device_attr(id_format, "0x%hhx\n");
 static DEVICE_ATTR_RO(id);
 static DEVICE_ATTR_RO(id_device);
diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
index 82b0b5daf3f5..bc0af3307bbf 100644
--- a/drivers/irqchip/Kconfig
+++ b/drivers/irqchip/Kconfig
@@ -158,8 +158,8 @@ config PIC32_EVIC
        select IRQ_DOMAIN
 config JCORE_AIC
-        bool "J-Core integrated AIC"
+        bool "J-Core integrated AIC" if COMPILE_TEST
-        depends on OF && (SUPERH || COMPILE_TEST)
+        depends on OF
        select IRQ_DOMAIN
        help
          Support for the J-Core integrated AIC.
diff --git a/drivers/irqchip/irq-eznps.c b/drivers/irqchip/irq-eznps.c
index efbf0e4304b7..2a7a38830a8d 100644
--- a/drivers/irqchip/irq-eznps.c
+++ b/drivers/irqchip/irq-eznps.c
@@ -85,7 +85,7 @@ static void nps400_irq_eoi_global(struct irq_data *irqd)
        nps_ack_gic();
 }
-static void nps400_irq_eoi(struct irq_data *irqd)
+static void nps400_irq_ack(struct irq_data *irqd)
 {
        unsigned int __maybe_unused irq = irqd_to_hwirq(irqd);
@@ -103,7 +103,7 @@ static struct irq_chip nps400_irq_chip_percpu = {
        .name           = "NPS400 IC",
        .irq_mask       = nps400_irq_mask,
        .irq_unmask     = nps400_irq_unmask,
-        .irq_eoi        = nps400_irq_eoi,
+        .irq_ack        = nps400_irq_ack,
 };
 static int nps400_irq_map(struct irq_domain *d, unsigned int virq,
@@ -135,7 +135,7 @@ static const struct irq_domain_ops nps400_irq_ops = {
 static int __init nps400_of_init(struct device_node *node,
                                 struct device_node *parent)
 {
-        static struct irq_domain *nps400_root_domain;
+        struct irq_domain *nps400_root_domain;
        if (parent) {
                pr_err("DeviceTree incore ic not a root irq controller\n");
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 003495d91f9c..c5dee300e8a3 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1023,7 +1023,7 @@ static void its_free_tables(struct its_node *its)
 static int its_alloc_tables(struct its_node *its)
 {
-        u64 typer = readq_relaxed(its->base + GITS_TYPER);
+        u64 typer = gic_read_typer(its->base + GITS_TYPER);
        u32 ids = GITS_TYPER_DEVBITS(typer);
        u64 shr = GITS_BASER_InnerShareable;
        u64 cache = GITS_BASER_WaWb;
@@ -1198,7 +1198,7 @@ static void its_cpu_init_collection(void)
                 * We now have to bind each collection to its target
                 * redistributor.
                 */
-                if (readq_relaxed(its->base + GITS_TYPER) & GITS_TYPER_PTA) {
+                if (gic_read_typer(its->base + GITS_TYPER) & GITS_TYPER_PTA) {
                        /*
                         * This ITS wants the physical address of the
                         * redistributor.
@@ -1208,7 +1208,7 @@ static void its_cpu_init_collection(void)
                        /*
                         * This ITS wants a linear CPU number.
                         */
-                        target = readq_relaxed(gic_data_rdist_rd_base() + GICR_TYPER);
+                        target = gic_read_typer(gic_data_rdist_rd_base() + GICR_TYPER);
                        target = GICR_TYPER_CPU_NUMBER(target) << 16;
                }
@@ -1691,7 +1691,7 @@ static int __init its_probe_one(struct resource *res,
        INIT_LIST_HEAD(&its->its_device_list);
        its->base = its_base;
        its->phys_base = res->start;
-        its->ite_size = ((readl_relaxed(its_base + GITS_TYPER) >> 4) & 0xf) + 1;
+        its->ite_size = ((gic_read_typer(its_base + GITS_TYPER) >> 4) & 0xf) + 1;
        its->numa_node = numa_node;
        its->cmd_base = kzalloc(ITS_CMD_QUEUE_SZ, GFP_KERNEL);
@@ -1763,7 +1763,7 @@ out_unmap:
 static bool gic_rdists_supports_plpis(void)
 {
-        return !!(readl_relaxed(gic_data_rdist_rd_base() + GICR_TYPER) & GICR_TYPER_PLPIS);
+        return !!(gic_read_typer(gic_data_rdist_rd_base() + GICR_TYPER) & GICR_TYPER_PLPIS);
 }
 int its_cpu_init(void)
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 9b81bd8b929c..19d642eae096 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -153,7 +153,7 @@ static void gic_enable_redist(bool enable)
                        return; /* No PM support in this redistributor */
        }
-        while (count--) {
+        while (--count) {
                val = readl_relaxed(rbase + GICR_WAKER);
                if (enable ^ (bool)(val & GICR_WAKER_ChildrenAsleep))
                        break;
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 58e5b4e87056..d6c404b3584d 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -1279,7 +1279,7 @@ static bool gic_check_eoimode(struct device_node *node, void __iomem **base)
                 */
                *base += 0xf000;
                cpuif_res.start += 0xf000;
-                pr_warn("GIC: Adjusting CPU interface base to %pa",
+                pr_warn("GIC: Adjusting CPU interface base to %pa\n",
                        &cpuif_res.start);
        }
diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c
index 84b01dec277d..033bccb41455 100644
--- a/drivers/irqchip/irq-jcore-aic.c
+++ b/drivers/irqchip/irq-jcore-aic.c
@@ -25,12 +25,30 @@
 static struct irq_chip jcore_aic;
+/*
+ * The J-Core AIC1 and AIC2 are cpu-local interrupt controllers and do
+ * not distinguish or use distinct irq number ranges for per-cpu event
+ * interrupts (timer, IPI). Since information to determine whether a
+ * particular irq number should be treated as per-cpu is not available
+ * at mapping time, we use a wrapper handler function which chooses
+ * the right handler at runtime based on whether IRQF_PERCPU was used
+ * when requesting the irq.
+ */
+static void handle_jcore_irq(struct irq_desc *desc)
+{
+        if (irqd_is_per_cpu(irq_desc_get_irq_data(desc)))
+                handle_percpu_irq(desc);
+        else
+                handle_simple_irq(desc);
+}
 static int jcore_aic_irqdomain_map(struct irq_domain *d, unsigned int irq,
                                   irq_hw_number_t hwirq)
 {
        struct irq_chip *aic = d->host_data;
-        irq_set_chip_and_handler(irq, aic, handle_simple_irq);
+        irq_set_chip_and_handler(irq, aic, handle_jcore_irq);
        return 0;
 }
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index d1f8ab915b15..b90776ef56ec 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -755,8 +755,10 @@ static int __init ser_gigaset_init(void)
        driver = gigaset_initdriver(GIGASET_MINOR, GIGASET_MINORS,
                                    GIGASET_MODULENAME, GIGASET_DEVNAME,
                                    &ops, THIS_MODULE);
-        if (!driver)
+        if (!driver) {
+                rc = -ENOMEM;
                goto error;
+        }
        rc = tty_register_ldisc(N_GIGASET_M101, &gigaset_ldisc);
        if (rc != 0) {
diff --git a/drivers/isdn/hisax/hfc4s8s_l1.c b/drivers/isdn/hisax/hfc4s8s_l1.c
index 9600cd771f1a..e034ed847ff3 100644
--- a/drivers/isdn/hisax/hfc4s8s_l1.c
+++ b/drivers/isdn/hisax/hfc4s8s_l1.c
@@ -1499,6 +1499,7 @@ hfc4s8s_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                printk(KERN_INFO
                       "HFC-4S/8S: failed to request address space at 0x%04x\n",
                       hw->iobase);
+                err = -EBUSY;
                goto out;
        }
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 08c87fadca8c..1f32688c312d 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -65,6 +65,7 @@
 #include <linux/mailbox_controller.h>
 #include <linux/mailbox_client.h>
 #include <linux/io-64-nonatomic-lo-hi.h>
+#include <acpi/pcc.h>
 #include "mailbox.h"
@@ -267,6 +268,8 @@ struct mbox_chan *pcc_mbox_request_channel(struct mbox_client *cl,
        if (chan->txdone_method == TXDONE_BY_POLL && cl->knows_txdone)
                chan->txdone_method |= TXDONE_BY_ACK;
+        spin_unlock_irqrestore(&chan->lock, flags);
        if (pcc_doorbell_irq[subspace_id] > 0) {
                int rc;
@@ -275,12 +278,11 @@ struct mbox_chan *pcc_mbox_request_channel(struct mbox_client *cl,
                if (unlikely(rc)) {
                        dev_err(dev, "failed to register PCC interrupt %d\n",
                                pcc_doorbell_irq[subspace_id]);
+                        pcc_mbox_free_channel(chan);
                        chan = ERR_PTR(rc);
                }
        }
-        spin_unlock_irqrestore(&chan->lock, flags);
        return chan;
 }
 EXPORT_SYMBOL_GPL(pcc_mbox_request_channel);
@@ -304,20 +306,19 @@ void pcc_mbox_free_channel(struct mbox_chan *chan)
                return;
        }
+        if (pcc_doorbell_irq[id] > 0)
+                devm_free_irq(chan->mbox->dev, pcc_doorbell_irq[id], chan);
        spin_lock_irqsave(&chan->lock, flags);
        chan->cl = NULL;
        chan->active_req = NULL;
        if (chan->txdone_method == (TXDONE_BY_POLL | TXDONE_BY_ACK))
                chan->txdone_method = TXDONE_BY_POLL;
-        if (pcc_doorbell_irq[id] > 0)
-                devm_free_irq(chan->mbox->dev, pcc_doorbell_irq[id], chan);
        spin_unlock_irqrestore(&chan->lock, flags);
 }
 EXPORT_SYMBOL_GPL(pcc_mbox_free_channel);
 /**
 * pcc_send_data - Called from Mailbox Controller code. Used
 *              here only to ring the channel doorbell. The PCC client
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 8abde6b8cedc..6d53810963f7 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -266,7 +266,7 @@ static struct raid_type {
        {"raid10_offset", "raid10 offset (striped mirrors)",        0, 2, 10, ALGORITHM_RAID10_OFFSET},
        {"raid10_near",   "raid10 near (striped mirrors)",          0, 2, 10, ALGORITHM_RAID10_NEAR},
        {"raid10",        "raid10 (striped mirrors)",               0, 2, 10, ALGORITHM_RAID10_DEFAULT},
-        {"raid4",         "raid4 (dedicated last parity disk)",     1, 2, 4,  ALGORITHM_PARITY_N}, /* raid4 layout = raid5_n */
+        {"raid4",         "raid4 (dedicated first parity disk)",    1, 2, 5,  ALGORITHM_PARITY_0}, /* raid4 layout = raid5_0 */
        {"raid5_n",       "raid5 (dedicated last parity disk)",     1, 2, 5,  ALGORITHM_PARITY_N},
        {"raid5_ls",      "raid5 (left symmetric)",                 1, 2, 5,  ALGORITHM_LEFT_SYMMETRIC},
        {"raid5_rs",      "raid5 (right symmetric)",                1, 2, 5,  ALGORITHM_RIGHT_SYMMETRIC},
@@ -2087,11 +2087,11 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
                /*
                 * No takeover/reshaping, because we don't have the extended v1.9.0 metadata
                 */
-                if (le32_to_cpu(sb->level) != mddev->level) {
+                if (le32_to_cpu(sb->level) != mddev->new_level) {
                        DMERR("Reshaping/takeover raid sets not yet supported. (raid level/stripes/size change)");
                        return -EINVAL;
                }
-                if (le32_to_cpu(sb->layout) != mddev->layout) {
+                if (le32_to_cpu(sb->layout) != mddev->new_layout) {
                        DMERR("Reshaping raid sets not yet supported. (raid layout change)");
                        DMERR("  0x%X vs 0x%X", le32_to_cpu(sb->layout), mddev->layout);
                        DMERR("  Old layout: %s w/ %d copies",
@@ -2102,7 +2102,7 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
                              raid10_md_layout_to_copies(mddev->layout));
                        return -EINVAL;
                }
-                if (le32_to_cpu(sb->stripe_sectors) != mddev->chunk_sectors) {
+                if (le32_to_cpu(sb->stripe_sectors) != mddev->new_chunk_sectors) {
                        DMERR("Reshaping raid sets not yet supported. (stripe sectors change)");
                        return -EINVAL;
                }
@@ -2115,6 +2115,8 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
                        return -EINVAL;
                }
+                DMINFO("Discovered old metadata format; upgrading to extended metadata format");
                /* Table line is checked vs. authoritative superblock */
                rs_set_new(rs);
        }
@@ -2258,7 +2260,8 @@ static int super_validate(struct raid_set *rs, struct md_rdev *rdev)
        if (!mddev->events && super_init_validation(rs, rdev))
                return -EINVAL;
-        if (le32_to_cpu(sb->compat_features) != FEATURE_FLAG_SUPPORTS_V190) {
+        if (le32_to_cpu(sb->compat_features) &&
+            le32_to_cpu(sb->compat_features) != FEATURE_FLAG_SUPPORTS_V190) {
                rs->ti->error = "Unable to assemble array: Unknown flag(s) in compatible feature flags";
                return -EINVAL;
        }
@@ -3646,7 +3649,7 @@ static void raid_resume(struct dm_target *ti)
 static struct target_type raid_target = {
        .name = "raid",
-        .version = {1, 9, 0},
+        .version = {1, 9, 1},
        .module = THIS_MODULE,
        .ctr = raid_ctr,
        .dtr = raid_dtr,
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index bdf1606f67bc..9a8b71067c6e 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -145,7 +145,6 @@ static void dispatch_bios(void *context, struct bio_list *bio_list)
 struct dm_raid1_bio_record {
        struct mirror *m;
-        /* if details->bi_bdev == NULL, details were not saved */
        struct dm_bio_details details;
        region_t write_region;
 };
@@ -1200,8 +1199,6 @@ static int mirror_map(struct dm_target *ti, struct bio *bio)
        struct dm_raid1_bio_record *bio_record =
          dm_per_bio_data(bio, sizeof(struct dm_raid1_bio_record));
-        bio_record->details.bi_bdev = NULL;
        if (rw == WRITE) {
                /* Save region for mirror_end_io() handler */
                bio_record->write_region = dm_rh_bio_to_region(ms->rh, bio);
@@ -1260,22 +1257,12 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
        }
        if (error == -EOPNOTSUPP)
-                goto out;
+                return error;
        if ((error == -EWOULDBLOCK) && (bio->bi_opf & REQ_RAHEAD))
-                goto out;
+                return error;
        if (unlikely(error)) {
-                if (!bio_record->details.bi_bdev) {
-                        /*
-                         * There wasn't enough memory to record necessary
-                         * information for a retry or there was no other
-                         * mirror in-sync.
-                         */
-                        DMERR_LIMIT("Mirror read failed.");
-                        return -EIO;
-                }
                m = bio_record->m;
                DMERR("Mirror read failed from %s. Trying alternative device.",
@@ -1291,7 +1278,7 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
                        bd = &bio_record->details;
                        dm_bio_restore(bd, bio);
-                        bio_record->details.bi_bdev = NULL;
+                        bio->bi_error = 0;
                        queue_bio(ms, bio, rw);
                        return DM_ENDIO_INCOMPLETE;
@@ -1299,9 +1286,6 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
                DMERR("All replicated volumes dead, failing I/O");
        }
-out:
-        bio_record->details.bi_bdev = NULL;
        return error;
 }
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index dc75bea0d541..1d0d2adc050a 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -856,8 +856,11 @@ int dm_old_init_request_queue(struct mapped_device *md)
        kthread_init_worker(&md->kworker);
        md->kworker_task = kthread_run(kthread_worker_fn, &md->kworker,
                                       "kdmwork-%s", dm_device_name(md));
-        if (IS_ERR(md->kworker_task))
+        if (IS_ERR(md->kworker_task)) {
-                return PTR_ERR(md->kworker_task);
+                int error = PTR_ERR(md->kworker_task);
+                md->kworker_task = NULL;
+                return error;
+        }
        elv_register_queue(md->queue);
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 3e407a9cde1f..c4b53b332607 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -695,37 +695,32 @@ int dm_table_add_target(struct dm_table *t, const char *type,
        tgt->type = dm_get_target_type(type);
        if (!tgt->type) {
-                DMERR("%s: %s: unknown target type", dm_device_name(t->md),
+                DMERR("%s: %s: unknown target type", dm_device_name(t->md), type);
-                      type);
                return -EINVAL;
        }
        if (dm_target_needs_singleton(tgt->type)) {
                if (t->num_targets) {
-                        DMERR("%s: target type %s must appear alone in table",
+                        tgt->error = "singleton target type must appear alone in table";
-                              dm_device_name(t->md), type);
+                        goto bad;
-                        return -EINVAL;
                }
                t->singleton = true;
        }
        if (dm_target_always_writeable(tgt->type) && !(t->mode & FMODE_WRITE)) {
-                DMERR("%s: target type %s may not be included in read-only tables",
+                tgt->error = "target type may not be included in a read-only table";
-                      dm_device_name(t->md), type);
+                goto bad;
-                return -EINVAL;
        }
        if (t->immutable_target_type) {
                if (t->immutable_target_type != tgt->type) {
-                        DMERR("%s: immutable target type %s cannot be mixed with other target types",
+                        tgt->error = "immutable target type cannot be mixed with other target types";
-                              dm_device_name(t->md), t->immutable_target_type->name);
+                        goto bad;
-                        return -EINVAL;
                }
        } else if (dm_target_is_immutable(tgt->type)) {
                if (t->num_targets) {
-                        DMERR("%s: immutable target type %s cannot be mixed with other target types",
+                        tgt->error = "immutable target type cannot be mixed with other target types";
-                              dm_device_name(t->md), tgt->type->name);
+                        goto bad;
-                        return -EINVAL;
                }
                t->immutable_target_type = tgt->type;
        }
@@ -740,7 +735,6 @@ int dm_table_add_target(struct dm_table *t, const char *type,
         */
        if (!adjoin(t, tgt)) {
                tgt->error = "Gap in table";
-                r = -EINVAL;
                goto bad;
        }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 147af9536d0c..ef7bf1dd6900 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1423,8 +1423,6 @@ static void cleanup_mapped_device(struct mapped_device *md)
        if (md->bs)
                bioset_free(md->bs);
-        cleanup_srcu_struct(&md->io_barrier);
        if (md->disk) {
                spin_lock(&_minor_lock);
                md->disk->private_data = NULL;
@@ -1436,6 +1434,8 @@ static void cleanup_mapped_device(struct mapped_device *md)
        if (md->queue)
                blk_cleanup_queue(md->queue);
+        cleanup_srcu_struct(&md->io_barrier);
        if (md->bdev) {
                bdput(md->bdev);
                md->bdev = NULL;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index eac84d8ff724..2089d46b0eb8 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3887,10 +3887,10 @@ array_state_show(struct mddev *mddev, char *page)
                        st = read_auto;
                        break;
                case 0:
-                        if (mddev->in_sync)
+                        if (test_bit(MD_CHANGE_PENDING, &mddev->flags))
-                                st = clean;
-                        else if (test_bit(MD_CHANGE_PENDING, &mddev->flags))
                                st = write_pending;
+                        else if (mddev->in_sync)
+                                st = clean;
                        else if (mddev->safemode)
                                st = active_idle;
                        else
@@ -8144,14 +8144,14 @@ void md_do_sync(struct md_thread *thread)
        if (!test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
            !test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
-            mddev->curr_resync > 2) {
+            mddev->curr_resync > 3) {
                mddev->curr_resync_completed = mddev->curr_resync;
                sysfs_notify(&mddev->kobj, NULL, "sync_completed");
        }
        mddev->pers->sync_request(mddev, max_sectors, &skipped);
        if (!test_bit(MD_RECOVERY_CHECK, &mddev->recovery) &&
-            mddev->curr_resync > 2) {
+            mddev->curr_resync > 3) {
                if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) {
                        if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
                                if (mddev->curr_resync >= mddev->recovery_cp) {
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 1961d827dbd1..29e2df5cd77b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -403,11 +403,14 @@ static void raid1_end_write_request(struct bio *bio)
        struct bio *to_put = NULL;
        int mirror = find_bio_disk(r1_bio, bio);
        struct md_rdev *rdev = conf->mirrors[mirror].rdev;
+        bool discard_error;
+        discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD;
        /*
         * 'one mirror IO has finished' event handler:
         */
-        if (bio->bi_error) {
+        if (bio->bi_error && !discard_error) {
                set_bit(WriteErrorSeen, &rdev->flags);
                if (!test_and_set_bit(WantReplacement, &rdev->flags))
                        set_bit(MD_RECOVERY_NEEDED, &
@@ -444,7 +447,7 @@ static void raid1_end_write_request(struct bio *bio)
                /* Maybe we can clear some bad blocks. */
                if (is_badblock(rdev, r1_bio->sector, r1_bio->sectors,
-                                &first_bad, &bad_sectors)) {
+                                &first_bad, &bad_sectors) && !discard_error) {
                        r1_bio->bios[mirror] = IO_MADE_GOOD;
                        set_bit(R1BIO_MadeGood, &r1_bio->state);
                }
@@ -2294,17 +2297,23 @@ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio)
         * This is all done synchronously while the array is
         * frozen
         */
+        bio = r1_bio->bios[r1_bio->read_disk];
+        bdevname(bio->bi_bdev, b);
+        bio_put(bio);
+        r1_bio->bios[r1_bio->read_disk] = NULL;
        if (mddev->ro == 0) {
                freeze_array(conf, 1);
                fix_read_error(conf, r1_bio->read_disk,
                               r1_bio->sector, r1_bio->sectors);
                unfreeze_array(conf);
-        } else
+        } else {
-                md_error(mddev, conf->mirrors[r1_bio->read_disk].rdev);
+                r1_bio->bios[r1_bio->read_disk] = IO_BLOCKED;
+        }
        rdev_dec_pending(conf->mirrors[r1_bio->read_disk].rdev, conf->mddev);
-        bio = r1_bio->bios[r1_bio->read_disk];
-        bdevname(bio->bi_bdev, b);
 read_more:
        disk = read_balance(conf, r1_bio, &max_sectors);
        if (disk == -1) {
@@ -2315,11 +2324,6 @@ read_more:
        } else {
                const unsigned long do_sync
                        = r1_bio->master_bio->bi_opf & REQ_SYNC;
-                if (bio) {
-                        r1_bio->bios[r1_bio->read_disk] =
-                                mddev->ro ? IO_BLOCKED : NULL;
-                        bio_put(bio);
-                }
                r1_bio->read_disk = disk;
                bio = bio_clone_mddev(r1_bio->master_bio, GFP_NOIO, mddev);
                bio_trim(bio, r1_bio->sector - bio->bi_iter.bi_sector,
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index be1a9fca3b2d..39fddda2fef2 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -447,6 +447,9 @@ static void raid10_end_write_request(struct bio *bio)
        struct r10conf *conf = r10_bio->mddev->private;
        int slot, repl;
        struct md_rdev *rdev = NULL;
+        bool discard_error;
+        discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD;
        dev = find_bio_disk(conf, r10_bio, bio, &slot, &repl);
@@ -460,7 +463,7 @@ static void raid10_end_write_request(struct bio *bio)
        /*
         * this branch is our 'one mirror IO has finished' event handler:
         */
-        if (bio->bi_error) {
+        if (bio->bi_error && !discard_error) {
                if (repl)
                        /* Never record new bad blocks to replacement,
                         * just fail it.
@@ -503,7 +506,7 @@ static void raid10_end_write_request(struct bio *bio)
                if (is_badblock(rdev,
                                r10_bio->devs[slot].addr,
                                r10_bio->sectors,
-                                &first_bad, &bad_sectors)) {
+                                &first_bad, &bad_sectors) && !discard_error) {
                        bio_put(bio);
                        if (repl)
                                r10_bio->devs[slot].repl_bio = IO_MADE_GOOD;
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 1b1ab4a1d132..a227a9f3ee65 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -1087,7 +1087,7 @@ static int r5l_recovery_log(struct r5l_log *log)
         * 1's seq + 10 and let superblock points to meta2. The same recovery will
         * not think meta 3 is a valid meta, because its seq doesn't match
         */
-        if (ctx.seq > log->last_cp_seq + 1) {
+        if (ctx.seq > log->last_cp_seq) {
                int ret;
                ret = r5l_log_write_empty_meta_block(log, ctx.pos, ctx.seq + 10);
@@ -1096,6 +1096,8 @@ static int r5l_recovery_log(struct r5l_log *log)
                log->seq = ctx.seq + 11;
                log->log_start = r5l_ring_add(log, ctx.pos, BLOCK_SECTORS);
                r5l_write_super(log, ctx.pos);
+                log->last_checkpoint = ctx.pos;
+                log->next_checkpoint = ctx.pos;
        } else {
                log->log_start = ctx.pos;
                log->seq = ctx.seq;
@@ -1154,6 +1156,7 @@ create:
        if (create_super) {
                log->last_cp_seq = prandom_u32();
                cp = 0;
+                r5l_log_write_empty_meta_block(log, cp, log->last_cp_seq);
                /*
                 * Make sure super points to correct address. Log might have
                 * data very soon. If super hasn't correct log tail address,
@@ -1168,6 +1171,7 @@ create:
        if (log->max_free_space > RECLAIM_MAX_FREE_SPACE)
                log->max_free_space = RECLAIM_MAX_FREE_SPACE;
        log->last_checkpoint = cp;
+        log->next_checkpoint = cp;
        __free_page(page);
diff --git a/drivers/media/dvb-frontends/Kconfig b/drivers/media/dvb-frontends/Kconfig
index 012225587c25..b71b747ee0ba 100644
--- a/drivers/media/dvb-frontends/Kconfig
+++ b/drivers/media/dvb-frontends/Kconfig
@@ -513,6 +513,11 @@ config DVB_AS102_FE
        depends on DVB_CORE
        default DVB_AS102
+config DVB_GP8PSK_FE
+        tristate
+        depends on DVB_CORE
+        default DVB_USB_GP8PSK
 comment "DVB-C (cable) frontends"
        depends on DVB_CORE
diff --git a/drivers/media/dvb-frontends/Makefile b/drivers/media/dvb-frontends/Makefile
index e90165ad361b..93921a4eaa27 100644
--- a/drivers/media/dvb-frontends/Makefile
+++ b/drivers/media/dvb-frontends/Makefile
@@ -121,6 +121,7 @@ obj-$(CONFIG_DVB_RTL2832_SDR) += rtl2832_sdr.o
 obj-$(CONFIG_DVB_M88RS2000) += m88rs2000.o
 obj-$(CONFIG_DVB_AF9033) += af9033.o
 obj-$(CONFIG_DVB_AS102_FE) += as102_fe.o
+obj-$(CONFIG_DVB_GP8PSK_FE) += gp8psk-fe.o
 obj-$(CONFIG_DVB_TC90522) += tc90522.o
 obj-$(CONFIG_DVB_HORUS3A) += horus3a.o
 obj-$(CONFIG_DVB_ASCOT2E) += ascot2e.o
diff --git a/drivers/media/usb/dvb-usb/gp8psk-fe.c b/drivers/media/dvb-frontends/gp8psk-fe.c
index db6eb79cde07..93f59bfea092 100644
--- a/drivers/media/usb/dvb-usb/gp8psk-fe.c
+++ b/drivers/media/dvb-frontends/gp8psk-fe.c
@@ -1,5 +1,5 @@
-/* DVB USB compliant Linux driver for the
+/*
- *  - GENPIX 8pks/qpsk/DCII USB2.0 DVB-S module
+ * Frontend driver for the GENPIX 8pks/qpsk/DCII USB2.0 DVB-S module
 *
 * Copyright (C) 2006,2007 Alan Nisota (alannisota@gmail.com)
 * Copyright (C) 2006,2007 Genpix Electronics (genpix@genpix-electronics.com)
@@ -8,17 +8,31 @@
 *
 * This module is based off the vp7045 and vp702x modules
 *
- *      This program is free software; you can redistribute it and/or modify it
+ * This program is free software; you can redistribute it and/or modify it
- *      under the terms of the GNU General Public License as published by the Free
+ * under the terms of the GNU General Public License as published by the Free
- *      Software Foundation, version 2.
+ * Software Foundation, version 2.
- *
- * see Documentation/dvb/README.dvb-usb for more information
 */
-#include "gp8psk.h"
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include "gp8psk-fe.h"
+#include "dvb_frontend.h"
+static int debug;
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
+#define dprintk(fmt, arg...) do {                                       \
+        if (debug)                                                      \
+                printk(KERN_DEBUG pr_fmt("%s: " fmt),                   \
+                       __func__, ##arg);                                \
+} while (0)
 struct gp8psk_fe_state {
        struct dvb_frontend fe;
-        struct dvb_usb_device *d;
+        void *priv;
+        const struct gp8psk_fe_ops *ops;
+        bool is_rev1;
        u8 lock;
        u16 snr;
        unsigned long next_status_check;
@@ -29,22 +43,24 @@ static int gp8psk_tuned_to_DCII(struct dvb_frontend *fe)
 {
        struct gp8psk_fe_state *st = fe->demodulator_priv;
        u8 status;
-        gp8psk_usb_in_op(st->d, GET_8PSK_CONFIG, 0, 0, &status, 1);
+        st->ops->in(st->priv, GET_8PSK_CONFIG, 0, 0, &status, 1);
        return status & bmDCtuned;
 }
 static int gp8psk_set_tuner_mode(struct dvb_frontend *fe, int mode)
 {
-        struct gp8psk_fe_state *state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
-        return gp8psk_usb_out_op(state->d, SET_8PSK_CONFIG, mode, 0, NULL, 0);
+        return st->ops->out(st->priv, SET_8PSK_CONFIG, mode, 0, NULL, 0);
 }
 static int gp8psk_fe_update_status(struct gp8psk_fe_state *st)
 {
        u8 buf[6];
        if (time_after(jiffies,st->next_status_check)) {
-                gp8psk_usb_in_op(st->d, GET_SIGNAL_LOCK, 0,0,&st->lock,1);
+                st->ops->in(st->priv, GET_SIGNAL_LOCK, 0, 0, &st->lock, 1);
-                gp8psk_usb_in_op(st->d, GET_SIGNAL_STRENGTH, 0,0,buf,6);
+                st->ops->in(st->priv, GET_SIGNAL_STRENGTH, 0, 0, buf, 6);
                st->snr = (buf[1]) << 8 | buf[0];
                st->next_status_check = jiffies + (st->status_check_interval*HZ)/1000;
        }
@@ -116,13 +132,12 @@ static int gp8psk_fe_get_tune_settings(struct dvb_frontend* fe, struct dvb_front
 static int gp8psk_fe_set_frontend(struct dvb_frontend *fe)
 {
-        struct gp8psk_fe_state *state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
        struct dtv_frontend_properties *c = &fe->dtv_property_cache;
        u8 cmd[10];
        u32 freq = c->frequency * 1000;
-        int gp_product_id = le16_to_cpu(state->d->udev->descriptor.idProduct);
-        deb_fe("%s()\n", __func__);
+        dprintk("%s()\n", __func__);
        cmd[4] = freq         & 0xff;
        cmd[5] = (freq >> 8)  & 0xff;
@@ -136,21 +151,21 @@ static int gp8psk_fe_set_frontend(struct dvb_frontend *fe)
        switch (c->delivery_system) {
        case SYS_DVBS:
                if (c->modulation != QPSK) {
-                        deb_fe("%s: unsupported modulation selected (%d)\n",
+                        dprintk("%s: unsupported modulation selected (%d)\n",
                                __func__, c->modulation);
                        return -EOPNOTSUPP;
                }
                c->fec_inner = FEC_AUTO;
                break;
        case SYS_DVBS2: /* kept for backwards compatibility */
-                deb_fe("%s: DVB-S2 delivery system selected\n", __func__);
+                dprintk("%s: DVB-S2 delivery system selected\n", __func__);
                break;
        case SYS_TURBO:
-                deb_fe("%s: Turbo-FEC delivery system selected\n", __func__);
+                dprintk("%s: Turbo-FEC delivery system selected\n", __func__);
                break;
        default:
-                deb_fe("%s: unsupported delivery system selected (%d)\n",
+                dprintk("%s: unsupported delivery system selected (%d)\n",
                        __func__, c->delivery_system);
                return -EOPNOTSUPP;
        }
@@ -161,9 +176,9 @@ static int gp8psk_fe_set_frontend(struct dvb_frontend *fe)
        cmd[3] = (c->symbol_rate >> 24) & 0xff;
        switch (c->modulation) {
        case QPSK:
-                if (gp_product_id == USB_PID_GENPIX_8PSK_REV_1_WARM)
+                if (st->is_rev1)
                        if (gp8psk_tuned_to_DCII(fe))
-                                gp8psk_bcm4500_reload(state->d);
+                                st->ops->reload(st->priv);
                switch (c->fec_inner) {
                case FEC_1_2:
                        cmd[9] = 0; break;
@@ -207,18 +222,18 @@ static int gp8psk_fe_set_frontend(struct dvb_frontend *fe)
                cmd[9] = 0;
                break;
        default: /* Unknown modulation */
-                deb_fe("%s: unsupported modulation selected (%d)\n",
+                dprintk("%s: unsupported modulation selected (%d)\n",
                        __func__, c->modulation);
                return -EOPNOTSUPP;
        }
-        if (gp_product_id == USB_PID_GENPIX_8PSK_REV_1_WARM)
+        if (st->is_rev1)
                gp8psk_set_tuner_mode(fe, 0);
-        gp8psk_usb_out_op(state->d, TUNE_8PSK, 0, 0, cmd, 10);
+        st->ops->out(st->priv, TUNE_8PSK, 0, 0, cmd, 10);
-        state->lock = 0;
+        st->lock = 0;
-        state->next_status_check = jiffies;
+        st->next_status_check = jiffies;
-        state->status_check_interval = 200;
+        st->status_check_interval = 200;
        return 0;
 }
@@ -228,9 +243,9 @@ static int gp8psk_fe_send_diseqc_msg (struct dvb_frontend* fe,
 {
        struct gp8psk_fe_state *st = fe->demodulator_priv;
-        deb_fe("%s\n",__func__);
+        dprintk("%s\n", __func__);
-        if (gp8psk_usb_out_op(st->d,SEND_DISEQC_COMMAND, m->msg[0], 0,
+        if (st->ops->out(st->priv, SEND_DISEQC_COMMAND, m->msg[0], 0,
                        m->msg, m->msg_len)) {
                return -EINVAL;
        }
@@ -243,12 +258,12 @@ static int gp8psk_fe_send_diseqc_burst(struct dvb_frontend *fe,
        struct gp8psk_fe_state *st = fe->demodulator_priv;
        u8 cmd;
-        deb_fe("%s\n",__func__);
+        dprintk("%s\n", __func__);
        /* These commands are certainly wrong */
        cmd = (burst == SEC_MINI_A) ? 0x00 : 0x01;
-        if (gp8psk_usb_out_op(st->d,SEND_DISEQC_COMMAND, cmd, 0,
+        if (st->ops->out(st->priv, SEND_DISEQC_COMMAND, cmd, 0,
                        &cmd, 0)) {
                return -EINVAL;
        }
@@ -258,10 +273,10 @@ static int gp8psk_fe_send_diseqc_burst(struct dvb_frontend *fe,
 static int gp8psk_fe_set_tone(struct dvb_frontend *fe,
                              enum fe_sec_tone_mode tone)
 {
-        struct gp8psk_fe_state* state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
-        if (gp8psk_usb_out_op(state->d,SET_22KHZ_TONE,
+        if (st->ops->out(st->priv, SET_22KHZ_TONE,
-                 (tone == SEC_TONE_ON), 0, NULL, 0)) {
+                         (tone == SEC_TONE_ON), 0, NULL, 0)) {
                return -EINVAL;
        }
        return 0;
@@ -270,9 +285,9 @@ static int gp8psk_fe_set_tone(struct dvb_frontend *fe,
 static int gp8psk_fe_set_voltage(struct dvb_frontend *fe,
                                 enum fe_sec_voltage voltage)
 {
-        struct gp8psk_fe_state* state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
-        if (gp8psk_usb_out_op(state->d,SET_LNB_VOLTAGE,
+        if (st->ops->out(st->priv, SET_LNB_VOLTAGE,
                         voltage == SEC_VOLTAGE_18, 0, NULL, 0)) {
                return -EINVAL;
        }
@@ -281,52 +296,60 @@ static int gp8psk_fe_set_voltage(struct dvb_frontend *fe,
 static int gp8psk_fe_enable_high_lnb_voltage(struct dvb_frontend* fe, long onoff)
 {
-        struct gp8psk_fe_state* state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
-        return gp8psk_usb_out_op(state->d, USE_EXTRA_VOLT, onoff, 0,NULL,0);
+        return st->ops->out(st->priv, USE_EXTRA_VOLT, onoff, 0, NULL, 0);
 }
 static int gp8psk_fe_send_legacy_dish_cmd (struct dvb_frontend* fe, unsigned long sw_cmd)
 {
-        struct gp8psk_fe_state* state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
        u8 cmd = sw_cmd & 0x7f;
-        if (gp8psk_usb_out_op(state->d,SET_DN_SWITCH, cmd, 0,
+        if (st->ops->out(st->priv, SET_DN_SWITCH, cmd, 0, NULL, 0))
-                        NULL, 0)) {
                return -EINVAL;
-        }
-        if (gp8psk_usb_out_op(state->d,SET_LNB_VOLTAGE, !!(sw_cmd & 0x80),
+        if (st->ops->out(st->priv, SET_LNB_VOLTAGE, !!(sw_cmd & 0x80),
-                        0, NULL, 0)) {
+                        0, NULL, 0))
                return -EINVAL;
-        }
        return 0;
 }
 static void gp8psk_fe_release(struct dvb_frontend* fe)
 {
-        struct gp8psk_fe_state *state = fe->demodulator_priv;
+        struct gp8psk_fe_state *st = fe->demodulator_priv;
-        kfree(state);
+        kfree(st);
 }
 static struct dvb_frontend_ops gp8psk_fe_ops;
-struct dvb_frontend * gp8psk_fe_attach(struct dvb_usb_device *d)
+struct dvb_frontend *gp8psk_fe_attach(const struct gp8psk_fe_ops *ops,
+                                      void *priv, bool is_rev1)
 {
-        struct gp8psk_fe_state *s = kzalloc(sizeof(struct gp8psk_fe_state), GFP_KERNEL);
+        struct gp8psk_fe_state *st;
-        if (s == NULL)
-                goto error;
-        s->d = d;
-        memcpy(&s->fe.ops, &gp8psk_fe_ops, sizeof(struct dvb_frontend_ops));
-        s->fe.demodulator_priv = s;
-        goto success;
-error:
-        return NULL;
-success:
-        return &s->fe;
-}
+        if (!ops || !ops->in || !ops->out || !ops->reload) {
+                pr_err("Error! gp8psk-fe ops not defined.\n");
+                return NULL;
+        }
+        st = kzalloc(sizeof(struct gp8psk_fe_state), GFP_KERNEL);
+        if (!st)
+                return NULL;
+        memcpy(&st->fe.ops, &gp8psk_fe_ops, sizeof(struct dvb_frontend_ops));
+        st->fe.demodulator_priv = st;
+        st->ops = ops;
+        st->priv = priv;
+        st->is_rev1 = is_rev1;
+        pr_info("Frontend %sattached\n", is_rev1 ? "revision 1 " : "");
+        return &st->fe;
+}
+EXPORT_SYMBOL_GPL(gp8psk_fe_attach);
 static struct dvb_frontend_ops gp8psk_fe_ops = {
        .delsys = { SYS_DVBS },
@@ -370,3 +393,8 @@ static struct dvb_frontend_ops gp8psk_fe_ops = {
        .dishnetwork_send_legacy_command = gp8psk_fe_send_legacy_dish_cmd,
        .enable_high_lnb_voltage = gp8psk_fe_enable_high_lnb_voltage
 };
+MODULE_AUTHOR("Alan Nisota <alannisota@gamil.com>");
+MODULE_DESCRIPTION("Frontend Driver for Genpix DVB-S");
+MODULE_VERSION("1.1");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb-frontends/gp8psk-fe.h b/drivers/media/dvb-frontends/gp8psk-fe.h
new file mode 100644
index 000000000000..6c7944b1ecd6
--- /dev/null
+++ b/drivers/media/dvb-frontends/gp8psk-fe.h
@@ -0,0 +1,82 @@
+/*
+ * gp8psk_fe driver
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#ifndef GP8PSK_FE_H
+#define GP8PSK_FE_H
+#include <linux/types.h>
+/* gp8psk commands */
+#define GET_8PSK_CONFIG                 0x80    /* in */
+#define SET_8PSK_CONFIG                 0x81
+#define I2C_WRITE                       0x83
+#define I2C_READ                        0x84
+#define ARM_TRANSFER                    0x85
+#define TUNE_8PSK                       0x86
+#define GET_SIGNAL_STRENGTH             0x87    /* in */
+#define LOAD_BCM4500                    0x88
+#define BOOT_8PSK                       0x89    /* in */
+#define START_INTERSIL                  0x8A    /* in */
+#define SET_LNB_VOLTAGE                 0x8B
+#define SET_22KHZ_TONE                  0x8C
+#define SEND_DISEQC_COMMAND             0x8D
+#define SET_DVB_MODE                    0x8E
+#define SET_DN_SWITCH                   0x8F
+#define GET_SIGNAL_LOCK                 0x90    /* in */
+#define GET_FW_VERS                     0x92
+#define GET_SERIAL_NUMBER               0x93    /* in */
+#define USE_EXTRA_VOLT                  0x94
+#define GET_FPGA_VERS                   0x95
+#define CW3K_INIT                       0x9d
+/* PSK_configuration bits */
+#define bm8pskStarted                   0x01
+#define bm8pskFW_Loaded                 0x02
+#define bmIntersilOn                    0x04
+#define bmDVBmode                       0x08
+#define bm22kHz                         0x10
+#define bmSEL18V                        0x20
+#define bmDCtuned                       0x40
+#define bmArmed                         0x80
+/* Satellite modulation modes */
+#define ADV_MOD_DVB_QPSK 0     /* DVB-S QPSK */
+#define ADV_MOD_TURBO_QPSK 1   /* Turbo QPSK */
+#define ADV_MOD_TURBO_8PSK 2   /* Turbo 8PSK (also used for Trellis 8PSK) */
+#define ADV_MOD_TURBO_16QAM 3  /* Turbo 16QAM (also used for Trellis 8PSK) */
+#define ADV_MOD_DCII_C_QPSK 4  /* Digicipher II Combo */
+#define ADV_MOD_DCII_I_QPSK 5  /* Digicipher II I-stream */
+#define ADV_MOD_DCII_Q_QPSK 6  /* Digicipher II Q-stream */
+#define ADV_MOD_DCII_C_OQPSK 7 /* Digicipher II offset QPSK */
+#define ADV_MOD_DSS_QPSK 8     /* DSS (DIRECTV) QPSK */
+#define ADV_MOD_DVB_BPSK 9     /* DVB-S BPSK */
+/* firmware revision id's */
+#define GP8PSK_FW_REV1                  0x020604
+#define GP8PSK_FW_REV2                  0x020704
+#define GP8PSK_FW_VERS(_fw_vers) \
+        ((_fw_vers)[2]<<0x10 | (_fw_vers)[1]<<0x08 | (_fw_vers)[0])
+struct gp8psk_fe_ops {
+        int (*in)(void *priv, u8 req, u16 value, u16 index, u8 *b, int blen);
+        int (*out)(void *priv, u8 req, u16 value, u16 index, u8 *b, int blen);
+        int (*reload)(void *priv);
+};
+struct dvb_frontend *gp8psk_fe_attach(const struct gp8psk_fe_ops *ops,
+                                      void *priv, bool is_rev1);
+#endif
diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
index f95a6bc839d5..cede3975d04b 100644
--- a/drivers/media/i2c/ir-kbd-i2c.c
+++ b/drivers/media/i2c/ir-kbd-i2c.c
@@ -118,7 +118,7 @@ static int get_key_haup_common(struct IR_i2c *ir, enum rc_type *protocol,
                        *protocol = RC_TYPE_RC6_MCE;
                        dev &= 0x7f;
                        dprintk(1, "ir hauppauge (rc6-mce): t%d vendor=%d dev=%d code=%d\n",
-                                                toggle, vendor, dev, code);
+                                                *ptoggle, vendor, dev, code);
                } else {
                        *ptoggle = 0;
                        *protocol = RC_TYPE_RC6_6A_32;
diff --git a/drivers/media/pci/ivtv/ivtv-udma.c b/drivers/media/pci/ivtv/ivtv-udma.c
index 4769469fe842..2c9232ef7baa 100644
--- a/drivers/media/pci/ivtv/ivtv-udma.c
+++ b/drivers/media/pci/ivtv/ivtv-udma.c
@@ -124,8 +124,8 @@ int ivtv_udma_setup(struct ivtv *itv, unsigned long ivtv_dest_addr,
        }
        /* Get user pages for DMA Xfer */
-        err = get_user_pages_unlocked(user_dma.uaddr, user_dma.page_count, 0,
+        err = get_user_pages_unlocked(user_dma.uaddr, user_dma.page_count,
-                        1, dma->map);
+                        dma->map, FOLL_FORCE);
        if (user_dma.page_count != err) {
                IVTV_DEBUG_WARN("failed to map user pages, returned %d instead of %d\n",
diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c
index b094054cda6e..f7299d3d8244 100644
--- a/drivers/media/pci/ivtv/ivtv-yuv.c
+++ b/drivers/media/pci/ivtv/ivtv-yuv.c
@@ -76,11 +76,12 @@ static int ivtv_yuv_prep_user_dma(struct ivtv *itv, struct ivtv_user_dma *dma,
        /* Get user pages for DMA Xfer */
        y_pages = get_user_pages_unlocked(y_dma.uaddr,
-                        y_dma.page_count, 0, 1, &dma->map[0]);
+                        y_dma.page_count, &dma->map[0], FOLL_FORCE);
        uv_pages = 0; /* silence gcc. value is set and consumed only if: */
        if (y_pages == y_dma.page_count) {
                uv_pages = get_user_pages_unlocked(uv_dma.uaddr,
-                                uv_dma.page_count, 0, 1, &dma->map[y_pages]);
+                                uv_dma.page_count, &dma->map[y_pages],
+                                FOLL_FORCE);
        }
        if (y_pages != y_dma.page_count || uv_pages != uv_dma.page_count) {
diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
index e668dde6d857..a31b95cb3b09 100644
--- a/drivers/media/platform/omap/omap_vout.c
+++ b/drivers/media/platform/omap/omap_vout.c
@@ -214,7 +214,7 @@ static int omap_vout_get_userptr(struct videobuf_buffer *vb, u32 virtp,
        if (!vec)
                return -ENOMEM;
-        ret = get_vaddr_frames(virtp, 1, true, false, vec);
+        ret = get_vaddr_frames(virtp, 1, FOLL_WRITE, vec);
        if (ret != 1) {
                frame_vector_destroy(vec);
                return -EINVAL;
diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c
index 317ef63ee789..8d96a22647b3 100644
--- a/drivers/media/tuners/tuner-xc2028.c
+++ b/drivers/media/tuners/tuner-xc2028.c
@@ -281,6 +281,14 @@ static void free_firmware(struct xc2028_data *priv)
        int i;
        tuner_dbg("%s called\n", __func__);
+        /* free allocated f/w string */
+        if (priv->fname != firmware_name)
+                kfree(priv->fname);
+        priv->fname = NULL;
+        priv->state = XC2028_NO_FIRMWARE;
+        memset(&priv->cur_fw, 0, sizeof(priv->cur_fw));
        if (!priv->firm)
                return;
@@ -291,9 +299,6 @@ static void free_firmware(struct xc2028_data *priv)
        priv->firm = NULL;
        priv->firm_size = 0;
-        priv->state = XC2028_NO_FIRMWARE;
-        memset(&priv->cur_fw, 0, sizeof(priv->cur_fw));
 }
 static int load_all_firmwares(struct dvb_frontend *fe,
@@ -884,9 +889,8 @@ read_not_reliable:
        return 0;
 fail:
-        priv->state = XC2028_NO_FIRMWARE;
+        free_firmware(priv);
-        memset(&priv->cur_fw, 0, sizeof(priv->cur_fw));
        if (retry_count < 8) {
                msleep(50);
                retry_count++;
@@ -1332,11 +1336,8 @@ static int xc2028_dvb_release(struct dvb_frontend *fe)
        mutex_lock(&xc2028_list_mutex);
        /* only perform final cleanup if this is the last instance */
-        if (hybrid_tuner_report_instance_count(priv) == 1) {
+        if (hybrid_tuner_report_instance_count(priv) == 1)
                free_firmware(priv);
-                kfree(priv->ctrl.fname);
-                priv->ctrl.fname = NULL;
-        }
        if (priv)
                hybrid_tuner_release_state(priv);
@@ -1399,19 +1400,8 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg)
        /*
         * Copy the config data.
-         * For the firmware name, keep a local copy of the string,
-         * in order to avoid troubles during device release.
         */
-        kfree(priv->ctrl.fname);
-        priv->ctrl.fname = NULL;
        memcpy(&priv->ctrl, p, sizeof(priv->ctrl));
-        if (p->fname) {
-                priv->ctrl.fname = kstrdup(p->fname, GFP_KERNEL);
-                if (priv->ctrl.fname == NULL) {
-                        rc = -ENOMEM;
-                        goto unlock;
-                }
-        }
        /*
         * If firmware name changed, frees firmware. As free_firmware will
@@ -1426,10 +1416,15 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg)
        if (priv->state == XC2028_NO_FIRMWARE) {
                if (!firmware_name[0])
-                        priv->fname = priv->ctrl.fname;
+                        priv->fname = kstrdup(p->fname, GFP_KERNEL);
                else
                        priv->fname = firmware_name;
+                if (!priv->fname) {
+                        rc = -ENOMEM;
+                        goto unlock;
+                }
                rc = request_firmware_nowait(THIS_MODULE, 1,
                                             priv->fname,
                                             priv->i2c_props.adap->dev.parent,
diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
index d4bdba60b0f7..52bc42da8a4c 100644
--- a/drivers/media/usb/b2c2/flexcop-usb.c
+++ b/drivers/media/usb/b2c2/flexcop-usb.c
@@ -73,23 +73,34 @@ static int flexcop_usb_readwrite_dw(struct flexcop_device *fc, u16 wRegOffsPCI,
        u8 request_type = (read ? USB_DIR_IN : USB_DIR_OUT) | USB_TYPE_VENDOR;
        u8 wAddress = B2C2_FLEX_PCIOFFSET_TO_INTERNALADDR(wRegOffsPCI) |
                (read ? 0x80 : 0);
+        int ret;
+        mutex_lock(&fc_usb->data_mutex);
+        if (!read)
+                memcpy(fc_usb->data, val, sizeof(*val));
-        int len = usb_control_msg(fc_usb->udev,
+        ret = usb_control_msg(fc_usb->udev,
                        read ? B2C2_USB_CTRL_PIPE_IN : B2C2_USB_CTRL_PIPE_OUT,
                        request,
                        request_type, /* 0xc0 read or 0x40 write */
                        wAddress,
                        0,
-                        val,
+                        fc_usb->data,
                        sizeof(u32),
                        B2C2_WAIT_FOR_OPERATION_RDW * HZ);
-        if (len != sizeof(u32)) {
+        if (ret != sizeof(u32)) {
                err("error while %s dword from %d (%d).", read ? "reading" :
                                "writing", wAddress, wRegOffsPCI);
-                return -EIO;
+                if (ret >= 0)
+                        ret = -EIO;
        }
-        return 0;
+        if (read && ret >= 0)
+                memcpy(val, fc_usb->data, sizeof(*val));
+        mutex_unlock(&fc_usb->data_mutex);
+        return ret;
 }
 /*
 * DKT 010817 - add support for V8 memory read/write and flash update
@@ -100,9 +111,14 @@ static int flexcop_usb_v8_memory_req(struct flexcop_usb *fc_usb,
 {
        u8 request_type = USB_TYPE_VENDOR;
        u16 wIndex;
-        int nWaitTime, pipe, len;
+        int nWaitTime, pipe, ret;
        wIndex = page << 8;
+        if (buflen > sizeof(fc_usb->data)) {
+                err("Buffer size bigger than max URB control message\n");
+                return -EIO;
+        }
        switch (req) {
        case B2C2_USB_READ_V8_MEM:
                nWaitTime = B2C2_WAIT_FOR_OPERATION_V8READ;
@@ -127,17 +143,32 @@ static int flexcop_usb_v8_memory_req(struct flexcop_usb *fc_usb,
        deb_v8("v8mem: %02x %02x %04x %04x, len: %d\n", request_type, req,
                        wAddress, wIndex, buflen);
-        len = usb_control_msg(fc_usb->udev, pipe,
+        mutex_lock(&fc_usb->data_mutex);
+        if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_OUT)
+                memcpy(fc_usb->data, pbBuffer, buflen);
+        ret = usb_control_msg(fc_usb->udev, pipe,
                        req,
                        request_type,
                        wAddress,
                        wIndex,
-                        pbBuffer,
+                        fc_usb->data,
                        buflen,
                        nWaitTime * HZ);
+        if (ret != buflen)
+                ret = -EIO;
+        if (ret >= 0) {
+                ret = 0;
+                if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN)
+                        memcpy(pbBuffer, fc_usb->data, buflen);
+        }
-        debug_dump(pbBuffer, len, deb_v8);
+        mutex_unlock(&fc_usb->data_mutex);
-        return len == buflen ? 0 : -EIO;
+        debug_dump(pbBuffer, ret, deb_v8);
+        return ret;
 }
 #define bytes_left_to_read_on_page(paddr,buflen) \
@@ -196,29 +227,6 @@ static int flexcop_usb_get_mac_addr(struct flexcop_device *fc, int extended)
                fc->dvb_adapter.proposed_mac, 6);
 }
-#if 0
-static int flexcop_usb_utility_req(struct flexcop_usb *fc_usb, int set,
-                flexcop_usb_utility_function_t func, u8 extra, u16 wIndex,
-                u16 buflen, u8 *pvBuffer)
-{
-        u16 wValue;
-        u8 request_type = (set ? USB_DIR_OUT : USB_DIR_IN) | USB_TYPE_VENDOR;
-        int nWaitTime = 2,
-            pipe = set ? B2C2_USB_CTRL_PIPE_OUT : B2C2_USB_CTRL_PIPE_IN, len;
-        wValue = (func << 8) | extra;
-        len = usb_control_msg(fc_usb->udev,pipe,
-                        B2C2_USB_UTILITY,
-                        request_type,
-                        wValue,
-                        wIndex,
-                        pvBuffer,
-                        buflen,
-                        nWaitTime * HZ);
-        return len == buflen ? 0 : -EIO;
-}
-#endif
 /* usb i2c stuff */
 static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c,
                flexcop_usb_request_t req, flexcop_usb_i2c_function_t func,
@@ -226,9 +234,14 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c,
 {
        struct flexcop_usb *fc_usb = i2c->fc->bus_specific;
        u16 wValue, wIndex;
-        int nWaitTime,pipe,len;
+        int nWaitTime, pipe, ret;
        u8 request_type = USB_TYPE_VENDOR;
+        if (buflen > sizeof(fc_usb->data)) {
+                err("Buffer size bigger than max URB control message\n");
+                return -EIO;
+        }
        switch (func) {
        case USB_FUNC_I2C_WRITE:
        case USB_FUNC_I2C_MULTIWRITE:
@@ -257,15 +270,32 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c,
                        wValue & 0xff, wValue >> 8,
                        wIndex & 0xff, wIndex >> 8);
-        len = usb_control_msg(fc_usb->udev,pipe,
+        mutex_lock(&fc_usb->data_mutex);
+        if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_OUT)
+                memcpy(fc_usb->data, buf, buflen);
+        ret = usb_control_msg(fc_usb->udev, pipe,
                        req,
                        request_type,
                        wValue,
                        wIndex,
-                        buf,
+                        fc_usb->data,
                        buflen,
                        nWaitTime * HZ);
-        return len == buflen ? 0 : -EREMOTEIO;
+        if (ret != buflen)
+                ret = -EIO;
+        if (ret >= 0) {
+                ret = 0;
+                if ((request_type & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN)
+                        memcpy(buf, fc_usb->data, buflen);
+        }
+        mutex_unlock(&fc_usb->data_mutex);
+        return 0;
 }
 /* actual bus specific access functions,
@@ -516,6 +546,7 @@ static int flexcop_usb_probe(struct usb_interface *intf,
        /* general flexcop init */
        fc_usb = fc->bus_specific;
        fc_usb->fc_dev = fc;
+        mutex_init(&fc_usb->data_mutex);
        fc->read_ibi_reg  = flexcop_usb_read_ibi_reg;
        fc->write_ibi_reg = flexcop_usb_write_ibi_reg;
diff --git a/drivers/media/usb/b2c2/flexcop-usb.h b/drivers/media/usb/b2c2/flexcop-usb.h
index 92529a9c4475..25ad43166e78 100644
--- a/drivers/media/usb/b2c2/flexcop-usb.h
+++ b/drivers/media/usb/b2c2/flexcop-usb.h
@@ -29,6 +29,10 @@ struct flexcop_usb {
        u8 tmp_buffer[1023+190];
        int tmp_buffer_length;
+        /* for URB control messages */
+        u8 data[80];
+        struct mutex data_mutex;
 };
 #if 0
diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
index 13620cdf0599..e9100a235831 100644
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -545,18 +545,30 @@ static void free_sbufs(struct camera_data *cam)
 static int write_packet(struct usb_device *udev,
                        u8 request, u8 * registers, u16 start, size_t size)
 {
+        unsigned char *buf;
+        int ret;
        if (!registers || size <= 0)
                return -EINVAL;
-        return usb_control_msg(udev,
+        buf = kmalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        memcpy(buf, registers, size);
+        ret = usb_control_msg(udev,
                               usb_sndctrlpipe(udev, 0),
                               request,
                               USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                               start,   /* value */
                               0,       /* index */
-                               registers,       /* buffer */
+                               buf,     /* buffer */
                               size,
                               HZ);
+        kfree(buf);
+        return ret;
 }
 /****************************************************************************
@@ -567,18 +579,32 @@ static int write_packet(struct usb_device *udev,
 static int read_packet(struct usb_device *udev,
                       u8 request, u8 * registers, u16 start, size_t size)
 {
+        unsigned char *buf;
+        int ret;
        if (!registers || size <= 0)
                return -EINVAL;
-        return usb_control_msg(udev,
+        buf = kmalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        ret = usb_control_msg(udev,
                               usb_rcvctrlpipe(udev, 0),
                               request,
                               USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_DEVICE,
                               start,   /* value */
                               0,       /* index */
-                               registers,       /* buffer */
+                               buf,     /* buffer */
                               size,
                               HZ);
+        if (ret >= 0)
+                memcpy(registers, buf, size);
+        kfree(buf);
+        return ret;
 }
 /******************************************************************************
diff --git a/drivers/media/usb/dvb-usb/Makefile b/drivers/media/usb/dvb-usb/Makefile
index 2a7b5a963acf..3b3f32b426d1 100644
--- a/drivers/media/usb/dvb-usb/Makefile
+++ b/drivers/media/usb/dvb-usb/Makefile
@@ -8,7 +8,7 @@ obj-$(CONFIG_DVB_USB_VP7045) += dvb-usb-vp7045.o
 dvb-usb-vp702x-objs := vp702x.o vp702x-fe.o
 obj-$(CONFIG_DVB_USB_VP702X) += dvb-usb-vp702x.o
-dvb-usb-gp8psk-objs := gp8psk.o gp8psk-fe.o
+dvb-usb-gp8psk-objs := gp8psk.o
 obj-$(CONFIG_DVB_USB_GP8PSK) += dvb-usb-gp8psk.o
 dvb-usb-dtt200u-objs := dtt200u.o dtt200u-fe.o
diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
index efa782ed6e2d..7853261906b1 100644
--- a/drivers/media/usb/dvb-usb/af9005.c
+++ b/drivers/media/usb/dvb-usb/af9005.c
@@ -52,17 +52,15 @@ u8 regmask[8] = { 0x01, 0x03, 0x07, 0x0f, 0x1f, 0x3f, 0x7f, 0xff };
 struct af9005_device_state {
        u8 sequence;
        int led_state;
+        unsigned char data[256];
 };
 static int af9005_generic_read_write(struct dvb_usb_device *d, u16 reg,
                              int readwrite, int type, u8 * values, int len)
 {
        struct af9005_device_state *st = d->priv;
-        u8 obuf[16] = { 0 };
+        u8 command, seq;
-        u8 ibuf[17] = { 0 };
+        int i, ret;
-        u8 command;
-        int i;
-        int ret;
        if (len < 1) {
                err("generic read/write, less than 1 byte. Makes no sense.");
@@ -73,16 +71,17 @@ static int af9005_generic_read_write(struct dvb_usb_device *d, u16 reg,
                return -EINVAL;
        }
-        obuf[0] = 14;           /* rest of buffer length low */
+        mutex_lock(&d->data_mutex);
-        obuf[1] = 0;            /* rest of buffer length high */
+        st->data[0] = 14;               /* rest of buffer length low */
+        st->data[1] = 0;                /* rest of buffer length high */
-        obuf[2] = AF9005_REGISTER_RW;   /* register operation */
+        st->data[2] = AF9005_REGISTER_RW;       /* register operation */
-        obuf[3] = 12;           /* rest of buffer length */
+        st->data[3] = 12;               /* rest of buffer length */
-        obuf[4] = st->sequence++;       /* sequence number */
+        st->data[4] = seq = st->sequence++;     /* sequence number */
-        obuf[5] = (u8) (reg >> 8);      /* register address */
+        st->data[5] = (u8) (reg >> 8);  /* register address */
-        obuf[6] = (u8) (reg & 0xff);
+        st->data[6] = (u8) (reg & 0xff);
        if (type == AF9005_OFDM_REG) {
                command = AF9005_CMD_OFDM_REG;
@@ -96,51 +95,52 @@ static int af9005_generic_read_write(struct dvb_usb_device *d, u16 reg,
        command |= readwrite;
        if (readwrite == AF9005_CMD_WRITE)
                for (i = 0; i < len; i++)
-                        obuf[8 + i] = values[i];
+                        st->data[8 + i] = values[i];
        else if (type == AF9005_TUNER_REG)
                /* read command for tuner, the first byte contains the i2c address */
-                obuf[8] = values[0];
+                st->data[8] = values[0];
-        obuf[7] = command;
+        st->data[7] = command;
-        ret = dvb_usb_generic_rw(d, obuf, 16, ibuf, 17, 0);
+        ret = dvb_usb_generic_rw(d, st->data, 16, st->data, 17, 0);
        if (ret)
-                return ret;
+                goto ret;
        /* sanity check */
-        if (ibuf[2] != AF9005_REGISTER_RW_ACK) {
+        if (st->data[2] != AF9005_REGISTER_RW_ACK) {
                err("generic read/write, wrong reply code.");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
        }
-        if (ibuf[3] != 0x0d) {
+        if (st->data[3] != 0x0d) {
                err("generic read/write, wrong length in reply.");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
        }
-        if (ibuf[4] != obuf[4]) {
+        if (st->data[4] != seq) {
                err("generic read/write, wrong sequence in reply.");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
        }
        /*
-           Windows driver doesn't check these fields, in fact sometimes
+         * In thesis, both input and output buffers should have
-           the register in the reply is different that what has been sent
+         * identical values for st->data[5] to st->data[8].
+         * However, windows driver doesn't check these fields, in fact
-           if (ibuf[5] != obuf[5] || ibuf[6] != obuf[6]) {
+         * sometimes the register in the reply is different that what
-           err("generic read/write, wrong register in reply.");
+         * has been sent
-           return -EIO;
-           }
-           if (ibuf[7] != command) {
-           err("generic read/write wrong command in reply.");
-           return -EIO;
-           }
         */
-        if (ibuf[16] != 0x01) {
+        if (st->data[16] != 0x01) {
                err("generic read/write wrong status code in reply.");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
        }
        if (readwrite == AF9005_CMD_READ)
                for (i = 0; i < len; i++)
-                        values[i] = ibuf[8 + i];
+                        values[i] = st->data[8 + i];
-        return 0;
+ret:
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
@@ -464,8 +464,7 @@ int af9005_send_command(struct dvb_usb_device *d, u8 command, u8 * wbuf,
        struct af9005_device_state *st = d->priv;
        int ret, i, packet_len;
-        u8 buf[64];
+        u8 seq;
-        u8 ibuf[64];
        if (wlen < 0) {
                err("send command, wlen less than 0 bytes. Makes no sense.");
@@ -480,94 +479,97 @@ int af9005_send_command(struct dvb_usb_device *d, u8 command, u8 * wbuf,
                return -EINVAL;
        }
        packet_len = wlen + 5;
-        buf[0] = (u8) (packet_len & 0xff);
-        buf[1] = (u8) ((packet_len & 0xff00) >> 8);
+        mutex_lock(&d->data_mutex);
-        buf[2] = 0x26;          /* packet type */
+        st->data[0] = (u8) (packet_len & 0xff);
-        buf[3] = wlen + 3;
+        st->data[1] = (u8) ((packet_len & 0xff00) >> 8);
-        buf[4] = st->sequence++;
-        buf[5] = command;
+        st->data[2] = 0x26;             /* packet type */
-        buf[6] = wlen;
+        st->data[3] = wlen + 3;
+        st->data[4] = seq = st->sequence++;
+        st->data[5] = command;
+        st->data[6] = wlen;
        for (i = 0; i < wlen; i++)
-                buf[7 + i] = wbuf[i];
+                st->data[7 + i] = wbuf[i];
-        ret = dvb_usb_generic_rw(d, buf, wlen + 7, ibuf, rlen + 7, 0);
+        ret = dvb_usb_generic_rw(d, st->data, wlen + 7, st->data, rlen + 7, 0);
-        if (ret)
+        if (st->data[2] != 0x27) {
-                return ret;
-        if (ibuf[2] != 0x27) {
                err("send command, wrong reply code.");
-                return -EIO;
+                ret = -EIO;
-        }
+        } else if (st->data[4] != seq) {
-        if (ibuf[4] != buf[4]) {
                err("send command, wrong sequence in reply.");
-                return -EIO;
+                ret = -EIO;
-        }
+        } else if (st->data[5] != 0x01) {
-        if (ibuf[5] != 0x01) {
                err("send command, wrong status code in reply.");
-                return -EIO;
+                ret = -EIO;
-        }
+        } else if (st->data[6] != rlen) {
-        if (ibuf[6] != rlen) {
                err("send command, invalid data length in reply.");
-                return -EIO;
+                ret = -EIO;
        }
-        for (i = 0; i < rlen; i++)
+        if (!ret) {
-                rbuf[i] = ibuf[i + 7];
+                for (i = 0; i < rlen; i++)
-        return 0;
+                        rbuf[i] = st->data[i + 7];
+        }
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 int af9005_read_eeprom(struct dvb_usb_device *d, u8 address, u8 * values,
                       int len)
 {
        struct af9005_device_state *st = d->priv;
-        u8 obuf[16], ibuf[14];
+        u8 seq;
        int ret, i;
-        memset(obuf, 0, sizeof(obuf));
+        mutex_lock(&d->data_mutex);
-        memset(ibuf, 0, sizeof(ibuf));
-        obuf[0] = 14;           /* length of rest of packet low */
+        memset(st->data, 0, sizeof(st->data));
-        obuf[1] = 0;            /* length of rest of packer high */
-        obuf[2] = 0x2a;         /* read/write eeprom */
+        st->data[0] = 14;               /* length of rest of packet low */
+        st->data[1] = 0;                /* length of rest of packer high */
-        obuf[3] = 12;           /* size */
+        st->data[2] = 0x2a;             /* read/write eeprom */
-        obuf[4] = st->sequence++;
+        st->data[3] = 12;               /* size */
-        obuf[5] = 0;            /* read */
+        st->data[4] = seq = st->sequence++;
-        obuf[6] = len;
+        st->data[5] = 0;                /* read */
-        obuf[7] = address;
-        ret = dvb_usb_generic_rw(d, obuf, 16, ibuf, 14, 0);
+        st->data[6] = len;
-        if (ret)
+        st->data[7] = address;
-                return ret;
+        ret = dvb_usb_generic_rw(d, st->data, 16, st->data, 14, 0);
-        if (ibuf[2] != 0x2b) {
+        if (st->data[2] != 0x2b) {
                err("Read eeprom, invalid reply code");
-                return -EIO;
+                ret = -EIO;
-        }
+        } else if (st->data[3] != 10) {
-        if (ibuf[3] != 10) {
                err("Read eeprom, invalid reply length");
-                return -EIO;
+                ret = -EIO;
-        }
+        } else if (st->data[4] != seq) {
-        if (ibuf[4] != obuf[4]) {
                err("Read eeprom, wrong sequence in reply ");
-                return -EIO;
+                ret = -EIO;
-        }
+        } else if (st->data[5] != 1) {
-        if (ibuf[5] != 1) {
                err("Read eeprom, wrong status in reply ");
-                return -EIO;
+                ret = -EIO;
        }
-        for (i = 0; i < len; i++) {
-                values[i] = ibuf[6 + i];
+        if (!ret) {
+                for (i = 0; i < len; i++)
+                        values[i] = st->data[6 + i];
        }
-        return 0;
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
-static int af9005_boot_packet(struct usb_device *udev, int type, u8 * reply)
+static int af9005_boot_packet(struct usb_device *udev, int type, u8 *reply,
+                              u8 *buf, int size)
 {
-        u8 buf[FW_BULKOUT_SIZE + 2];
        u16 checksum;
        int act_len, i, ret;
-        memset(buf, 0, sizeof(buf));
+        memset(buf, 0, size);
        buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff);
        buf[1] = (u8) ((FW_BULKOUT_SIZE >> 8) & 0xff);
        switch (type) {
@@ -720,15 +722,21 @@ static int af9005_download_firmware(struct usb_device *udev, const struct firmwa
 {
        int i, packets, ret, act_len;
-        u8 buf[FW_BULKOUT_SIZE + 2];
+        u8 *buf;
        u8 reply;
-        ret = af9005_boot_packet(udev, FW_CONFIG, &reply);
+        buf = kmalloc(FW_BULKOUT_SIZE + 2, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        ret = af9005_boot_packet(udev, FW_CONFIG, &reply, buf,
+                                 FW_BULKOUT_SIZE + 2);
        if (ret)
-                return ret;
+                goto err;
        if (reply != 0x01) {
                err("before downloading firmware, FW_CONFIG expected 0x01, received 0x%x", reply);
-                return -EIO;
+                ret = -EIO;
+                goto err;
        }
        packets = fw->size / FW_BULKOUT_SIZE;
        buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff);
@@ -743,28 +751,35 @@ static int af9005_download_firmware(struct usb_device *udev, const struct firmwa
                                   buf, FW_BULKOUT_SIZE + 2, &act_len, 1000);
                if (ret) {
                        err("firmware download failed at packet %d with code %d", i, ret);
-                        return ret;
+                        goto err;
                }
        }
-        ret = af9005_boot_packet(udev, FW_CONFIRM, &reply);
+        ret = af9005_boot_packet(udev, FW_CONFIRM, &reply,
+                                 buf, FW_BULKOUT_SIZE + 2);
        if (ret)
-                return ret;
+                goto err;
        if (reply != (u8) (packets & 0xff)) {
                err("after downloading firmware, FW_CONFIRM expected 0x%x, received 0x%x", packets & 0xff, reply);
-                return -EIO;
+                ret = -EIO;
+                goto err;
        }
-        ret = af9005_boot_packet(udev, FW_BOOT, &reply);
+        ret = af9005_boot_packet(udev, FW_BOOT, &reply, buf,
+                                 FW_BULKOUT_SIZE + 2);
        if (ret)
-                return ret;
+                goto err;
-        ret = af9005_boot_packet(udev, FW_CONFIG, &reply);
+        ret = af9005_boot_packet(udev, FW_CONFIG, &reply, buf,
+                                 FW_BULKOUT_SIZE + 2);
        if (ret)
-                return ret;
+                goto err;
        if (reply != 0x02) {
                err("after downloading firmware, FW_CONFIG expected 0x02, received 0x%x", reply);
-                return -EIO;
+                ret = -EIO;
+                goto err;
        }
-        return 0;
+err:
+        kfree(buf);
+        return ret;
 }
@@ -823,53 +838,59 @@ static int af9005_rc_query(struct dvb_usb_device *d, u32 * event, int *state)
 {
        struct af9005_device_state *st = d->priv;
        int ret, len;
+        u8 seq;
-        u8 obuf[5];
-        u8 ibuf[256];
        *state = REMOTE_NO_KEY_PRESSED;
        if (rc_decode == NULL) {
                /* it shouldn't never come here */
                return 0;
        }
+        mutex_lock(&d->data_mutex);
        /* deb_info("rc_query\n"); */
-        obuf[0] = 3;            /* rest of packet length low */
+        st->data[0] = 3;                /* rest of packet length low */
-        obuf[1] = 0;            /* rest of packet lentgh high */
+        st->data[1] = 0;                /* rest of packet lentgh high */
-        obuf[2] = 0x40;         /* read remote */
+        st->data[2] = 0x40;             /* read remote */
-        obuf[3] = 1;            /* rest of packet length */
+        st->data[3] = 1;                /* rest of packet length */
-        obuf[4] = st->sequence++;       /* sequence number */
+        st->data[4] = seq = st->sequence++;     /* sequence number */
-        ret = dvb_usb_generic_rw(d, obuf, 5, ibuf, 256, 0);
+        ret = dvb_usb_generic_rw(d, st->data, 5, st->data, 256, 0);
        if (ret) {
                err("rc query failed");
-                return ret;
+                goto ret;
        }
-        if (ibuf[2] != 0x41) {
+        if (st->data[2] != 0x41) {
                err("rc query bad header.");
-                return -EIO;
+                ret = -EIO;
-        }
+                goto ret;
-        if (ibuf[4] != obuf[4]) {
+        } else if (st->data[4] != seq) {
                err("rc query bad sequence.");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
        }
-        len = ibuf[5];
+        len = st->data[5];
        if (len > 246) {
                err("rc query invalid length");
-                return -EIO;
+                ret = -EIO;
+                goto ret;
        }
        if (len > 0) {
                deb_rc("rc data (%d) ", len);
-                debug_dump((ibuf + 6), len, deb_rc);
+                debug_dump((st->data + 6), len, deb_rc);
-                ret = rc_decode(d, &ibuf[6], len, event, state);
+                ret = rc_decode(d, &st->data[6], len, event, state);
                if (ret) {
                        err("rc_decode failed");
-                        return ret;
+                        goto ret;
                } else {
                        deb_rc("rc_decode state %x event %x\n", *state, *event);
                        if (*state == REMOTE_KEY_REPEAT)
                                *event = d->last_event;
                }
        }
-        return 0;
+ret:
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 static int af9005_power_ctrl(struct dvb_usb_device *d, int onoff)
@@ -953,10 +974,16 @@ static int af9005_identify_state(struct usb_device *udev,
                                 int *cold)
 {
        int ret;
-        u8 reply;
+        u8 reply, *buf;
-        ret = af9005_boot_packet(udev, FW_CONFIG, &reply);
+        buf = kmalloc(FW_BULKOUT_SIZE + 2, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        ret = af9005_boot_packet(udev, FW_CONFIG, &reply,
+                                 buf, FW_BULKOUT_SIZE + 2);
        if (ret)
-                return ret;
+                goto err;
        deb_info("result of FW_CONFIG in identify state %d\n", reply);
        if (reply == 0x01)
                *cold = 1;
@@ -965,7 +992,10 @@ static int af9005_identify_state(struct usb_device *udev,
        else
                return -EIO;
        deb_info("Identify state cold = %d\n", *cold);
-        return 0;
+err:
+        kfree(buf);
+        return ret;
 }
 static struct dvb_usb_device_properties af9005_properties;
@@ -974,7 +1004,7 @@ static int af9005_usb_probe(struct usb_interface *intf,
                            const struct usb_device_id *id)
 {
        return dvb_usb_device_init(intf, &af9005_properties,
-                                   THIS_MODULE, NULL, adapter_nr);
+                                  THIS_MODULE, NULL, adapter_nr);
 }
 enum af9005_usb_table_entry {
diff --git a/drivers/media/usb/dvb-usb/cinergyT2-core.c b/drivers/media/usb/dvb-usb/cinergyT2-core.c
index 9fd1527494eb..290275bc7fde 100644
--- a/drivers/media/usb/dvb-usb/cinergyT2-core.c
+++ b/drivers/media/usb/dvb-usb/cinergyT2-core.c
@@ -41,6 +41,7 @@ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 struct cinergyt2_state {
        u8 rc_counter;
+        unsigned char data[64];
 };
 /* We are missing a release hook with usb_device data */
@@ -50,38 +51,57 @@ static struct dvb_usb_device_properties cinergyt2_properties;
 static int cinergyt2_streaming_ctrl(struct dvb_usb_adapter *adap, int enable)
 {
-        char buf[] = { CINERGYT2_EP1_CONTROL_STREAM_TRANSFER, enable ? 1 : 0 };
+        struct dvb_usb_device *d = adap->dev;
-        char result[64];
+        struct cinergyt2_state *st = d->priv;
-        return dvb_usb_generic_rw(adap->dev, buf, sizeof(buf), result,
+        int ret;
-                                sizeof(result), 0);
+        mutex_lock(&d->data_mutex);
+        st->data[0] = CINERGYT2_EP1_CONTROL_STREAM_TRANSFER;
+        st->data[1] = enable ? 1 : 0;
+        ret = dvb_usb_generic_rw(d, st->data, 2, st->data, 64, 0);
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 static int cinergyt2_power_ctrl(struct dvb_usb_device *d, int enable)
 {
-        char buf[] = { CINERGYT2_EP1_SLEEP_MODE, enable ? 0 : 1 };
+        struct cinergyt2_state *st = d->priv;
-        char state[3];
+        int ret;
-        return dvb_usb_generic_rw(d, buf, sizeof(buf), state, sizeof(state), 0);
+        mutex_lock(&d->data_mutex);
+        st->data[0] = CINERGYT2_EP1_SLEEP_MODE;
+        st->data[1] = enable ? 0 : 1;
+        ret = dvb_usb_generic_rw(d, st->data, 2, st->data, 3, 0);
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        char query[] = { CINERGYT2_EP1_GET_FIRMWARE_VERSION };
+        struct dvb_usb_device *d = adap->dev;
-        char state[3];
+        struct cinergyt2_state *st = d->priv;
        int ret;
        adap->fe_adap[0].fe = cinergyt2_fe_attach(adap->dev);
-        ret = dvb_usb_generic_rw(adap->dev, query, sizeof(query), state,
+        mutex_lock(&d->data_mutex);
-                                sizeof(state), 0);
+        st->data[0] = CINERGYT2_EP1_GET_FIRMWARE_VERSION;
+        ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 3, 0);
        if (ret < 0) {
                deb_rc("cinergyt2_power_ctrl() Failed to retrieve sleep "
                        "state info\n");
        }
+        mutex_unlock(&d->data_mutex);
        /* Copy this pointer as we are gonna need it in the release phase */
        cinergyt2_usb_device = adap->dev;
-        return 0;
+        return ret;
 }
 static struct rc_map_table rc_map_cinergyt2_table[] = {
@@ -141,13 +161,18 @@ static int repeatable_keys[] = {
 static int cinergyt2_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 {
        struct cinergyt2_state *st = d->priv;
-        u8 key[5] = {0, 0, 0, 0, 0}, cmd = CINERGYT2_EP1_GET_RC_EVENTS;
+        int i, ret;
-        int i;
        *state = REMOTE_NO_KEY_PRESSED;
-        dvb_usb_generic_rw(d, &cmd, 1, key, sizeof(key), 0);
+        mutex_lock(&d->data_mutex);
-        if (key[4] == 0xff) {
+        st->data[0] = CINERGYT2_EP1_GET_RC_EVENTS;
+        ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 5, 0);
+        if (ret < 0)
+                goto ret;
+        if (st->data[4] == 0xff) {
                /* key repeat */
                st->rc_counter++;
                if (st->rc_counter > RC_REPEAT_DELAY) {
@@ -157,34 +182,36 @@ static int cinergyt2_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
                                        *event = d->last_event;
                                        deb_rc("repeat key, event %x\n",
                                                   *event);
-                                        return 0;
+                                        goto ret;
                                }
                        }
                        deb_rc("repeated key (non repeatable)\n");
                }
-                return 0;
+                goto ret;
        }
        /* hack to pass checksum on the custom field */
-        key[2] = ~key[1];
+        st->data[2] = ~st->data[1];
-        dvb_usb_nec_rc_key_to_event(d, key, event, state);
+        dvb_usb_nec_rc_key_to_event(d, st->data, event, state);
-        if (key[0] != 0) {
+        if (st->data[0] != 0) {
                if (*event != d->last_event)
                        st->rc_counter = 0;
-                deb_rc("key: %*ph\n", 5, key);
+                deb_rc("key: %*ph\n", 5, st->data);
        }
-        return 0;
+ret:
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 static int cinergyt2_usb_probe(struct usb_interface *intf,
                                const struct usb_device_id *id)
 {
        return dvb_usb_device_init(intf, &cinergyt2_properties,
-                                        THIS_MODULE, NULL, adapter_nr);
+                                   THIS_MODULE, NULL, adapter_nr);
 }
 static struct usb_device_id cinergyt2_usb_table[] = {
        { USB_DEVICE(USB_VID_TERRATEC, 0x0038) },
        { 0 }
diff --git a/drivers/media/usb/dvb-usb/cinergyT2-fe.c b/drivers/media/usb/dvb-usb/cinergyT2-fe.c
index b3ec743a7a2e..2d29b4174dba 100644
--- a/drivers/media/usb/dvb-usb/cinergyT2-fe.c
+++ b/drivers/media/usb/dvb-usb/cinergyT2-fe.c
@@ -139,32 +139,42 @@ static uint16_t compute_tps(struct dtv_frontend_properties *op)
 struct cinergyt2_fe_state {
        struct dvb_frontend fe;
        struct dvb_usb_device *d;
+        unsigned char data[64];
+        struct mutex data_mutex;
+        struct dvbt_get_status_msg status;
 };
 static int cinergyt2_fe_read_status(struct dvb_frontend *fe,
                                    enum fe_status *status)
 {
        struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_get_status_msg result;
-        u8 cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
        int ret;
-        ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (u8 *)&result,
+        mutex_lock(&state->data_mutex);
-                        sizeof(result), 0);
+        state->data[0] = CINERGYT2_EP1_GET_TUNER_STATUS;
+        ret = dvb_usb_generic_rw(state->d, state->data, 1,
+                                 state->data, sizeof(state->status), 0);
+        if (!ret)
+                memcpy(&state->status, state->data, sizeof(state->status));
+        mutex_unlock(&state->data_mutex);
        if (ret < 0)
                return ret;
        *status = 0;
-        if (0xffff - le16_to_cpu(result.gain) > 30)
+        if (0xffff - le16_to_cpu(state->status.gain) > 30)
                *status |= FE_HAS_SIGNAL;
-        if (result.lock_bits & (1 << 6))
+        if (state->status.lock_bits & (1 << 6))
                *status |= FE_HAS_LOCK;
-        if (result.lock_bits & (1 << 5))
+        if (state->status.lock_bits & (1 << 5))
                *status |= FE_HAS_SYNC;
-        if (result.lock_bits & (1 << 4))
+        if (state->status.lock_bits & (1 << 4))
                *status |= FE_HAS_CARRIER;
-        if (result.lock_bits & (1 << 1))
+        if (state->status.lock_bits & (1 << 1))
                *status |= FE_HAS_VITERBI;
        if ((*status & (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC)) !=
@@ -177,34 +187,16 @@ static int cinergyt2_fe_read_status(struct dvb_frontend *fe,
 static int cinergyt2_fe_read_ber(struct dvb_frontend *fe, u32 *ber)
 {
        struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_get_status_msg status;
-        char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
-        int ret;
-        ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status,
-                                sizeof(status), 0);
-        if (ret < 0)
-                return ret;
-        *ber = le32_to_cpu(status.viterbi_error_rate);
+        *ber = le32_to_cpu(state->status.viterbi_error_rate);
        return 0;
 }
 static int cinergyt2_fe_read_unc_blocks(struct dvb_frontend *fe, u32 *unc)
 {
        struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_get_status_msg status;
-        u8 cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
-        int ret;
-        ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (u8 *)&status,
+        *unc = le32_to_cpu(state->status.uncorrected_block_count);
-                                sizeof(status), 0);
-        if (ret < 0) {
-                err("cinergyt2_fe_read_unc_blocks() Failed! (Error=%d)\n",
-                        ret);
-                return ret;
-        }
-        *unc = le32_to_cpu(status.uncorrected_block_count);
        return 0;
 }
@@ -212,35 +204,16 @@ static int cinergyt2_fe_read_signal_strength(struct dvb_frontend *fe,
                                                u16 *strength)
 {
        struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_get_status_msg status;
-        char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
-        int ret;
-        ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status,
+        *strength = (0xffff - le16_to_cpu(state->status.gain));
-                                sizeof(status), 0);
-        if (ret < 0) {
-                err("cinergyt2_fe_read_signal_strength() Failed!"
-                        " (Error=%d)\n", ret);
-                return ret;
-        }
-        *strength = (0xffff - le16_to_cpu(status.gain));
        return 0;
 }
 static int cinergyt2_fe_read_snr(struct dvb_frontend *fe, u16 *snr)
 {
        struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_get_status_msg status;
-        char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS };
-        int ret;
-        ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status,
+        *snr = (state->status.snr << 8) | state->status.snr;
-                                sizeof(status), 0);
-        if (ret < 0) {
-                err("cinergyt2_fe_read_snr() Failed! (Error=%d)\n", ret);
-                return ret;
-        }
-        *snr = (status.snr << 8) | status.snr;
        return 0;
 }
@@ -266,34 +239,36 @@ static int cinergyt2_fe_set_frontend(struct dvb_frontend *fe)
 {
        struct dtv_frontend_properties *fep = &fe->dtv_property_cache;
        struct cinergyt2_fe_state *state = fe->demodulator_priv;
-        struct dvbt_set_parameters_msg param;
+        struct dvbt_set_parameters_msg *param;
-        char result[2];
        int err;
-        param.cmd = CINERGYT2_EP1_SET_TUNER_PARAMETERS;
+        mutex_lock(&state->data_mutex);
-        param.tps = cpu_to_le16(compute_tps(fep));
-        param.freq = cpu_to_le32(fep->frequency / 1000);
+        param = (void *)state->data;
-        param.flags = 0;
+        param->cmd = CINERGYT2_EP1_SET_TUNER_PARAMETERS;
+        param->tps = cpu_to_le16(compute_tps(fep));
+        param->freq = cpu_to_le32(fep->frequency / 1000);
+        param->flags = 0;
        switch (fep->bandwidth_hz) {
        default:
        case 8000000:
-                param.bandwidth = 8;
+                param->bandwidth = 8;
                break;
        case 7000000:
-                param.bandwidth = 7;
+                param->bandwidth = 7;
                break;
        case 6000000:
-                param.bandwidth = 6;
+                param->bandwidth = 6;
                break;
        }
-        err = dvb_usb_generic_rw(state->d,
+        err = dvb_usb_generic_rw(state->d, state->data, sizeof(*param),
-                        (char *)&param, sizeof(param),
+                                 state->data, 2, 0);
-                        result, sizeof(result), 0);
        if (err < 0)
                err("cinergyt2_fe_set_frontend() Failed! err=%d\n", err);
+        mutex_unlock(&state->data_mutex);
        return (err < 0) ? err : 0;
 }
@@ -315,6 +290,7 @@ struct dvb_frontend *cinergyt2_fe_attach(struct dvb_usb_device *d)
        s->d = d;
        memcpy(&s->fe.ops, &cinergyt2_fe_ops, sizeof(struct dvb_frontend_ops));
        s->fe.demodulator_priv = s;
+        mutex_init(&s->data_mutex);
        return &s->fe;
 }
diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index 907ac01ae297..243403081fa5 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -45,9 +45,6 @@
 #include "si2168.h"
 #include "si2157.h"
-/* Max transfer size done by I2C transfer functions */
-#define MAX_XFER_SIZE  80
 /* debug */
 static int dvb_usb_cxusb_debug;
 module_param_named(debug, dvb_usb_cxusb_debug, int, 0644);
@@ -61,23 +58,27 @@ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 static int cxusb_ctrl_msg(struct dvb_usb_device *d,
                          u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
 {
-        int wo = (rbuf == NULL || rlen == 0); /* write-only */
+        struct cxusb_state *st = d->priv;
-        u8 sndbuf[MAX_XFER_SIZE];
+        int ret, wo;
-        if (1 + wlen > sizeof(sndbuf)) {
+        if (1 + wlen > MAX_XFER_SIZE) {
-                warn("i2c wr: len=%d is too big!\n",
+                warn("i2c wr: len=%d is too big!\n", wlen);
-                     wlen);
                return -EOPNOTSUPP;
        }
-        memset(sndbuf, 0, 1+wlen);
+        wo = (rbuf == NULL || rlen == 0); /* write-only */
-        sndbuf[0] = cmd;
+        mutex_lock(&d->data_mutex);
-        memcpy(&sndbuf[1], wbuf, wlen);
+        st->data[0] = cmd;
+        memcpy(&st->data[1], wbuf, wlen);
        if (wo)
-                return dvb_usb_generic_write(d, sndbuf, 1+wlen);
+                ret = dvb_usb_generic_write(d, st->data, 1 + wlen);
        else
-                return dvb_usb_generic_rw(d, sndbuf, 1+wlen, rbuf, rlen, 0);
+                ret = dvb_usb_generic_rw(d, st->data, 1 + wlen,
+                                         rbuf, rlen, 0);
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 /* GPIO */
diff --git a/drivers/media/usb/dvb-usb/cxusb.h b/drivers/media/usb/dvb-usb/cxusb.h
index 527ff7905e15..18acda19527a 100644
--- a/drivers/media/usb/dvb-usb/cxusb.h
+++ b/drivers/media/usb/dvb-usb/cxusb.h
@@ -28,10 +28,15 @@
 #define CMD_ANALOG        0x50
 #define CMD_DIGITAL       0x51
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  80
 struct cxusb_state {
        u8 gpio_write_state[3];
        struct i2c_client *i2c_client_demod;
        struct i2c_client *i2c_client_tuner;
+        unsigned char data[MAX_XFER_SIZE];
 };
 #endif
diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
index f3196658fb70..47ce9d5de4c6 100644
--- a/drivers/media/usb/dvb-usb/dib0700_core.c
+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
@@ -213,7 +213,7 @@ static int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg *msg,
                                                 usb_rcvctrlpipe(d->udev, 0),
                                                 REQUEST_NEW_I2C_READ,
                                                 USB_TYPE_VENDOR | USB_DIR_IN,
-                                                 value, index, msg[i].buf,
+                                                 value, index, st->buf,
                                                 msg[i].len,
                                                 USB_CTRL_GET_TIMEOUT);
                        if (result < 0) {
@@ -221,6 +221,14 @@ static int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg *msg,
                                break;
                        }
+                        if (msg[i].len > sizeof(st->buf)) {
+                                deb_info("buffer too small to fit %d bytes\n",
+                                         msg[i].len);
+                                return -EIO;
+                        }
+                        memcpy(msg[i].buf, st->buf, msg[i].len);
                        deb_data("<<< ");
                        debug_dump(msg[i].buf, msg[i].len, deb_data);
@@ -238,6 +246,13 @@ static int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg *msg,
                        /* I2C ctrl + FE bus; */
                        st->buf[3] = ((gen_mode << 6) & 0xC0) |
                                 ((bus_mode << 4) & 0x30);
+                        if (msg[i].len > sizeof(st->buf) - 4) {
+                                deb_info("i2c message to big: %d\n",
+                                         msg[i].len);
+                                return -EIO;
+                        }
                        /* The Actual i2c payload */
                        memcpy(&st->buf[4], msg[i].buf, msg[i].len);
@@ -283,6 +298,11 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap,
                /* fill in the address */
                st->buf[1] = msg[i].addr << 1;
                /* fill the buffer */
+                if (msg[i].len > sizeof(st->buf) - 2) {
+                        deb_info("i2c xfer to big: %d\n",
+                                msg[i].len);
+                        return -EIO;
+                }
                memcpy(&st->buf[2], msg[i].buf, msg[i].len);
                /* write/read request */
@@ -292,13 +312,20 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap,
                        /* special thing in the current firmware: when length is zero the read-failed */
                        len = dib0700_ctrl_rd(d, st->buf, msg[i].len + 2,
-                                        msg[i+1].buf, msg[i+1].len);
+                                              st->buf, msg[i + 1].len);
                        if (len <= 0) {
                                deb_info("I2C read failed on address 0x%02x\n",
                                                msg[i].addr);
                                break;
                        }
+                        if (msg[i + 1].len > sizeof(st->buf)) {
+                                deb_info("i2c xfer buffer to small for %d\n",
+                                        msg[i].len);
+                                return -EIO;
+                        }
+                        memcpy(msg[i + 1].buf, st->buf, msg[i + 1].len);
                        msg[i+1].len = len;
                        i++;
@@ -677,7 +704,7 @@ static void dib0700_rc_urb_completion(struct urb *purb)
        struct dvb_usb_device *d = purb->context;
        struct dib0700_rc_response *poll_reply;
        enum rc_type protocol;
-        u32 uninitialized_var(keycode);
+        u32 keycode;
        u8 toggle;
        deb_info("%s()\n", __func__);
@@ -718,7 +745,8 @@ static void dib0700_rc_urb_completion(struct urb *purb)
                    poll_reply->nec.data       == 0x00 &&
                    poll_reply->nec.not_data   == 0xff) {
                        poll_reply->data_state = 2;
-                        break;
+                        rc_repeat(d->rc_dev);
+                        goto resubmit;
                }
                if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) {
diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
index 0857b56e652c..ef1b8ee75c57 100644
--- a/drivers/media/usb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
@@ -508,8 +508,6 @@ static int stk7700ph_tuner_attach(struct dvb_usb_adapter *adap)
 #define DEFAULT_RC_INTERVAL 50
-static u8 rc_request[] = { REQUEST_POLL_RC, 0 };
 /*
 * This function is used only when firmware is < 1.20 version. Newer
 * firmwares use bulk mode, with functions implemented at dib0700_core,
@@ -517,7 +515,6 @@ static u8 rc_request[] = { REQUEST_POLL_RC, 0 };
 */
 static int dib0700_rc_query_old_firmware(struct dvb_usb_device *d)
 {
-        u8 key[4];
        enum rc_type protocol;
        u32 scancode;
        u8 toggle;
@@ -532,39 +529,43 @@ static int dib0700_rc_query_old_firmware(struct dvb_usb_device *d)
                return 0;
        }
-        i = dib0700_ctrl_rd(d, rc_request, 2, key, 4);
+        st->buf[0] = REQUEST_POLL_RC;
+        st->buf[1] = 0;
+        i = dib0700_ctrl_rd(d, st->buf, 2, st->buf, 4);
        if (i <= 0) {
                err("RC Query Failed");
-                return -1;
+                return -EIO;
        }
        /* losing half of KEY_0 events from Philipps rc5 remotes.. */
-        if (key[0] == 0 && key[1] == 0 && key[2] == 0 && key[3] == 0)
+        if (st->buf[0] == 0 && st->buf[1] == 0
+            && st->buf[2] == 0 && st->buf[3] == 0)
                return 0;
-        /* info("%d: %2X %2X %2X %2X",dvb_usb_dib0700_ir_proto,(int)key[3-2],(int)key[3-3],(int)key[3-1],(int)key[3]);  */
+        /* info("%d: %2X %2X %2X %2X",dvb_usb_dib0700_ir_proto,(int)st->buf[3 - 2],(int)st->buf[3 - 3],(int)st->buf[3 - 1],(int)st->buf[3]);  */
        dib0700_rc_setup(d, NULL); /* reset ir sensor data to prevent false events */
        switch (d->props.rc.core.protocol) {
        case RC_BIT_NEC:
                /* NEC protocol sends repeat code as 0 0 0 FF */
-                if ((key[3-2] == 0x00) && (key[3-3] == 0x00) &&
+                if ((st->buf[3 - 2] == 0x00) && (st->buf[3 - 3] == 0x00) &&
-                    (key[3] == 0xff)) {
+                    (st->buf[3] == 0xff)) {
                        rc_repeat(d->rc_dev);
                        return 0;
                }
                protocol = RC_TYPE_NEC;
-                scancode = RC_SCANCODE_NEC(key[3-2], key[3-3]);
+                scancode = RC_SCANCODE_NEC(st->buf[3 - 2], st->buf[3 - 3]);
                toggle = 0;
                break;
        default:
                /* RC-5 protocol changes toggle bit on new keypress */
                protocol = RC_TYPE_RC5;
-                scancode = RC_SCANCODE_RC5(key[3-2], key[3-3]);
+                scancode = RC_SCANCODE_RC5(st->buf[3 - 2], st->buf[3 - 3]);
-                toggle = key[3-1];
+                toggle = st->buf[3 - 1];
                break;
        }
diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
index 18ed3bfbb5e2..de3ee2547479 100644
--- a/drivers/media/usb/dvb-usb/dibusb-common.c
+++ b/drivers/media/usb/dvb-usb/dibusb-common.c
@@ -62,72 +62,117 @@ EXPORT_SYMBOL(dibusb_pid_filter_ctrl);
 int dibusb_power_ctrl(struct dvb_usb_device *d, int onoff)
 {
-        u8 b[3];
+        u8 *b;
        int ret;
+        b = kmalloc(3, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
        b[0] = DIBUSB_REQ_SET_IOCTL;
        b[1] = DIBUSB_IOCTL_CMD_POWER_MODE;
        b[2] = onoff ? DIBUSB_IOCTL_POWER_WAKEUP : DIBUSB_IOCTL_POWER_SLEEP;
-        ret = dvb_usb_generic_write(d,b,3);
+        ret = dvb_usb_generic_write(d, b, 3);
+        kfree(b);
        msleep(10);
        return ret;
 }
 EXPORT_SYMBOL(dibusb_power_ctrl);
 int dibusb2_0_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
 {
-        u8 b[3] = { 0 };
        int ret;
+        u8 *b;
+        b = kmalloc(3, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
        if ((ret = dibusb_streaming_ctrl(adap,onoff)) < 0)
-                return ret;
+                goto ret;
        if (onoff) {
                b[0] = DIBUSB_REQ_SET_STREAMING_MODE;
                b[1] = 0x00;
-                if ((ret = dvb_usb_generic_write(adap->dev,b,2)) < 0)
+                ret = dvb_usb_generic_write(adap->dev, b, 2);
-                        return ret;
+                if (ret  < 0)
+                        goto ret;
        }
        b[0] = DIBUSB_REQ_SET_IOCTL;
        b[1] = onoff ? DIBUSB_IOCTL_CMD_ENABLE_STREAM : DIBUSB_IOCTL_CMD_DISABLE_STREAM;
-        return dvb_usb_generic_write(adap->dev,b,3);
+        ret = dvb_usb_generic_write(adap->dev, b, 3);
+ret:
+        kfree(b);
+        return ret;
 }
 EXPORT_SYMBOL(dibusb2_0_streaming_ctrl);
 int dibusb2_0_power_ctrl(struct dvb_usb_device *d, int onoff)
 {
-        if (onoff) {
+        u8 *b;
-                u8 b[3] = { DIBUSB_REQ_SET_IOCTL, DIBUSB_IOCTL_CMD_POWER_MODE, DIBUSB_IOCTL_POWER_WAKEUP };
+        int ret;
-                return dvb_usb_generic_write(d,b,3);
-        } else
+        if (!onoff)
                return 0;
+        b = kmalloc(3, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
+        b[0] = DIBUSB_REQ_SET_IOCTL;
+        b[1] = DIBUSB_IOCTL_CMD_POWER_MODE;
+        b[2] = DIBUSB_IOCTL_POWER_WAKEUP;
+        ret = dvb_usb_generic_write(d, b, 3);
+        kfree(b);
+        return ret;
 }
 EXPORT_SYMBOL(dibusb2_0_power_ctrl);
 static int dibusb_i2c_msg(struct dvb_usb_device *d, u8 addr,
                          u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
 {
-        u8 sndbuf[MAX_XFER_SIZE]; /* lead(1) devaddr,direction(1) addr(2) data(wlen) (len(2) (when reading)) */
+        u8 *sndbuf;
+        int ret, wo, len;
        /* write only ? */
-        int wo = (rbuf == NULL || rlen == 0),
+        wo = (rbuf == NULL || rlen == 0);
-                len = 2 + wlen + (wo ? 0 : 2);
+        len = 2 + wlen + (wo ? 0 : 2);
+        sndbuf = kmalloc(MAX_XFER_SIZE, GFP_KERNEL);
+        if (!sndbuf)
+                return -ENOMEM;
-        if (4 + wlen > sizeof(sndbuf)) {
+        if (4 + wlen > MAX_XFER_SIZE) {
                warn("i2c wr: len=%d is too big!\n", wlen);
-                return -EOPNOTSUPP;
+                ret = -EOPNOTSUPP;
+                goto ret;
        }
        sndbuf[0] = wo ? DIBUSB_REQ_I2C_WRITE : DIBUSB_REQ_I2C_READ;
        sndbuf[1] = (addr << 1) | (wo ? 0 : 1);
-        memcpy(&sndbuf[2],wbuf,wlen);
+        memcpy(&sndbuf[2], wbuf, wlen);
        if (!wo) {
-                sndbuf[wlen+2] = (rlen >> 8) & 0xff;
+                sndbuf[wlen + 2] = (rlen >> 8) & 0xff;
-                sndbuf[wlen+3] = rlen & 0xff;
+                sndbuf[wlen + 3] = rlen & 0xff;
        }
-        return dvb_usb_generic_rw(d,sndbuf,len,rbuf,rlen,0);
+        ret = dvb_usb_generic_rw(d, sndbuf, len, rbuf, rlen, 0);
+ret:
+        kfree(sndbuf);
+        return ret;
 }
 /*
@@ -319,11 +364,27 @@ EXPORT_SYMBOL(rc_map_dibusb_table);
 int dibusb_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 {
-        u8 key[5],cmd = DIBUSB_REQ_POLL_REMOTE;
+        u8 *buf;
-        dvb_usb_generic_rw(d,&cmd,1,key,5,0);
+        int ret;
-        dvb_usb_nec_rc_key_to_event(d,key,event,state);
-        if (key[0] != 0)
+        buf = kmalloc(5, GFP_KERNEL);
-                deb_info("key: %*ph\n", 5, key);
+        if (!buf)
-        return 0;
+                return -ENOMEM;
+        buf[0] = DIBUSB_REQ_POLL_REMOTE;
+        ret = dvb_usb_generic_rw(d, buf, 1, buf, 5, 0);
+        if (ret < 0)
+                goto ret;
+        dvb_usb_nec_rc_key_to_event(d, buf, event, state);
+        if (buf[0] != 0)
+                deb_info("key: %*ph\n", 5, buf);
+        kfree(buf);
+ret:
+        return ret;
 }
 EXPORT_SYMBOL(dibusb_rc_query);
diff --git a/drivers/media/usb/dvb-usb/dibusb.h b/drivers/media/usb/dvb-usb/dibusb.h
index 3f82163d8ab8..697be2a17ade 100644
--- a/drivers/media/usb/dvb-usb/dibusb.h
+++ b/drivers/media/usb/dvb-usb/dibusb.h
@@ -96,6 +96,9 @@
 #define DIBUSB_IOCTL_CMD_ENABLE_STREAM  0x01
 #define DIBUSB_IOCTL_CMD_DISABLE_STREAM 0x02
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
 struct dibusb_state {
        struct dib_fe_xfer_ops ops;
        int mt2060_present;
diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c
index 63134335c994..4284f6984dc1 100644
--- a/drivers/media/usb/dvb-usb/digitv.c
+++ b/drivers/media/usb/dvb-usb/digitv.c
@@ -28,22 +28,26 @@ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 static int digitv_ctrl_msg(struct dvb_usb_device *d,
                u8 cmd, u8 vv, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
 {
-        int wo = (rbuf == NULL || rlen == 0); /* write-only */
+        struct digitv_state *st = d->priv;
-        u8 sndbuf[7],rcvbuf[7];
+        int ret, wo;
-        memset(sndbuf,0,7); memset(rcvbuf,0,7);
-        sndbuf[0] = cmd;
+        wo = (rbuf == NULL || rlen == 0); /* write-only */
-        sndbuf[1] = vv;
-        sndbuf[2] = wo ? wlen : rlen;
+        memset(st->sndbuf, 0, 7);
+        memset(st->rcvbuf, 0, 7);
+        st->sndbuf[0] = cmd;
+        st->sndbuf[1] = vv;
+        st->sndbuf[2] = wo ? wlen : rlen;
        if (wo) {
-                memcpy(&sndbuf[3],wbuf,wlen);
+                memcpy(&st->sndbuf[3], wbuf, wlen);
-                dvb_usb_generic_write(d,sndbuf,7);
+                ret = dvb_usb_generic_write(d, st->sndbuf, 7);
        } else {
-                dvb_usb_generic_rw(d,sndbuf,7,rcvbuf,7,10);
+                ret = dvb_usb_generic_rw(d, st->sndbuf, 7, st->rcvbuf, 7, 10);
-                memcpy(rbuf,&rcvbuf[3],rlen);
+                memcpy(rbuf, &st->rcvbuf[3], rlen);
        }
-        return 0;
+        return ret;
 }
 /* I2C */
diff --git a/drivers/media/usb/dvb-usb/digitv.h b/drivers/media/usb/dvb-usb/digitv.h
index 908c09f4966b..581e09c25491 100644
--- a/drivers/media/usb/dvb-usb/digitv.h
+++ b/drivers/media/usb/dvb-usb/digitv.h
@@ -5,7 +5,10 @@
 #include "dvb-usb.h"
 struct digitv_state {
-    int is_nxt6000;
+        int is_nxt6000;
+        unsigned char sndbuf[7];
+        unsigned char rcvbuf[7];
 };
 /* protocol (from usblogging and the SDK:
diff --git a/drivers/media/usb/dvb-usb/dtt200u-fe.c b/drivers/media/usb/dvb-usb/dtt200u-fe.c
index c09332bd99cb..f5c042baa254 100644
--- a/drivers/media/usb/dvb-usb/dtt200u-fe.c
+++ b/drivers/media/usb/dvb-usb/dtt200u-fe.c
@@ -18,17 +18,28 @@ struct dtt200u_fe_state {
        struct dtv_frontend_properties fep;
        struct dvb_frontend frontend;
+        unsigned char data[80];
+        struct mutex data_mutex;
 };
 static int dtt200u_fe_read_status(struct dvb_frontend *fe,
                                  enum fe_status *stat)
 {
        struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 st = GET_TUNE_STATUS, b[3];
+        int ret;
+        mutex_lock(&state->data_mutex);
+        state->data[0] = GET_TUNE_STATUS;
-        dvb_usb_generic_rw(state->d,&st,1,b,3,0);
+        ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 3, 0);
+        if (ret < 0) {
+                *stat = 0;
+                mutex_unlock(&state->data_mutex);
+                return ret;
+        }
-        switch (b[0]) {
+        switch (state->data[0]) {
                case 0x01:
                        *stat = FE_HAS_SIGNAL | FE_HAS_CARRIER |
                                FE_HAS_VITERBI | FE_HAS_SYNC | FE_HAS_LOCK;
@@ -41,51 +52,86 @@ static int dtt200u_fe_read_status(struct dvb_frontend *fe,
                        *stat = 0;
                        break;
        }
+        mutex_unlock(&state->data_mutex);
        return 0;
 }
 static int dtt200u_fe_read_ber(struct dvb_frontend* fe, u32 *ber)
 {
        struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 bw = GET_VIT_ERR_CNT,b[3];
+        int ret;
-        dvb_usb_generic_rw(state->d,&bw,1,b,3,0);
-        *ber = (b[0] << 16) | (b[1] << 8) | b[2];
+        mutex_lock(&state->data_mutex);
-        return 0;
+        state->data[0] = GET_VIT_ERR_CNT;
+        ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 3, 0);
+        if (ret >= 0)
+                *ber = (state->data[0] << 16) | (state->data[1] << 8) | state->data[2];
+        mutex_unlock(&state->data_mutex);
+        return ret;
 }
 static int dtt200u_fe_read_unc_blocks(struct dvb_frontend* fe, u32 *unc)
 {
        struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 bw = GET_RS_UNCOR_BLK_CNT,b[2];
+        int ret;
-        dvb_usb_generic_rw(state->d,&bw,1,b,2,0);
+        mutex_lock(&state->data_mutex);
-        *unc = (b[0] << 8) | b[1];
+        state->data[0] = GET_RS_UNCOR_BLK_CNT;
-        return 0;
+        ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 2, 0);
+        if (ret >= 0)
+                *unc = (state->data[0] << 8) | state->data[1];
+        mutex_unlock(&state->data_mutex);
+        return ret;
 }
 static int dtt200u_fe_read_signal_strength(struct dvb_frontend* fe, u16 *strength)
 {
        struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 bw = GET_AGC, b;
+        int ret;
-        dvb_usb_generic_rw(state->d,&bw,1,&b,1,0);
-        *strength = (b << 8) | b;
+        mutex_lock(&state->data_mutex);
-        return 0;
+        state->data[0] = GET_AGC;
+        ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 1, 0);
+        if (ret >= 0)
+                *strength = (state->data[0] << 8) | state->data[0];
+        mutex_unlock(&state->data_mutex);
+        return ret;
 }
 static int dtt200u_fe_read_snr(struct dvb_frontend* fe, u16 *snr)
 {
        struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 bw = GET_SNR,br;
+        int ret;
-        dvb_usb_generic_rw(state->d,&bw,1,&br,1,0);
-        *snr = ~((br << 8) | br);
+        mutex_lock(&state->data_mutex);
-        return 0;
+        state->data[0] = GET_SNR;
+        ret = dvb_usb_generic_rw(state->d, state->data, 1, state->data, 1, 0);
+        if (ret >= 0)
+                *snr = ~((state->data[0] << 8) | state->data[0]);
+        mutex_unlock(&state->data_mutex);
+        return ret;
 }
 static int dtt200u_fe_init(struct dvb_frontend* fe)
 {
        struct dtt200u_fe_state *state = fe->demodulator_priv;
-        u8 b = SET_INIT;
+        int ret;
-        return dvb_usb_generic_write(state->d,&b,1);
+        mutex_lock(&state->data_mutex);
+        state->data[0] = SET_INIT;
+        ret = dvb_usb_generic_write(state->d, state->data, 1);
+        mutex_unlock(&state->data_mutex);
+        return ret;
 }
 static int dtt200u_fe_sleep(struct dvb_frontend* fe)
@@ -105,39 +151,40 @@ static int dtt200u_fe_set_frontend(struct dvb_frontend *fe)
 {
        struct dtv_frontend_properties *fep = &fe->dtv_property_cache;
        struct dtt200u_fe_state *state = fe->demodulator_priv;
-        int i;
+        int ret;
-        enum fe_status st;
        u16 freq = fep->frequency / 250000;
-        u8 bwbuf[2] = { SET_BANDWIDTH, 0 },freqbuf[3] = { SET_RF_FREQ, 0, 0 };
+        mutex_lock(&state->data_mutex);
+        state->data[0] = SET_BANDWIDTH;
        switch (fep->bandwidth_hz) {
        case 8000000:
-                bwbuf[1] = 8;
+                state->data[1] = 8;
                break;
        case 7000000:
-                bwbuf[1] = 7;
+                state->data[1] = 7;
                break;
        case 6000000:
-                bwbuf[1] = 6;
+                state->data[1] = 6;
                break;
        default:
-                return -EINVAL;
+                ret = -EINVAL;
+                goto ret;
        }
-        dvb_usb_generic_write(state->d,bwbuf,2);
+        ret = dvb_usb_generic_write(state->d, state->data, 2);
+        if (ret < 0)
+                goto ret;
-        freqbuf[1] = freq & 0xff;
+        state->data[0] = SET_RF_FREQ;
-        freqbuf[2] = (freq >> 8) & 0xff;
+        state->data[1] = freq & 0xff;
-        dvb_usb_generic_write(state->d,freqbuf,3);
+        state->data[2] = (freq >> 8) & 0xff;
+        ret = dvb_usb_generic_write(state->d, state->data, 3);
+        if (ret < 0)
+                goto ret;
-        for (i = 0; i < 30; i++) {
+ret:
-                msleep(20);
+        mutex_unlock(&state->data_mutex);
-                dtt200u_fe_read_status(fe, &st);
+        return ret;
-                if (st & FE_TIMEDOUT)
-                        continue;
-        }
-        return 0;
 }
 static int dtt200u_fe_get_frontend(struct dvb_frontend* fe,
@@ -169,6 +216,7 @@ struct dvb_frontend* dtt200u_fe_attach(struct dvb_usb_device *d)
        deb_info("attaching frontend dtt200u\n");
        state->d = d;
+        mutex_init(&state->data_mutex);
        memcpy(&state->frontend.ops,&dtt200u_fe_ops,sizeof(struct dvb_frontend_ops));
        state->frontend.demodulator_priv = state;
diff --git a/drivers/media/usb/dvb-usb/dtt200u.c b/drivers/media/usb/dvb-usb/dtt200u.c
index d2a01b50af0d..fcbff7fb0c4e 100644
--- a/drivers/media/usb/dvb-usb/dtt200u.c
+++ b/drivers/media/usb/dvb-usb/dtt200u.c
@@ -20,75 +20,115 @@ MODULE_PARM_DESC(debug, "set debugging level (1=info,xfer=2 (or-able))." DVB_USB
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+struct dtt200u_state {
+        unsigned char data[80];
+};
 static int dtt200u_power_ctrl(struct dvb_usb_device *d, int onoff)
 {
-        u8 b = SET_INIT;
+        struct dtt200u_state *st = d->priv;
+        int ret = 0;
+        mutex_lock(&d->data_mutex);
+        st->data[0] = SET_INIT;
        if (onoff)
-                dvb_usb_generic_write(d,&b,2);
+                ret = dvb_usb_generic_write(d, st->data, 2);
-        return 0;
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 static int dtt200u_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
 {
-        u8 b_streaming[2] = { SET_STREAMING, onoff };
+        struct dvb_usb_device *d = adap->dev;
-        u8 b_rst_pid = RESET_PID_FILTER;
+        struct dtt200u_state *st = d->priv;
+        int ret;
-        dvb_usb_generic_write(adap->dev, b_streaming, 2);
+        mutex_lock(&d->data_mutex);
+        st->data[0] = SET_STREAMING;
+        st->data[1] = onoff;
-        if (onoff == 0)
+        ret = dvb_usb_generic_write(adap->dev, st->data, 2);
-                dvb_usb_generic_write(adap->dev, &b_rst_pid, 1);
+        if (ret < 0)
-        return 0;
+                goto ret;
+        if (onoff)
+                goto ret;
+        st->data[0] = RESET_PID_FILTER;
+        ret = dvb_usb_generic_write(adap->dev, st->data, 1);
+ret:
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 static int dtt200u_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid, int onoff)
 {
-        u8 b_pid[4];
+        struct dvb_usb_device *d = adap->dev;
+        struct dtt200u_state *st = d->priv;
+        int ret;
        pid = onoff ? pid : 0;
-        b_pid[0] = SET_PID_FILTER;
+        mutex_lock(&d->data_mutex);
-        b_pid[1] = index;
+        st->data[0] = SET_PID_FILTER;
-        b_pid[2] = pid & 0xff;
+        st->data[1] = index;
-        b_pid[3] = (pid >> 8) & 0x1f;
+        st->data[2] = pid & 0xff;
+        st->data[3] = (pid >> 8) & 0x1f;
+        ret = dvb_usb_generic_write(adap->dev, st->data, 4);
+        mutex_unlock(&d->data_mutex);
-        return dvb_usb_generic_write(adap->dev, b_pid, 4);
+        return ret;
 }
 static int dtt200u_rc_query(struct dvb_usb_device *d)
 {
-        u8 key[5],cmd = GET_RC_CODE;
+        struct dtt200u_state *st = d->priv;
        u32 scancode;
+        int ret;
+        mutex_lock(&d->data_mutex);
+        st->data[0] = GET_RC_CODE;
-        dvb_usb_generic_rw(d,&cmd,1,key,5,0);
+        ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 5, 0);
-        if (key[0] == 1) {
+        if (ret < 0)
+                goto ret;
+        if (st->data[0] == 1) {
                enum rc_type proto = RC_TYPE_NEC;
-                scancode = key[1];
+                scancode = st->data[1];
-                if ((u8) ~key[1] != key[2]) {
+                if ((u8) ~st->data[1] != st->data[2]) {
                        /* Extended NEC */
                        scancode = scancode << 8;
-                        scancode |= key[2];
+                        scancode |= st->data[2];
                        proto = RC_TYPE_NECX;
                }
                scancode = scancode << 8;
-                scancode |= key[3];
+                scancode |= st->data[3];
                /* Check command checksum is ok */
-                if ((u8) ~key[3] == key[4])
+                if ((u8) ~st->data[3] == st->data[4])
                        rc_keydown(d->rc_dev, proto, scancode, 0);
                else
                        rc_keyup(d->rc_dev);
-        } else if (key[0] == 2) {
+        } else if (st->data[0] == 2) {
                rc_repeat(d->rc_dev);
        } else {
                rc_keyup(d->rc_dev);
        }
-        if (key[0] != 0)
+        if (st->data[0] != 0)
-                deb_info("key: %*ph\n", 5, key);
+                deb_info("st->data: %*ph\n", 5, st->data);
-        return 0;
+ret:
+        mutex_unlock(&d->data_mutex);
+        return ret;
 }
 static int dtt200u_frontend_attach(struct dvb_usb_adapter *adap)
@@ -140,6 +180,8 @@ static struct dvb_usb_device_properties dtt200u_properties = {
        .usb_ctrl = CYPRESS_FX2,
        .firmware = "dvb-usb-dtt200u-01.fw",
+        .size_of_priv     = sizeof(struct dtt200u_state),
        .num_adapters = 1,
        .adapter = {
                {
@@ -190,6 +232,8 @@ static struct dvb_usb_device_properties wt220u_properties = {
        .usb_ctrl = CYPRESS_FX2,
        .firmware = "dvb-usb-wt220u-02.fw",
+        .size_of_priv     = sizeof(struct dtt200u_state),
        .num_adapters = 1,
        .adapter = {
                {
@@ -240,6 +284,8 @@ static struct dvb_usb_device_properties wt220u_fc_properties = {
        .usb_ctrl = CYPRESS_FX2,
        .firmware = "dvb-usb-wt220u-fc03.fw",
+        .size_of_priv     = sizeof(struct dtt200u_state),
        .num_adapters = 1,
        .adapter = {
                {
@@ -290,6 +336,8 @@ static struct dvb_usb_device_properties wt220u_zl0353_properties = {
        .usb_ctrl = CYPRESS_FX2,
        .firmware = "dvb-usb-wt220u-zl0353-01.fw",
+        .size_of_priv     = sizeof(struct dtt200u_state),
        .num_adapters = 1,
        .adapter = {
                {
@@ -340,6 +388,8 @@ static struct dvb_usb_device_properties wt220u_miglia_properties = {
        .usb_ctrl = CYPRESS_FX2,
        .firmware = "dvb-usb-wt220u-miglia-01.fw",
+        .size_of_priv     = sizeof(struct dtt200u_state),
        .num_adapters = 1,
        .generic_bulk_ctrl_endpoint = 0x01,
diff --git a/drivers/media/usb/dvb-usb/dtv5100.c b/drivers/media/usb/dvb-usb/dtv5100.c
index 3d11df41cac0..c60fb54f445f 100644
--- a/drivers/media/usb/dvb-usb/dtv5100.c
+++ b/drivers/media/usb/dvb-usb/dtv5100.c
@@ -31,9 +31,14 @@ module_param_named(debug, dvb_usb_dtv5100_debug, int, 0644);
 MODULE_PARM_DESC(debug, "set debugging level" DVB_USB_DEBUG_STATUS);
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+struct dtv5100_state {
+        unsigned char data[80];
+};
 static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr,
                           u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
 {
+        struct dtv5100_state *st = d->priv;
        u8 request;
        u8 type;
        u16 value;
@@ -60,9 +65,10 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr,
        }
        index = (addr << 8) + wbuf[0];
+        memcpy(st->data, rbuf, rlen);
        msleep(1); /* avoid I2C errors */
        return usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), request,
-                               type, value, index, rbuf, rlen,
+                               type, value, index, st->data, rlen,
                               DTV5100_USB_TIMEOUT);
 }
@@ -176,7 +182,7 @@ static struct dvb_usb_device_properties dtv5100_properties = {
        .caps = DVB_USB_IS_AN_I2C_ADAPTER,
        .usb_ctrl = DEVICE_SPECIFIC,
-        .size_of_priv = 0,
+        .size_of_priv = sizeof(struct dtv5100_state),
        .num_adapters = 1,
        .adapter = {{
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
index 3896ba9a4179..84308569e7dc 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
@@ -142,6 +142,7 @@ static int dvb_usb_init(struct dvb_usb_device *d, short *adapter_nums)
 {
        int ret = 0;
+        mutex_init(&d->data_mutex);
        mutex_init(&d->usb_mutex);
        mutex_init(&d->i2c_mutex);
diff --git a/drivers/media/usb/dvb-usb/dvb-usb.h b/drivers/media/usb/dvb-usb/dvb-usb.h
index 639c4678c65b..107255b08b2b 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb.h
+++ b/drivers/media/usb/dvb-usb/dvb-usb.h
@@ -404,8 +404,12 @@ struct dvb_usb_adapter {
 *  Powered is in/decremented for each call to modify the state.
 * @udev: pointer to the device's struct usb_device.
 *
- * @usb_mutex: semaphore of USB control messages (reading needs two messages)
+ * @data_mutex: mutex to protect the data structure used to store URB data
- * @i2c_mutex: semaphore for i2c-transfers
+ * @usb_mutex: mutex of USB control messages (reading needs two messages).
+ *      Please notice that this mutex is used internally at the generic
+ *      URB control functions. So, drivers using dvb_usb_generic_rw() and
+ *      derivated functions should not lock it internally.
+ * @i2c_mutex: mutex for i2c-transfers
 *
 * @i2c_adap: device's i2c_adapter if it uses I2CoverUSB
 *
@@ -433,6 +437,7 @@ struct dvb_usb_device {
        int powered;
        /* locking */
+        struct mutex data_mutex;
        struct mutex usb_mutex;
        /* i2c */
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 5fb0c650926e..2c720cb2fb00 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -852,7 +852,7 @@ static int su3000_power_ctrl(struct dvb_usb_device *d, int i)
        if (i && !state->initialized) {
                state->initialized = 1;
                /* reset board */
-                dvb_usb_generic_rw(d, obuf, 2, NULL, 0, 0);
+                return dvb_usb_generic_rw(d, obuf, 2, NULL, 0, 0);
        }
        return 0;
diff --git a/drivers/media/usb/dvb-usb/gp8psk.c b/drivers/media/usb/dvb-usb/gp8psk.c
index 5d0384dd45b5..993bb7a72985 100644
--- a/drivers/media/usb/dvb-usb/gp8psk.c
+++ b/drivers/media/usb/dvb-usb/gp8psk.c
@@ -15,6 +15,7 @@
 * see Documentation/dvb/README.dvb-usb for more information
 */
 #include "gp8psk.h"
+#include "gp8psk-fe.h"
 /* debug */
 static char bcm4500_firmware[] = "dvb-usb-gp8psk-02.fw";
@@ -24,37 +25,19 @@ MODULE_PARM_DESC(debug, "set debugging level (1=info,xfer=2,rc=4 (or-able))." DV
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
-static int gp8psk_get_fw_version(struct dvb_usb_device *d, u8 *fw_vers)
+struct gp8psk_state {
-{
+        unsigned char data[80];
-        return (gp8psk_usb_in_op(d, GET_FW_VERS, 0, 0, fw_vers, 6));
+};
-}
-static int gp8psk_get_fpga_version(struct dvb_usb_device *d, u8 *fpga_vers)
-{
-        return (gp8psk_usb_in_op(d, GET_FPGA_VERS, 0, 0, fpga_vers, 1));
-}
-static void gp8psk_info(struct dvb_usb_device *d)
-{
-        u8 fpga_vers, fw_vers[6];
-        if (!gp8psk_get_fw_version(d, fw_vers))
-                info("FW Version = %i.%02i.%i (0x%x)  Build %4i/%02i/%02i",
-                fw_vers[2], fw_vers[1], fw_vers[0], GP8PSK_FW_VERS(fw_vers),
-                2000 + fw_vers[5], fw_vers[4], fw_vers[3]);
-        else
-                info("failed to get FW version");
-        if (!gp8psk_get_fpga_version(d, &fpga_vers))
-                info("FPGA Version = %i", fpga_vers);
-        else
-                info("failed to get FPGA version");
-}
-int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8 *b, int blen)
+static int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value,
+                            u16 index, u8 *b, int blen)
 {
+        struct gp8psk_state *st = d->priv;
        int ret = 0,try = 0;
+        if (blen > sizeof(st->data))
+                return -EIO;
        if ((ret = mutex_lock_interruptible(&d->usb_mutex)))
                return ret;
@@ -63,7 +46,7 @@ int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8
                        usb_rcvctrlpipe(d->udev,0),
                        req,
                        USB_TYPE_VENDOR | USB_DIR_IN,
-                        value,index,b,blen,
+                        value, index, st->data, blen,
                        2000);
                deb_info("reading number %d (ret: %d)\n",try,ret);
                try++;
@@ -72,8 +55,10 @@ int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8
        if (ret < 0 || ret != blen) {
                warn("usb in %d operation failed.", req);
                ret = -EIO;
-        } else
+        } else {
                ret = 0;
+                memcpy(b, st->data, blen);
+        }
        deb_xfer("in: req. %x, val: %x, ind: %x, buffer: ",req,value,index);
        debug_dump(b,blen,deb_xfer);
@@ -83,22 +68,27 @@ int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8
        return ret;
 }
-int gp8psk_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value,
+static int gp8psk_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value,
                             u16 index, u8 *b, int blen)
 {
+        struct gp8psk_state *st = d->priv;
        int ret;
        deb_xfer("out: req. %x, val: %x, ind: %x, buffer: ",req,value,index);
        debug_dump(b,blen,deb_xfer);
+        if (blen > sizeof(st->data))
+                return -EIO;
        if ((ret = mutex_lock_interruptible(&d->usb_mutex)))
                return ret;
+        memcpy(st->data, b, blen);
        if (usb_control_msg(d->udev,
                        usb_sndctrlpipe(d->udev,0),
                        req,
                        USB_TYPE_VENDOR | USB_DIR_OUT,
-                        value,index,b,blen,
+                        value, index, st->data, blen,
                        2000) != blen) {
                warn("usb out operation failed.");
                ret = -EIO;
@@ -109,6 +99,34 @@ int gp8psk_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value,
        return ret;
 }
+static int gp8psk_get_fw_version(struct dvb_usb_device *d, u8 *fw_vers)
+{
+        return gp8psk_usb_in_op(d, GET_FW_VERS, 0, 0, fw_vers, 6);
+}
+static int gp8psk_get_fpga_version(struct dvb_usb_device *d, u8 *fpga_vers)
+{
+        return gp8psk_usb_in_op(d, GET_FPGA_VERS, 0, 0, fpga_vers, 1);
+}
+static void gp8psk_info(struct dvb_usb_device *d)
+{
+        u8 fpga_vers, fw_vers[6];
+        if (!gp8psk_get_fw_version(d, fw_vers))
+                info("FW Version = %i.%02i.%i (0x%x)  Build %4i/%02i/%02i",
+                fw_vers[2], fw_vers[1], fw_vers[0], GP8PSK_FW_VERS(fw_vers),
+                2000 + fw_vers[5], fw_vers[4], fw_vers[3]);
+        else
+                info("failed to get FW version");
+        if (!gp8psk_get_fpga_version(d, &fpga_vers))
+                info("FPGA Version = %i", fpga_vers);
+        else
+                info("failed to get FPGA version");
+}
 static int gp8psk_load_bcm4500fw(struct dvb_usb_device *d)
 {
        int ret;
@@ -143,6 +161,11 @@ static int gp8psk_load_bcm4500fw(struct dvb_usb_device *d)
                        err("failed to load bcm4500 firmware.");
                        goto out_free;
                }
+                if (buflen > 64) {
+                        err("firmare chunk size bigger than 64 bytes.");
+                        goto out_free;
+                }
                memcpy(buf, ptr, buflen);
                if (dvb_usb_generic_write(d, buf, buflen)) {
                        err("failed to load bcm4500 firmware.");
@@ -206,10 +229,13 @@ static int gp8psk_power_ctrl(struct dvb_usb_device *d, int onoff)
        return 0;
 }
-int gp8psk_bcm4500_reload(struct dvb_usb_device *d)
+static int gp8psk_bcm4500_reload(struct dvb_usb_device *d)
 {
        u8 buf;
        int gp_product_id = le16_to_cpu(d->udev->descriptor.idProduct);
+        deb_xfer("reloading firmware\n");
        /* Turn off 8psk power */
        if (gp8psk_usb_in_op(d, BOOT_8PSK, 0, 0, &buf, 1))
                return -EINVAL;
@@ -228,9 +254,47 @@ static int gp8psk_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
        return gp8psk_usb_out_op(adap->dev, ARM_TRANSFER, onoff, 0 , NULL, 0);
 }
+/* Callbacks for gp8psk-fe.c */
+static int gp8psk_fe_in(void *priv, u8 req, u16 value,
+                            u16 index, u8 *b, int blen)
+{
+        struct dvb_usb_device *d = priv;
+        return gp8psk_usb_in_op(d, req, value, index, b, blen);
+}
+static int gp8psk_fe_out(void *priv, u8 req, u16 value,
+                            u16 index, u8 *b, int blen)
+{
+        struct dvb_usb_device *d = priv;
+        return gp8psk_usb_out_op(d, req, value, index, b, blen);
+}
+static int gp8psk_fe_reload(void *priv)
+{
+        struct dvb_usb_device *d = priv;
+        return gp8psk_bcm4500_reload(d);
+}
+const struct gp8psk_fe_ops gp8psk_fe_ops = {
+        .in = gp8psk_fe_in,
+        .out = gp8psk_fe_out,
+        .reload = gp8psk_fe_reload,
+};
 static int gp8psk_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        adap->fe_adap[0].fe = gp8psk_fe_attach(adap->dev);
+        struct dvb_usb_device *d = adap->dev;
+        int id = le16_to_cpu(d->udev->descriptor.idProduct);
+        int is_rev1;
+        is_rev1 = (id == USB_PID_GENPIX_8PSK_REV_1_WARM) ? true : false;
+        adap->fe_adap[0].fe = dvb_attach(gp8psk_fe_attach,
+                                         &gp8psk_fe_ops, d, is_rev1);
        return 0;
 }
@@ -265,6 +329,8 @@ static struct dvb_usb_device_properties gp8psk_properties = {
        .usb_ctrl = CYPRESS_FX2,
        .firmware = "dvb-usb-gp8psk-01.fw",
+        .size_of_priv = sizeof(struct gp8psk_state),
        .num_adapters = 1,
        .adapter = {
                {
diff --git a/drivers/media/usb/dvb-usb/gp8psk.h b/drivers/media/usb/dvb-usb/gp8psk.h
index ed32b9da4843..d8975b866dee 100644
--- a/drivers/media/usb/dvb-usb/gp8psk.h
+++ b/drivers/media/usb/dvb-usb/gp8psk.h
@@ -24,58 +24,6 @@ extern int dvb_usb_gp8psk_debug;
 #define deb_info(args...) dprintk(dvb_usb_gp8psk_debug,0x01,args)
 #define deb_xfer(args...) dprintk(dvb_usb_gp8psk_debug,0x02,args)
 #define deb_rc(args...)   dprintk(dvb_usb_gp8psk_debug,0x04,args)
-#define deb_fe(args...)   dprintk(dvb_usb_gp8psk_debug,0x08,args)
-/* Twinhan Vendor requests */
-#define TH_COMMAND_IN                     0xC0
-#define TH_COMMAND_OUT                    0xC1
-/* gp8psk commands */
-#define GET_8PSK_CONFIG                 0x80    /* in */
-#define SET_8PSK_CONFIG                 0x81
-#define I2C_WRITE                       0x83
-#define I2C_READ                        0x84
-#define ARM_TRANSFER                    0x85
-#define TUNE_8PSK                       0x86
-#define GET_SIGNAL_STRENGTH             0x87    /* in */
-#define LOAD_BCM4500                    0x88
-#define BOOT_8PSK                       0x89    /* in */
-#define START_INTERSIL                  0x8A    /* in */
-#define SET_LNB_VOLTAGE                 0x8B
-#define SET_22KHZ_TONE                  0x8C
-#define SEND_DISEQC_COMMAND             0x8D
-#define SET_DVB_MODE                    0x8E
-#define SET_DN_SWITCH                   0x8F
-#define GET_SIGNAL_LOCK                 0x90    /* in */
-#define GET_FW_VERS                     0x92
-#define GET_SERIAL_NUMBER               0x93    /* in */
-#define USE_EXTRA_VOLT                  0x94
-#define GET_FPGA_VERS                   0x95
-#define CW3K_INIT                       0x9d
-/* PSK_configuration bits */
-#define bm8pskStarted                   0x01
-#define bm8pskFW_Loaded                 0x02
-#define bmIntersilOn                    0x04
-#define bmDVBmode                       0x08
-#define bm22kHz                         0x10
-#define bmSEL18V                        0x20
-#define bmDCtuned                       0x40
-#define bmArmed                         0x80
-/* Satellite modulation modes */
-#define ADV_MOD_DVB_QPSK 0     /* DVB-S QPSK */
-#define ADV_MOD_TURBO_QPSK 1   /* Turbo QPSK */
-#define ADV_MOD_TURBO_8PSK 2   /* Turbo 8PSK (also used for Trellis 8PSK) */
-#define ADV_MOD_TURBO_16QAM 3  /* Turbo 16QAM (also used for Trellis 8PSK) */
-#define ADV_MOD_DCII_C_QPSK 4  /* Digicipher II Combo */
-#define ADV_MOD_DCII_I_QPSK 5  /* Digicipher II I-stream */
-#define ADV_MOD_DCII_Q_QPSK 6  /* Digicipher II Q-stream */
-#define ADV_MOD_DCII_C_OQPSK 7 /* Digicipher II offset QPSK */
-#define ADV_MOD_DSS_QPSK 8     /* DSS (DIRECTV) QPSK */
-#define ADV_MOD_DVB_BPSK 9     /* DVB-S BPSK */
 #define GET_USB_SPEED                     0x07
@@ -86,15 +34,4 @@ extern int dvb_usb_gp8psk_debug;
 #define PRODUCT_STRING_READ               0x0D
 #define FW_BCD_VERSION_READ               0x14
-/* firmware revision id's */
-#define GP8PSK_FW_REV1                  0x020604
-#define GP8PSK_FW_REV2                  0x020704
-#define GP8PSK_FW_VERS(_fw_vers)        ((_fw_vers)[2]<<0x10 | (_fw_vers)[1]<<0x08 | (_fw_vers)[0])
-extern struct dvb_frontend * gp8psk_fe_attach(struct dvb_usb_device *d);
-extern int gp8psk_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8 *b, int blen);
-extern int gp8psk_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value,
-                             u16 index, u8 *b, int blen);
-extern int gp8psk_bcm4500_reload(struct dvb_usb_device *d);
 #endif
diff --git a/drivers/media/usb/dvb-usb/nova-t-usb2.c b/drivers/media/usb/dvb-usb/nova-t-usb2.c
index fc7569e2728d..1babd3341910 100644
--- a/drivers/media/usb/dvb-usb/nova-t-usb2.c
+++ b/drivers/media/usb/dvb-usb/nova-t-usb2.c
@@ -74,22 +74,31 @@ static struct rc_map_table rc_map_haupp_table[] = {
 */
 static int nova_t_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 {
-        u8 key[5],cmd[2] = { DIBUSB_REQ_POLL_REMOTE, 0x35 }, data,toggle,custom;
+        u8 *buf, data, toggle, custom;
        u16 raw;
-        int i;
+        int i, ret;
        struct dibusb_device_state *st = d->priv;
-        dvb_usb_generic_rw(d,cmd,2,key,5,0);
+        buf = kmalloc(5, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        buf[0] = DIBUSB_REQ_POLL_REMOTE;
+        buf[1] = 0x35;
+        ret = dvb_usb_generic_rw(d, buf, 2, buf, 5, 0);
+        if (ret < 0)
+                goto ret;
        *state = REMOTE_NO_KEY_PRESSED;
-        switch (key[0]) {
+        switch (buf[0]) {
                case DIBUSB_RC_HAUPPAUGE_KEY_PRESSED:
-                        raw = ((key[1] << 8) | key[2]) >> 3;
+                        raw = ((buf[1] << 8) | buf[2]) >> 3;
                        toggle = !!(raw & 0x800);
                        data = raw & 0x3f;
                        custom = (raw >> 6) & 0x1f;
-                        deb_rc("raw key code 0x%02x, 0x%02x, 0x%02x to c: %02x d: %02x toggle: %d\n",key[1],key[2],key[3],custom,data,toggle);
+                        deb_rc("raw key code 0x%02x, 0x%02x, 0x%02x to c: %02x d: %02x toggle: %d\n",
+                               buf[1], buf[2], buf[3], custom, data, toggle);
                        for (i = 0; i < ARRAY_SIZE(rc_map_haupp_table); i++) {
                                if (rc5_data(&rc_map_haupp_table[i]) == data &&
@@ -117,7 +126,9 @@ static int nova_t_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
                        break;
        }
-        return 0;
+ret:
+        kfree(buf);
+        return ret;
 }
 static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c
index c05de1b088a4..07fa08be9e99 100644
--- a/drivers/media/usb/dvb-usb/pctv452e.c
+++ b/drivers/media/usb/dvb-usb/pctv452e.c
@@ -97,48 +97,53 @@ struct pctv452e_state {
        u8 c;      /* transaction counter, wraps around...  */
        u8 initialized; /* set to 1 if 0x15 has been sent */
        u16 last_rc_key;
+        unsigned char data[80];
 };
 static int tt3650_ci_msg(struct dvb_usb_device *d, u8 cmd, u8 *data,
                         unsigned int write_len, unsigned int read_len)
 {
        struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
-        u8 buf[64];
        u8 id;
        unsigned int rlen;
        int ret;
-        BUG_ON(NULL == data && 0 != (write_len | read_len));
+        if (!data || (write_len > 64 - 4) || (read_len > 64 - 4)) {
-        BUG_ON(write_len > 64 - 4);
+                err("%s: transfer data invalid", __func__);
-        BUG_ON(read_len > 64 - 4);
+                return -EIO;
+        }
+        mutex_lock(&state->ca_mutex);
        id = state->c++;
-        buf[0] = SYNC_BYTE_OUT;
+        state->data[0] = SYNC_BYTE_OUT;
-        buf[1] = id;
+        state->data[1] = id;
-        buf[2] = cmd;
+        state->data[2] = cmd;
-        buf[3] = write_len;
+        state->data[3] = write_len;
-        memcpy(buf + 4, data, write_len);
+        memcpy(state->data + 4, data, write_len);
        rlen = (read_len > 0) ? 64 : 0;
-        ret = dvb_usb_generic_rw(d, buf, 4 + write_len,
+        ret = dvb_usb_generic_rw(d, state->data, 4 + write_len,
-                                  buf, rlen, /* delay_ms */ 0);
+                                  state->data, rlen, /* delay_ms */ 0);
        if (0 != ret)
                goto failed;
        ret = -EIO;
-        if (SYNC_BYTE_IN != buf[0] || id != buf[1])
+        if (SYNC_BYTE_IN != state->data[0] || id != state->data[1])
                goto failed;
-        memcpy(data, buf + 4, read_len);
+        memcpy(data, state->data + 4, read_len);
+        mutex_unlock(&state->ca_mutex);
        return 0;
 failed:
        err("CI error %d; %02X %02X %02X -> %*ph.",
-             ret, SYNC_BYTE_OUT, id, cmd, 3, buf);
+             ret, SYNC_BYTE_OUT, id, cmd, 3, state->data);
+        mutex_unlock(&state->ca_mutex);
        return ret;
 }
@@ -405,52 +410,53 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr,
                                u8 *rcv_buf, u8 rcv_len)
 {
        struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
-        u8 buf[64];
        u8 id;
        int ret;
+        mutex_lock(&state->ca_mutex);
        id = state->c++;
        ret = -EINVAL;
        if (snd_len > 64 - 7 || rcv_len > 64 - 7)
                goto failed;
-        buf[0] = SYNC_BYTE_OUT;
+        state->data[0] = SYNC_BYTE_OUT;
-        buf[1] = id;
+        state->data[1] = id;
-        buf[2] = PCTV_CMD_I2C;
+        state->data[2] = PCTV_CMD_I2C;
-        buf[3] = snd_len + 3;
+        state->data[3] = snd_len + 3;
-        buf[4] = addr << 1;
+        state->data[4] = addr << 1;
-        buf[5] = snd_len;
+        state->data[5] = snd_len;
-        buf[6] = rcv_len;
+        state->data[6] = rcv_len;
-        memcpy(buf + 7, snd_buf, snd_len);
+        memcpy(state->data + 7, snd_buf, snd_len);
-        ret = dvb_usb_generic_rw(d, buf, 7 + snd_len,
+        ret = dvb_usb_generic_rw(d, state->data, 7 + snd_len,
-                                  buf, /* rcv_len */ 64,
+                                  state->data, /* rcv_len */ 64,
                                  /* delay_ms */ 0);
        if (ret < 0)
                goto failed;
        /* TT USB protocol error. */
        ret = -EIO;
-        if (SYNC_BYTE_IN != buf[0] || id != buf[1])
+        if (SYNC_BYTE_IN != state->data[0] || id != state->data[1])
                goto failed;
        /* I2C device didn't respond as expected. */
        ret = -EREMOTEIO;
-        if (buf[5] < snd_len || buf[6] < rcv_len)
+        if (state->data[5] < snd_len || state->data[6] < rcv_len)
                goto failed;
-        memcpy(rcv_buf, buf + 7, rcv_len);
+        memcpy(rcv_buf, state->data + 7, rcv_len);
+        mutex_unlock(&state->ca_mutex);
        return rcv_len;
 failed:
-        err("I2C error %d; %02X %02X  %02X %02X %02X -> "
+        err("I2C error %d; %02X %02X  %02X %02X %02X -> %*ph",
-             "%02X %02X  %02X %02X %02X.",
             ret, SYNC_BYTE_OUT, id, addr << 1, snd_len, rcv_len,
-             buf[0], buf[1], buf[4], buf[5], buf[6]);
+             7, state->data);
+        mutex_unlock(&state->ca_mutex);
        return ret;
 }
@@ -499,8 +505,7 @@ static u32 pctv452e_i2c_func(struct i2c_adapter *adapter)
 static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i)
 {
        struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
-        u8 b0[] = { 0xaa, 0, PCTV_CMD_RESET, 1, 0 };
+        u8 *rx;
-        u8 rx[PCTV_ANSWER_LEN];
        int ret;
        info("%s: %d\n", __func__, i);
@@ -511,6 +516,11 @@ static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i)
        if (state->initialized)
                return 0;
+        rx = kmalloc(PCTV_ANSWER_LEN, GFP_KERNEL);
+        if (!rx)
+                return -ENOMEM;
+        mutex_lock(&state->ca_mutex);
        /* hmm where shoud this should go? */
        ret = usb_set_interface(d->udev, 0, ISOC_INTERFACE_ALTERNATIVE);
        if (ret != 0)
@@ -518,65 +528,75 @@ static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i)
                        __func__, ret);
        /* this is a one-time initialization, dont know where to put */
-        b0[1] = state->c++;
+        state->data[0] = 0xaa;
+        state->data[1] = state->c++;
+        state->data[2] = PCTV_CMD_RESET;
+        state->data[3] = 1;
+        state->data[4] = 0;
        /* reset board */
-        ret = dvb_usb_generic_rw(d, b0, sizeof(b0), rx, PCTV_ANSWER_LEN, 0);
+        ret = dvb_usb_generic_rw(d, state->data, 5, rx, PCTV_ANSWER_LEN, 0);
        if (ret)
-                return ret;
+                goto ret;
-        b0[1] = state->c++;
+        state->data[1] = state->c++;
-        b0[4] = 1;
+        state->data[4] = 1;
        /* reset board (again?) */
-        ret = dvb_usb_generic_rw(d, b0, sizeof(b0), rx, PCTV_ANSWER_LEN, 0);
+        ret = dvb_usb_generic_rw(d, state->data, 5, rx, PCTV_ANSWER_LEN, 0);
        if (ret)
-                return ret;
+                goto ret;
        state->initialized = 1;
-        return 0;
+ret:
+        mutex_unlock(&state->ca_mutex);
+        kfree(rx);
+        return ret;
 }
 static int pctv452e_rc_query(struct dvb_usb_device *d)
 {
        struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
-        u8 b[CMD_BUFFER_SIZE];
-        u8 rx[PCTV_ANSWER_LEN];
        int ret, i;
-        u8 id = state->c++;
+        u8 id;
+        mutex_lock(&state->ca_mutex);
+        id = state->c++;
        /* prepare command header  */
-        b[0] = SYNC_BYTE_OUT;
+        state->data[0] = SYNC_BYTE_OUT;
-        b[1] = id;
+        state->data[1] = id;
-        b[2] = PCTV_CMD_IR;
+        state->data[2] = PCTV_CMD_IR;
-        b[3] = 0;
+        state->data[3] = 0;
        /* send ir request */
-        ret = dvb_usb_generic_rw(d, b, 4, rx, PCTV_ANSWER_LEN, 0);
+        ret = dvb_usb_generic_rw(d, state->data, 4,
+                                 state->data, PCTV_ANSWER_LEN, 0);
        if (ret != 0)
-                return ret;
+                goto ret;
        if (debug > 3) {
-                info("%s: read: %2d: %*ph: ", __func__, ret, 3, rx);
+                info("%s: read: %2d: %*ph: ", __func__, ret, 3, state->data);
-                for (i = 0; (i < rx[3]) && ((i+3) < PCTV_ANSWER_LEN); i++)
+                for (i = 0; (i < state->data[3]) && ((i + 3) < PCTV_ANSWER_LEN); i++)
-                        info(" %02x", rx[i+3]);
+                        info(" %02x", state->data[i + 3]);
                info("\n");
        }
-        if ((rx[3] == 9) &&  (rx[12] & 0x01)) {
+        if ((state->data[3] == 9) &&  (state->data[12] & 0x01)) {
                /* got a "press" event */
-                state->last_rc_key = RC_SCANCODE_RC5(rx[7], rx[6]);
+                state->last_rc_key = RC_SCANCODE_RC5(state->data[7], state->data[6]);
                if (debug > 2)
                        info("%s: cmd=0x%02x sys=0x%02x\n",
-                                __func__, rx[6], rx[7]);
+                                __func__, state->data[6], state->data[7]);
                rc_keydown(d->rc_dev, RC_TYPE_RC5, state->last_rc_key, 0);
        } else if (state->last_rc_key) {
                rc_keyup(d->rc_dev);
                state->last_rc_key = 0;
        }
+ret:
-        return 0;
+        mutex_unlock(&state->ca_mutex);
+        return ret;
 }
 static int pctv452e_read_mac_address(struct dvb_usb_device *d, u8 mac[6])
diff --git a/drivers/media/usb/dvb-usb/technisat-usb2.c b/drivers/media/usb/dvb-usb/technisat-usb2.c
index d9f3262bf071..4706628a3ed5 100644
--- a/drivers/media/usb/dvb-usb/technisat-usb2.c
+++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
@@ -89,9 +89,13 @@ struct technisat_usb2_state {
 static int technisat_usb2_i2c_access(struct usb_device *udev,
                u8 device_addr, u8 *tx, u8 txlen, u8 *rx, u8 rxlen)
 {
-        u8 b[64];
+        u8 *b;
        int ret, actual_length;
+        b = kmalloc(64, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
        deb_i2c("i2c-access: %02x, tx: ", device_addr);
        debug_dump(tx, txlen, deb_i2c);
        deb_i2c(" ");
@@ -123,7 +127,7 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
        if (ret < 0) {
                err("i2c-error: out failed %02x = %d", device_addr, ret);
-                return -ENODEV;
+                goto err;
        }
        ret = usb_bulk_msg(udev,
@@ -131,7 +135,7 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
                        b, 64, &actual_length, 1000);
        if (ret < 0) {
                err("i2c-error: in failed %02x = %d", device_addr, ret);
-                return -ENODEV;
+                goto err;
        }
        if (b[0] != I2C_STATUS_OK) {
@@ -140,7 +144,7 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
                if (!(b[0] == I2C_STATUS_NAK &&
                                device_addr == 0x60
                                /* && device_is_technisat_usb2 */))
-                        return -ENODEV;
+                        goto err;
        }
        deb_i2c("status: %d, ", b[0]);
@@ -154,7 +158,9 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
        deb_i2c("\n");
-        return 0;
+err:
+        kfree(b);
+        return ret;
 }
 static int technisat_usb2_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,
diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c
index c3a0e87066eb..f7bb78c1873c 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -1901,19 +1901,30 @@ static long s2255_vendor_req(struct s2255_dev *dev, unsigned char Request,
                             s32 TransferBufferLength, int bOut)
 {
        int r;
+        unsigned char *buf;
+        buf = kmalloc(TransferBufferLength, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
        if (!bOut) {
                r = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
                                    Request,
                                    USB_TYPE_VENDOR | USB_RECIP_DEVICE |
                                    USB_DIR_IN,
-                                    Value, Index, TransferBuffer,
+                                    Value, Index, buf,
                                    TransferBufferLength, HZ * 5);
+                if (r >= 0)
+                        memcpy(TransferBuffer, buf, TransferBufferLength);
        } else {
+                memcpy(buf, TransferBuffer, TransferBufferLength);
                r = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
                                    Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                                    Value, Index, TransferBuffer,
+                                    Value, Index, buf,
                                    TransferBufferLength, HZ * 5);
        }
+        kfree(buf);
        return r;
 }
diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
index db200c9d796d..22a9aae16291 100644
--- a/drivers/media/usb/stkwebcam/stk-webcam.c
+++ b/drivers/media/usb/stkwebcam/stk-webcam.c
@@ -147,20 +147,26 @@ int stk_camera_write_reg(struct stk_camera *dev, u16 index, u8 value)
 int stk_camera_read_reg(struct stk_camera *dev, u16 index, int *value)
 {
        struct usb_device *udev = dev->udev;
+        unsigned char *buf;
        int ret;
+        buf = kmalloc(sizeof(u8), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
                        0x00,
                        USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                        0x00,
                        index,
-                        (u8 *) value,
+                        buf,
                        sizeof(u8),
                        500);
-        if (ret < 0)
+        if (ret >= 0)
-                return ret;
+                memcpy(value, buf, sizeof(u8));
-        else
-                return 0;
+        kfree(buf);
+        return ret;
 }
 static int stk_start_stream(struct stk_camera *dev)
diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
index f300f060b3f3..1db0af6c7f94 100644
--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
@@ -156,6 +156,7 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
 {
        unsigned long first, last;
        int err, rw = 0;
+        unsigned int flags = FOLL_FORCE;
        dma->direction = direction;
        switch (dma->direction) {
@@ -178,12 +179,14 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
        if (NULL == dma->pages)
                return -ENOMEM;
+        if (rw == READ)
+                flags |= FOLL_WRITE;
        dprintk(1, "init user [0x%lx+0x%lx => %d pages]\n",
                data, size, dma->nr_pages);
        err = get_user_pages(data & PAGE_MASK, dma->nr_pages,
-                             rw == READ, 1, /* force */
+                             flags, dma->pages, NULL);
-                             dma->pages, NULL);
        if (err != dma->nr_pages) {
                dma->nr_pages = (err >= 0) ? err : 0;
diff --git a/drivers/media/v4l2-core/videobuf2-memops.c b/drivers/media/v4l2-core/videobuf2-memops.c
index 3c3b517f1d1c..1cd322e939c7 100644
--- a/drivers/media/v4l2-core/videobuf2-memops.c
+++ b/drivers/media/v4l2-core/videobuf2-memops.c
@@ -42,6 +42,10 @@ struct frame_vector *vb2_create_framevec(unsigned long start,
        unsigned long first, last;
        unsigned long nr;
        struct frame_vector *vec;
+        unsigned int flags = FOLL_FORCE;
+        if (write)
+                flags |= FOLL_WRITE;
        first = start >> PAGE_SHIFT;
        last = (start + length - 1) >> PAGE_SHIFT;
@@ -49,7 +53,7 @@ struct frame_vector *vb2_create_framevec(unsigned long start,
        vec = frame_vector_create(nr);
        if (!vec)
                return ERR_PTR(-ENOMEM);
-        ret = get_vaddr_frames(start & PAGE_MASK, nr, write, true, vec);
+        ret = get_vaddr_frames(start & PAGE_MASK, nr, flags, vec);
        if (ret < 0)
                goto out_destroy;
        /* We accept only complete set of PFNs */
diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c
index d34bc3530385..2e3cf012ef48 100644
--- a/drivers/memstick/host/rtsx_usb_ms.c
+++ b/drivers/memstick/host/rtsx_usb_ms.c
@@ -524,6 +524,7 @@ static void rtsx_usb_ms_handle_req(struct work_struct *work)
        int rc;
        if (!host->req) {
+                pm_runtime_get_sync(ms_dev(host));
                do {
                        rc = memstick_next_req(msh, &host->req);
                        dev_dbg(ms_dev(host), "next req %d\n", rc);
@@ -544,6 +545,7 @@ static void rtsx_usb_ms_handle_req(struct work_struct *work)
                                                host->req->error);
                        }
                } while (!rc);
+                pm_runtime_put(ms_dev(host));
        }
 }
@@ -570,6 +572,7 @@ static int rtsx_usb_ms_set_param(struct memstick_host *msh,
        dev_dbg(ms_dev(host), "%s: param = %d, value = %d\n",
                        __func__, param, value);
+        pm_runtime_get_sync(ms_dev(host));
        mutex_lock(&ucr->dev_mutex);
        err = rtsx_usb_card_exclusive_check(ucr, RTSX_USB_MS_CARD);
@@ -635,6 +638,7 @@ static int rtsx_usb_ms_set_param(struct memstick_host *msh,
        }
 out:
        mutex_unlock(&ucr->dev_mutex);
+        pm_runtime_put(ms_dev(host));
        /* power-on delay */
        if (param == MEMSTICK_POWER && value == MEMSTICK_POWER_ON)
@@ -681,6 +685,7 @@ static int rtsx_usb_detect_ms_card(void *__host)
        int err;
        for (;;) {
+                pm_runtime_get_sync(ms_dev(host));
                mutex_lock(&ucr->dev_mutex);
                /* Check pending MS card changes */
@@ -703,6 +708,7 @@ static int rtsx_usb_detect_ms_card(void *__host)
                }
 poll_again:
+                pm_runtime_put(ms_dev(host));
                if (host->eject)
                        break;
diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
index 3228fd182a99..9ff243970e93 100644
--- a/drivers/mfd/intel-lpss-pci.c
+++ b/drivers/mfd/intel-lpss-pci.c
@@ -123,19 +123,6 @@ static const struct intel_lpss_platform_info apl_i2c_info = {
        .properties = apl_i2c_properties,
 };
-static const struct intel_lpss_platform_info kbl_info = {
-        .clk_rate = 120000000,
-};
-static const struct intel_lpss_platform_info kbl_uart_info = {
-        .clk_rate = 120000000,
-        .clk_con_id = "baudclk",
-};
-static const struct intel_lpss_platform_info kbl_i2c_info = {
-        .clk_rate = 133000000,
-};
 static const struct pci_device_id intel_lpss_pci_ids[] = {
        /* BXT A-Step */
        { PCI_VDEVICE(INTEL, 0x0aac), (kernel_ulong_t)&bxt_i2c_info },
@@ -207,15 +194,15 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
        { PCI_VDEVICE(INTEL, 0xa161), (kernel_ulong_t)&spt_i2c_info },
        { PCI_VDEVICE(INTEL, 0xa166), (kernel_ulong_t)&spt_uart_info },
        /* KBL-H */
-        { PCI_VDEVICE(INTEL, 0xa2a7), (kernel_ulong_t)&kbl_uart_info },
+        { PCI_VDEVICE(INTEL, 0xa2a7), (kernel_ulong_t)&spt_uart_info },
-        { PCI_VDEVICE(INTEL, 0xa2a8), (kernel_ulong_t)&kbl_uart_info },
+        { PCI_VDEVICE(INTEL, 0xa2a8), (kernel_ulong_t)&spt_uart_info },
-        { PCI_VDEVICE(INTEL, 0xa2a9), (kernel_ulong_t)&kbl_info },
+        { PCI_VDEVICE(INTEL, 0xa2a9), (kernel_ulong_t)&spt_info },
-        { PCI_VDEVICE(INTEL, 0xa2aa), (kernel_ulong_t)&kbl_info },
+        { PCI_VDEVICE(INTEL, 0xa2aa), (kernel_ulong_t)&spt_info },
-        { PCI_VDEVICE(INTEL, 0xa2e0), (kernel_ulong_t)&kbl_i2c_info },
+        { PCI_VDEVICE(INTEL, 0xa2e0), (kernel_ulong_t)&spt_i2c_info },
-        { PCI_VDEVICE(INTEL, 0xa2e1), (kernel_ulong_t)&kbl_i2c_info },
+        { PCI_VDEVICE(INTEL, 0xa2e1), (kernel_ulong_t)&spt_i2c_info },
-        { PCI_VDEVICE(INTEL, 0xa2e2), (kernel_ulong_t)&kbl_i2c_info },
+        { PCI_VDEVICE(INTEL, 0xa2e2), (kernel_ulong_t)&spt_i2c_info },
-        { PCI_VDEVICE(INTEL, 0xa2e3), (kernel_ulong_t)&kbl_i2c_info },
+        { PCI_VDEVICE(INTEL, 0xa2e3), (kernel_ulong_t)&spt_i2c_info },
-        { PCI_VDEVICE(INTEL, 0xa2e6), (kernel_ulong_t)&kbl_uart_info },
+        { PCI_VDEVICE(INTEL, 0xa2e6), (kernel_ulong_t)&spt_uart_info },
        { }
 };
 MODULE_DEVICE_TABLE(pci, intel_lpss_pci_ids);
diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
index 41b113875d64..70c646b0097d 100644
--- a/drivers/mfd/intel-lpss.c
+++ b/drivers/mfd/intel-lpss.c
@@ -502,9 +502,6 @@ int intel_lpss_suspend(struct device *dev)
        for (i = 0; i < LPSS_PRIV_REG_COUNT; i++)
                lpss->priv_ctx[i] = readl(lpss->priv + i * 4);
-        /* Put the device into reset state */
-        writel(0, lpss->priv + LPSS_PRIV_RESETS);
        return 0;
 }
 EXPORT_SYMBOL_GPL(intel_lpss_suspend);
diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c
index 43e54b7e908f..f9a8c5203873 100644
--- a/drivers/mfd/intel_soc_pmic_bxtwc.c
+++ b/drivers/mfd/intel_soc_pmic_bxtwc.c
@@ -86,6 +86,7 @@ enum bxtwc_irqs_level2 {
        BXTWC_THRM2_IRQ,
        BXTWC_BCU_IRQ,
        BXTWC_ADC_IRQ,
+        BXTWC_USBC_IRQ,
        BXTWC_CHGR0_IRQ,
        BXTWC_CHGR1_IRQ,
        BXTWC_GPIO0_IRQ,
@@ -111,7 +112,8 @@ static const struct regmap_irq bxtwc_regmap_irqs_level2[] = {
        REGMAP_IRQ_REG(BXTWC_THRM2_IRQ, 2, 0xff),
        REGMAP_IRQ_REG(BXTWC_BCU_IRQ, 3, 0x1f),
        REGMAP_IRQ_REG(BXTWC_ADC_IRQ, 4, 0xff),
-        REGMAP_IRQ_REG(BXTWC_CHGR0_IRQ, 5, 0x3f),
+        REGMAP_IRQ_REG(BXTWC_USBC_IRQ, 5, BIT(5)),
+        REGMAP_IRQ_REG(BXTWC_CHGR0_IRQ, 5, 0x1f),
        REGMAP_IRQ_REG(BXTWC_CHGR1_IRQ, 6, 0x1f),
        REGMAP_IRQ_REG(BXTWC_GPIO0_IRQ, 7, 0xff),
        REGMAP_IRQ_REG(BXTWC_GPIO1_IRQ, 8, 0x3f),
@@ -146,7 +148,7 @@ static struct resource adc_resources[] = {
 };
 static struct resource usbc_resources[] = {
-        DEFINE_RES_IRQ_NAMED(BXTWC_CHGR0_IRQ, "USBC"),
+        DEFINE_RES_IRQ(BXTWC_USBC_IRQ),
 };
 static struct resource charger_resources[] = {
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 3ac486a597f3..c57e407020f1 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -399,6 +399,8 @@ int mfd_clone_cell(const char *cell, const char **clones, size_t n_clones)
                                        clones[i]);
        }
+        put_device(dev);
        return 0;
 }
 EXPORT_SYMBOL(mfd_clone_cell);
diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index cfdae8a3d779..b0c7bcdaf5df 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -851,6 +851,8 @@ static int stmpe_reset(struct stmpe *stmpe)
        if (ret < 0)
                return ret;
+        msleep(10);
        timeout = jiffies + msecs_to_jiffies(100);
        while (time_before(jiffies, timeout)) {
                ret = __stmpe_reg_read(stmpe, stmpe->regs[STMPE_IDX_SYS_CTRL]);
diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c
index 2f2225e845ef..b93fe4c4957a 100644
--- a/drivers/mfd/syscon.c
+++ b/drivers/mfd/syscon.c
@@ -73,8 +73,10 @@ static struct syscon *of_syscon_register(struct device_node *np)
        /* Parse the device's DT node for an endianness specification */
        if (of_property_read_bool(np, "big-endian"))
                syscon_config.val_format_endian = REGMAP_ENDIAN_BIG;
-         else if (of_property_read_bool(np, "little-endian"))
+        else if (of_property_read_bool(np, "little-endian"))
                syscon_config.val_format_endian = REGMAP_ENDIAN_LITTLE;
+        else if (of_property_read_bool(np, "native-endian"))
+                syscon_config.val_format_endian = REGMAP_ENDIAN_NATIVE;
        /*
         * search for reg-io-width property in DT. If it is not provided,
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index 7eec619a6023..8588dbad3301 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -393,8 +393,13 @@ static int wm8994_device_init(struct wm8994 *wm8994, int irq)
                BUG();
                goto err;
        }
-                
-        ret = devm_regulator_bulk_get(wm8994->dev, wm8994->num_supplies,
+        /*
+         * Can't use devres helper here as some of the supplies are provided by
+         * wm8994->dev's children (regulators) and those regulators are
+         * unregistered by the devres core before the supplies are freed.
+         */
+        ret = regulator_bulk_get(wm8994->dev, wm8994->num_supplies,
                                 wm8994->supplies);
        if (ret != 0) {
                dev_err(wm8994->dev, "Failed to get supplies: %d\n", ret);
@@ -405,7 +410,7 @@ static int wm8994_device_init(struct wm8994 *wm8994, int irq)
                                    wm8994->supplies);
        if (ret != 0) {
                dev_err(wm8994->dev, "Failed to enable supplies: %d\n", ret);
-                goto err;
+                goto err_regulator_free;
        }
        ret = wm8994_reg_read(wm8994, WM8994_SOFTWARE_RESET);
@@ -596,6 +601,8 @@ err_irq:
 err_enable:
        regulator_bulk_disable(wm8994->num_supplies,
                               wm8994->supplies);
+err_regulator_free:
+        regulator_bulk_free(wm8994->num_supplies, wm8994->supplies);
 err:
        mfd_remove_devices(wm8994->dev);
        return ret;
@@ -604,10 +611,11 @@ err:
 static void wm8994_device_exit(struct wm8994 *wm8994)
 {
        pm_runtime_disable(wm8994->dev);
-        mfd_remove_devices(wm8994->dev);
        wm8994_irq_exit(wm8994);
        regulator_bulk_disable(wm8994->num_supplies,
                               wm8994->supplies);
+        regulator_bulk_free(wm8994->num_supplies, wm8994->supplies);
+        mfd_remove_devices(wm8994->dev);
 }
 static const struct of_device_id wm8994_of_match[] = {
diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c
index f3d34b941f85..2e5233b60971 100644
--- a/drivers/misc/cxl/api.c
+++ b/drivers/misc/cxl/api.c
@@ -229,6 +229,14 @@ int cxl_start_context(struct cxl_context *ctx, u64 wed,
        if (ctx->status == STARTED)
                goto out; /* already started */
+        /*
+         * Increment the mapped context count for adapter. This also checks
+         * if adapter_context_lock is taken.
+         */
+        rc = cxl_adapter_context_get(ctx->afu->adapter);
+        if (rc)
+                goto out;
        if (task) {
                ctx->pid = get_task_pid(task, PIDTYPE_PID);
                ctx->glpid = get_task_pid(task->group_leader, PIDTYPE_PID);
@@ -239,7 +247,10 @@ int cxl_start_context(struct cxl_context *ctx, u64 wed,
        cxl_ctx_get();
        if ((rc = cxl_ops->attach_process(ctx, kernel, wed, 0))) {
+                put_pid(ctx->glpid);
                put_pid(ctx->pid);
+                ctx->glpid = ctx->pid = NULL;
+                cxl_adapter_context_put(ctx->afu->adapter);
                cxl_ctx_put();
                goto out;
        }
diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
index c466ee2b0c97..5e506c19108a 100644
--- a/drivers/misc/cxl/context.c
+++ b/drivers/misc/cxl/context.c
@@ -238,6 +238,9 @@ int __detach_context(struct cxl_context *ctx)
        put_pid(ctx->glpid);
        cxl_ctx_put();
+        /* Decrease the attached context count on the adapter */
+        cxl_adapter_context_put(ctx->afu->adapter);
        return 0;
 }
diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
index 01d372aba131..a144073593fa 100644
--- a/drivers/misc/cxl/cxl.h
+++ b/drivers/misc/cxl/cxl.h
@@ -618,6 +618,14 @@ struct cxl {
        bool perst_select_user;
        bool perst_same_image;
        bool psl_timebase_synced;
+        /*
+         * number of contexts mapped on to this card. Possible values are:
+         * >0: Number of contexts mapped and new one can be mapped.
+         *  0: No active contexts and new ones can be mapped.
+         * -1: No contexts mapped and new ones cannot be mapped.
+         */
+        atomic_t contexts_num;
 };
 int cxl_pci_alloc_one_irq(struct cxl *adapter);
@@ -944,4 +952,20 @@ bool cxl_pci_is_vphb_device(struct pci_dev *dev);
 /* decode AFU error bits in the PSL register PSL_SERR_An */
 void cxl_afu_decode_psl_serr(struct cxl_afu *afu, u64 serr);
+/*
+ * Increments the number of attached contexts on an adapter.
+ * In case an adapter_context_lock is taken the return -EBUSY.
+ */
+int cxl_adapter_context_get(struct cxl *adapter);
+/* Decrements the number of attached contexts on an adapter */
+void cxl_adapter_context_put(struct cxl *adapter);
+/* If no active contexts then prevents contexts from being attached */
+int cxl_adapter_context_lock(struct cxl *adapter);
+/* Unlock the contexts-lock if taken. Warn and force unlock otherwise */
+void cxl_adapter_context_unlock(struct cxl *adapter);
 #endif
diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
index 5fb9894b157f..77080cc5fa0a 100644
--- a/drivers/misc/cxl/file.c
+++ b/drivers/misc/cxl/file.c
@@ -194,6 +194,16 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
        ctx->mmio_err_ff = !!(work.flags & CXL_START_WORK_ERR_FF);
        /*
+         * Increment the mapped context count for adapter. This also checks
+         * if adapter_context_lock is taken.
+         */
+        rc = cxl_adapter_context_get(ctx->afu->adapter);
+        if (rc) {
+                afu_release_irqs(ctx, ctx);
+                goto out;
+        }
+        /*
         * We grab the PID here and not in the file open to allow for the case
         * where a process (master, some daemon, etc) has opened the chardev on
         * behalf of another process, so the AFU's mm gets bound to the process
@@ -205,11 +215,16 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
        ctx->pid = get_task_pid(current, PIDTYPE_PID);
        ctx->glpid = get_task_pid(current->group_leader, PIDTYPE_PID);
        trace_cxl_attach(ctx, work.work_element_descriptor, work.num_interrupts, amr);
        if ((rc = cxl_ops->attach_process(ctx, false, work.work_element_descriptor,
                                                        amr))) {
                afu_release_irqs(ctx, ctx);
+                cxl_adapter_context_put(ctx->afu->adapter);
+                put_pid(ctx->glpid);
+                put_pid(ctx->pid);
+                ctx->glpid = ctx->pid = NULL;
                goto out;
        }
diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
index 9aa58a77a24d..3e102cd6ed91 100644
--- a/drivers/misc/cxl/guest.c
+++ b/drivers/misc/cxl/guest.c
@@ -1152,6 +1152,9 @@ struct cxl *cxl_guest_init_adapter(struct device_node *np, struct platform_devic
        if ((rc = cxl_sysfs_adapter_add(adapter)))
                goto err_put1;
+        /* release the context lock as the adapter is configured */
+        cxl_adapter_context_unlock(adapter);
        return adapter;
 err_put1:
diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
index d9be23b24aa3..62e0dfb5f15b 100644
--- a/drivers/misc/cxl/main.c
+++ b/drivers/misc/cxl/main.c
@@ -243,8 +243,10 @@ struct cxl *cxl_alloc_adapter(void)
        if (dev_set_name(&adapter->dev, "card%i", adapter->adapter_num))
                goto err2;
-        return adapter;
+        /* start with context lock taken */
+        atomic_set(&adapter->contexts_num, -1);
+        return adapter;
 err2:
        cxl_remove_adapter_nr(adapter);
 err1:
@@ -286,6 +288,44 @@ int cxl_afu_select_best_mode(struct cxl_afu *afu)
        return 0;
 }
+int cxl_adapter_context_get(struct cxl *adapter)
+{
+        int rc;
+        rc = atomic_inc_unless_negative(&adapter->contexts_num);
+        return rc >= 0 ? 0 : -EBUSY;
+}
+void cxl_adapter_context_put(struct cxl *adapter)
+{
+        atomic_dec_if_positive(&adapter->contexts_num);
+}
+int cxl_adapter_context_lock(struct cxl *adapter)
+{
+        int rc;
+        /* no active contexts -> contexts_num == 0 */
+        rc = atomic_cmpxchg(&adapter->contexts_num, 0, -1);
+        return rc ? -EBUSY : 0;
+}
+void cxl_adapter_context_unlock(struct cxl *adapter)
+{
+        int val = atomic_cmpxchg(&adapter->contexts_num, -1, 0);
+        /*
+         * contexts lock taken -> contexts_num == -1
+         * If not true then show a warning and force reset the lock.
+         * This will happen when context_unlock was requested without
+         * doing a context_lock.
+         */
+        if (val != -1) {
+                atomic_set(&adapter->contexts_num, 0);
+                WARN(1, "Adapter context unlocked with %d active contexts",
+                     val);
+        }
+}
 static int __init init_cxl(void)
 {
        int rc = 0;
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index 7afad8477ad5..e96be9ca4e60 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1487,6 +1487,8 @@ static int cxl_configure_adapter(struct cxl *adapter, struct pci_dev *dev)
        if ((rc = cxl_native_register_psl_err_irq(adapter)))
                goto err;
+        /* Release the context lock as adapter is configured */
+        cxl_adapter_context_unlock(adapter);
        return 0;
 err:
diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
index b043c20f158f..a8b6d6a635e9 100644
--- a/drivers/misc/cxl/sysfs.c
+++ b/drivers/misc/cxl/sysfs.c
@@ -75,12 +75,31 @@ static ssize_t reset_adapter_store(struct device *device,
        int val;
        rc = sscanf(buf, "%i", &val);
-        if ((rc != 1) || (val != 1))
+        if ((rc != 1) || (val != 1 && val != -1))
                return -EINVAL;
-        if ((rc = cxl_ops->adapter_reset(adapter)))
+        /*
-                return rc;
+         * See if we can lock the context mapping that's only allowed
-        return count;
+         * when there are no contexts attached to the adapter. Once
+         * taken this will also prevent any context from getting activated.
+         */
+        if (val == 1) {
+                rc =  cxl_adapter_context_lock(adapter);
+                if (rc)
+                        goto out;
+                rc = cxl_ops->adapter_reset(adapter);
+                /* In case reset failed release context lock */
+                if (rc)
+                        cxl_adapter_context_unlock(adapter);
+        } else if (val == -1) {
+                /* Perform a forced adapter reset */
+                rc = cxl_ops->adapter_reset(adapter);
+        }
+out:
+        return rc ? rc : count;
 }
 static ssize_t load_image_on_perst_show(struct device *device,
diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
index 8a679ecc8fd1..fc2794b513fa 100644
--- a/drivers/misc/genwqe/card_utils.c
+++ b/drivers/misc/genwqe/card_utils.c
@@ -352,17 +352,27 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
                if (copy_from_user(sgl->lpage, user_addr + user_size -
                                   sgl->lpage_size, sgl->lpage_size)) {
                        rc = -EFAULT;
-                        goto err_out1;
+                        goto err_out2;
                }
        }
        return 0;
+ err_out2:
+        __genwqe_free_consistent(cd, PAGE_SIZE, sgl->lpage,
+                                 sgl->lpage_dma_addr);
+        sgl->lpage = NULL;
+        sgl->lpage_dma_addr = 0;
 err_out1:
        __genwqe_free_consistent(cd, PAGE_SIZE, sgl->fpage,
                                 sgl->fpage_dma_addr);
+        sgl->fpage = NULL;
+        sgl->fpage_dma_addr = 0;
 err_out:
        __genwqe_free_consistent(cd, sgl->sgl_size, sgl->sgl,
                                 sgl->sgl_dma_addr);
+        sgl->sgl = NULL;
+        sgl->sgl_dma_addr = 0;
+        sgl->sgl_size = 0;
        return -ENOMEM;
 }
diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
index e9e6ea3ab73c..75b9d4ac8b1e 100644
--- a/drivers/misc/mei/bus-fixup.c
+++ b/drivers/misc/mei/bus-fixup.c
@@ -178,7 +178,7 @@ static int mei_nfc_if_version(struct mei_cl *cl,
        ret = 0;
        bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length);
-        if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
+        if (bytes_recv < if_version_length) {
                dev_err(bus->dev, "Could not read IF version\n");
                ret = -EIO;
                goto err;
diff --git a/drivers/misc/mei/hw-txe.c b/drivers/misc/mei/hw-txe.c
index e6e5e55a12ed..60415a2bfcbd 100644
--- a/drivers/misc/mei/hw-txe.c
+++ b/drivers/misc/mei/hw-txe.c
@@ -981,11 +981,13 @@ static bool mei_txe_check_and_ack_intrs(struct mei_device *dev, bool do_ack)
        hisr = mei_txe_br_reg_read(hw, HISR_REG);
        aliveness = mei_txe_aliveness_get(dev);
-        if (hhisr & IPC_HHIER_SEC && aliveness)
+        if (hhisr & IPC_HHIER_SEC && aliveness) {
                ipc_isr = mei_txe_sec_reg_read_silent(hw,
                                SEC_IPC_HOST_INT_STATUS_REG);
-        else
+        } else {
                ipc_isr = 0;
+                hhisr &= ~IPC_HHIER_SEC;
+        }
        generated = generated ||
                (hisr & HISR_INT_STS_MSK) ||
diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
index e0203b1a20fd..f806a4471eb9 100644
--- a/drivers/misc/mic/scif/scif_rma.c
+++ b/drivers/misc/mic/scif/scif_rma.c
@@ -1396,8 +1396,7 @@ retry:
                pinned_pages->nr_pages = get_user_pages(
                                (u64)addr,
                                nr_pages,
-                                !!(prot & SCIF_PROT_WRITE),
+                                (prot & SCIF_PROT_WRITE) ? FOLL_WRITE : 0,
-                                0,
                                pinned_pages->pages,
                                NULL);
                up_write(&mm->mmap_sem);
diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index a2d97b9b17e3..6fb773dbcd0c 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -198,7 +198,7 @@ static int non_atomic_pte_lookup(struct vm_area_struct *vma,
 #else
        *pageshift = PAGE_SHIFT;
 #endif
-        if (get_user_pages(vaddr, 1, write, 0, &page, NULL) <= 0)
+        if (get_user_pages(vaddr, 1, write ? FOLL_WRITE : 0, &page, NULL) <= 0)
                return -EFAULT;
        *paddr = page_to_phys(page);
        put_page(page);
diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
index 1525870f460a..33741ad4a74a 100644
--- a/drivers/misc/sgi-gru/grumain.c
+++ b/drivers/misc/sgi-gru/grumain.c
@@ -283,7 +283,7 @@ static void gru_unload_mm_tracker(struct gru_state *gru,
        spin_lock(&gru->gs_asid_lock);
        BUG_ON((asids->mt_ctxbitmap & ctxbitmap) != ctxbitmap);
        asids->mt_ctxbitmap ^= ctxbitmap;
-        gru_dbg(grudev, "gid %d, gts %p, gms %p, ctxnum 0x%d, asidmap 0x%lx\n",
+        gru_dbg(grudev, "gid %d, gts %p, gms %p, ctxnum %d, asidmap 0x%lx\n",
                gru->gs_gid, gts, gms, gts->ts_ctxnum, gms->ms_asidmap[0]);
        spin_unlock(&gru->gs_asid_lock);
        spin_unlock(&gms->ms_asid_lock);
diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c
index a8cee33ae8d2..b3fa738ae005 100644
--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
+++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
@@ -431,6 +431,12 @@ int vmci_doorbell_create(struct vmci_handle *handle,
        if (vmci_handle_is_invalid(*handle)) {
                u32 context_id = vmci_get_context_id();
+                if (context_id == VMCI_INVALID_ID) {
+                        pr_warn("Failed to get context ID\n");
+                        result = VMCI_ERROR_NO_RESOURCES;
+                        goto free_mem;
+                }
                /* Let resource code allocate a free ID for us */
                new_handle = vmci_make_handle(context_id, VMCI_INVALID_ID);
        } else {
@@ -525,7 +531,7 @@ int vmci_doorbell_destroy(struct vmci_handle handle)
        entry = container_of(resource, struct dbell_entry, resource);
-        if (vmci_guest_code_active()) {
+        if (!hlist_unhashed(&entry->node)) {
                int result;
                dbell_index_table_remove(entry);
diff --git a/drivers/misc/vmw_vmci/vmci_driver.c b/drivers/misc/vmw_vmci/vmci_driver.c
index 896be150e28f..d7eaf1eb11e7 100644
--- a/drivers/misc/vmw_vmci/vmci_driver.c
+++ b/drivers/misc/vmw_vmci/vmci_driver.c
@@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
-MODULE_VERSION("1.1.4.0-k");
+MODULE_VERSION("1.1.5.0-k");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index c3335112e68c..709a872ed484 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -46,6 +46,7 @@
 #include <asm/uaccess.h>
 #include "queue.h"
+#include "block.h"
 MODULE_ALIAS("mmc:block");
 #ifdef MODULE_PARAM_PREFIX
@@ -1786,7 +1787,7 @@ static void mmc_blk_packed_hdr_wrq_prep(struct mmc_queue_req *mqrq,
        struct mmc_blk_data *md = mq->data;
        struct mmc_packed *packed = mqrq->packed;
        bool do_rel_wr, do_data_tag;
-        u32 *packed_cmd_hdr;
+        __le32 *packed_cmd_hdr;
        u8 hdr_blocks;
        u8 i = 1;
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index 5a8dc5a76e0d..3678220964fe 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -2347,7 +2347,7 @@ static int mmc_test_ongoing_transfer(struct mmc_test_card *test,
        struct mmc_test_req *rq = mmc_test_req_alloc();
        struct mmc_host *host = test->card->host;
        struct mmc_test_area *t = &test->area;
-        struct mmc_async_req areq;
+        struct mmc_test_async_req test_areq = { .test = test };
        struct mmc_request *mrq;
        unsigned long timeout;
        bool expired = false;
@@ -2363,8 +2363,8 @@ static int mmc_test_ongoing_transfer(struct mmc_test_card *test,
                mrq->sbc = &rq->sbc;
        mrq->cap_cmd_during_tfr = true;
-        areq.mrq = mrq;
+        test_areq.areq.mrq = mrq;
-        areq.err_check = mmc_test_check_result_async;
+        test_areq.areq.err_check = mmc_test_check_result_async;
        mmc_test_prepare_mrq(test, mrq, t->sg, t->sg_len, dev_addr, t->blocks,
                             512, write);
@@ -2378,7 +2378,7 @@ static int mmc_test_ongoing_transfer(struct mmc_test_card *test,
        /* Start ongoing data request */
        if (use_areq) {
-                mmc_start_req(host, &areq, &ret);
+                mmc_start_req(host, &test_areq.areq, &ret);
                if (ret)
                        goto out_free;
        } else {
diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
index 3c15a75bae86..342f1e3f301e 100644
--- a/drivers/mmc/card/queue.h
+++ b/drivers/mmc/card/queue.h
@@ -31,7 +31,7 @@ enum mmc_packed_type {
 struct mmc_packed {
        struct list_head        list;
-        u32                     cmd_hdr[1024];
+        __le32                  cmd_hdr[1024];
        unsigned int            blocks;
        u8                      nr_entries;
        u8                      retries;
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 3486bc7fbb64..df19777068a6 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -26,6 +26,8 @@
 #include "mmc_ops.h"
 #include "sd_ops.h"
+#define DEFAULT_CMD6_TIMEOUT_MS 500
 static const unsigned int tran_exp[] = {
        10000,          100000,         1000000,        10000000,
        0,              0,              0,              0
@@ -571,6 +573,7 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
                card->erased_byte = 0x0;
        /* eMMC v4.5 or later */
+        card->ext_csd.generic_cmd6_time = DEFAULT_CMD6_TIMEOUT_MS;
        if (card->ext_csd.rev >= 6) {
                card->ext_csd.feature_support |= MMC_DISCARD_FEATURE;
@@ -1263,6 +1266,16 @@ static int mmc_select_hs400es(struct mmc_card *card)
                goto out_err;
        }
+        if (card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS400_1_2V)
+                err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120);
+        if (err && card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS400_1_8V)
+                err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180);
+        /* If fails try again during next card power cycle */
+        if (err)
+                goto out_err;
        err = mmc_select_bus_width(card);
        if (err < 0)
                goto out_err;
@@ -1272,6 +1285,8 @@ static int mmc_select_hs400es(struct mmc_card *card)
        if (err)
                goto out_err;
+        mmc_set_clock(host, card->ext_csd.hs_max_dtr);
        err = mmc_switch_status(card);
        if (err)
                goto out_err;
diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
index c0bb0c793e84..dbbc4303bdd0 100644
--- a/drivers/mmc/host/dw_mmc-pltfm.c
+++ b/drivers/mmc/host/dw_mmc-pltfm.c
@@ -46,12 +46,13 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
        host->pdata = pdev->dev.platform_data;
        regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        /* Get registers' physical base address */
-        host->phy_regs = regs->start;
        host->regs = devm_ioremap_resource(&pdev->dev, regs);
        if (IS_ERR(host->regs))
                return PTR_ERR(host->regs);
+        /* Get registers' physical base address */
+        host->phy_regs = regs->start;
        platform_set_drvdata(pdev, host);
        return dw_mci_probe(host);
 }
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 4fcbc4012ed0..df478ae72e23 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1058,6 +1058,7 @@ static int dw_mci_submit_data_dma(struct dw_mci *host, struct mmc_data *data)
        spin_unlock_irqrestore(&host->irq_lock, irqflags);
        if (host->dma_ops->start(host, sg_len)) {
+                host->dma_ops->stop(host);
                /* We can't do DMA, try PIO for this one */
                dev_dbg(host->dev,
                        "%s: fall back to PIO mode for current transfer\n",
@@ -2940,7 +2941,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
                return ERR_PTR(-ENOMEM);
        /* find reset controller when exist */
-        pdata->rstc = devm_reset_control_get_optional(dev, NULL);
+        pdata->rstc = devm_reset_control_get_optional(dev, "reset");
        if (IS_ERR(pdata->rstc)) {
                if (PTR_ERR(pdata->rstc) == -EPROBE_DEFER)
                        return ERR_PTR(-EPROBE_DEFER);
diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
index d839147e591d..44ecebd1ea8c 100644
--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -661,13 +661,13 @@ static int mxs_mmc_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, mmc);
+        spin_lock_init(&host->lock);
        ret = devm_request_irq(&pdev->dev, irq_err, mxs_mmc_irq_handler, 0,
                               dev_name(&pdev->dev), host);
        if (ret)
                goto out_free_dma;
-        spin_lock_init(&host->lock);
        ret = mmc_add_host(mmc);
        if (ret)
                goto out_free_dma;
diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c
index 4106295527b9..6e9c0f8fddb1 100644
--- a/drivers/mmc/host/rtsx_usb_sdmmc.c
+++ b/drivers/mmc/host/rtsx_usb_sdmmc.c
@@ -1138,11 +1138,6 @@ static void sdmmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
        dev_dbg(sdmmc_dev(host), "%s\n", __func__);
        mutex_lock(&ucr->dev_mutex);
-        if (rtsx_usb_card_exclusive_check(ucr, RTSX_USB_SD_CARD)) {
-                mutex_unlock(&ucr->dev_mutex);
-                return;
-        }
        sd_set_power_mode(host, ios->power_mode);
        sd_set_bus_width(host, ios->bus_width);
        sd_set_timing(host, ios->timing, &host->ddr_mode);
@@ -1314,6 +1309,7 @@ static void rtsx_usb_update_led(struct work_struct *work)
                container_of(work, struct rtsx_usb_sdmmc, led_work);
        struct rtsx_ucr *ucr = host->ucr;
+        pm_runtime_get_sync(sdmmc_dev(host));
        mutex_lock(&ucr->dev_mutex);
        if (host->led.brightness == LED_OFF)
@@ -1322,6 +1318,7 @@ static void rtsx_usb_update_led(struct work_struct *work)
                rtsx_usb_turn_on_led(ucr);
        mutex_unlock(&ucr->dev_mutex);
+        pm_runtime_put(sdmmc_dev(host));
 }
 #endif
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 1f54fd8755c8..7123ef96ed18 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -346,7 +346,8 @@ static void esdhc_writel_le(struct sdhci_host *host, u32 val, int reg)
        struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
        u32 data;
-        if (unlikely(reg == SDHCI_INT_ENABLE || reg == SDHCI_SIGNAL_ENABLE)) {
+        if (unlikely(reg == SDHCI_INT_ENABLE || reg == SDHCI_SIGNAL_ENABLE ||
+                        reg == SDHCI_INT_STATUS)) {
                if ((val & SDHCI_INT_CARD_INT) && !esdhc_is_usdhc(imx_data)) {
                        /*
                         * Clear and then set D3CD bit to avoid missing the
@@ -555,6 +556,25 @@ static void esdhc_writew_le(struct sdhci_host *host, u16 val, int reg)
        esdhc_clrset_le(host, 0xffff, val, reg);
 }
+static u8 esdhc_readb_le(struct sdhci_host *host, int reg)
+{
+        u8 ret;
+        u32 val;
+        switch (reg) {
+        case SDHCI_HOST_CONTROL:
+                val = readl(host->ioaddr + reg);
+                ret = val & SDHCI_CTRL_LED;
+                ret |= (val >> 5) & SDHCI_CTRL_DMA_MASK;
+                ret |= (val & ESDHC_CTRL_4BITBUS);
+                ret |= (val & ESDHC_CTRL_8BITBUS) << 3;
+                return ret;
+        }
+        return readb(host->ioaddr + reg);
+}
 static void esdhc_writeb_le(struct sdhci_host *host, u8 val, int reg)
 {
        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
@@ -947,6 +967,7 @@ static void esdhc_set_timeout(struct sdhci_host *host, struct mmc_command *cmd)
 static struct sdhci_ops sdhci_esdhc_ops = {
        .read_l = esdhc_readl_le,
        .read_w = esdhc_readw_le,
+        .read_b = esdhc_readb_le,
        .write_l = esdhc_writel_le,
        .write_w = esdhc_writew_le,
        .write_b = esdhc_writeb_le,
diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
index 8ef44a2a2fd9..90ed2e12d345 100644
--- a/drivers/mmc/host/sdhci-msm.c
+++ b/drivers/mmc/host/sdhci-msm.c
@@ -647,6 +647,7 @@ static int sdhci_msm_probe(struct platform_device *pdev)
        if (msm_host->pwr_irq < 0) {
                dev_err(&pdev->dev, "Get pwr_irq failed (%d)\n",
                        msm_host->pwr_irq);
+                ret = msm_host->pwr_irq;
                goto clk_disable;
        }
diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
index da8e40af6f85..410a55b1c25f 100644
--- a/drivers/mmc/host/sdhci-of-arasan.c
+++ b/drivers/mmc/host/sdhci-of-arasan.c
@@ -250,7 +250,7 @@ static void sdhci_arasan_hs400_enhanced_strobe(struct mmc_host *mmc,
        writel(vendor, host->ioaddr + SDHCI_ARASAN_VENDOR_REGISTER);
 }
-void sdhci_arasan_reset(struct sdhci_host *host, u8 mask)
+static void sdhci_arasan_reset(struct sdhci_host *host, u8 mask)
 {
        u8 ctrl;
        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
@@ -265,6 +265,28 @@ void sdhci_arasan_reset(struct sdhci_host *host, u8 mask)
        }
 }
+static int sdhci_arasan_voltage_switch(struct mmc_host *mmc,
+                                       struct mmc_ios *ios)
+{
+        switch (ios->signal_voltage) {
+        case MMC_SIGNAL_VOLTAGE_180:
+                /*
+                 * Plese don't switch to 1V8 as arasan,5.1 doesn't
+                 * actually refer to this setting to indicate the
+                 * signal voltage and the state machine will be broken
+                 * actually if we force to enable 1V8. That's something
+                 * like broken quirk but we could work around here.
+                 */
+                return 0;
+        case MMC_SIGNAL_VOLTAGE_330:
+        case MMC_SIGNAL_VOLTAGE_120:
+                /* We don't support 3V3 and 1V2 */
+                break;
+        }
+        return -EINVAL;
+}
 static struct sdhci_ops sdhci_arasan_ops = {
        .set_clock = sdhci_arasan_set_clock,
        .get_max_clock = sdhci_pltfm_clk_get_max_clock,
@@ -661,6 +683,8 @@ static int sdhci_arasan_probe(struct platform_device *pdev)
                host->mmc_host_ops.hs400_enhanced_strobe =
                                        sdhci_arasan_hs400_enhanced_strobe;
+                host->mmc_host_ops.start_signal_voltage_switch =
+                                        sdhci_arasan_voltage_switch;
        }
        ret = sdhci_add_host(host);
diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
index fb71c866eacc..1bb11e4a9fe5 100644
--- a/drivers/mmc/host/sdhci-of-esdhc.c
+++ b/drivers/mmc/host/sdhci-of-esdhc.c
@@ -66,6 +66,20 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
                        return ret;
                }
        }
+        /*
+         * The DAT[3:0] line signal levels and the CMD line signal level are
+         * not compatible with standard SDHC register. The line signal levels
+         * DAT[7:0] are at bits 31:24 and the command line signal level is at
+         * bit 23. All other bits are the same as in the standard SDHC
+         * register.
+         */
+        if (spec_reg == SDHCI_PRESENT_STATE) {
+                ret = value & 0x000fffff;
+                ret |= (value >> 4) & SDHCI_DATA_LVL_MASK;
+                ret |= (value << 1) & SDHCI_CMD_LVL;
+                return ret;
+        }
        ret = value;
        return ret;
 }
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index 72a1f1f5180a..1d9e00a00e9f 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -32,6 +32,14 @@
 #include "sdhci-pci.h"
 #include "sdhci-pci-o2micro.h"
+static int sdhci_pci_enable_dma(struct sdhci_host *host);
+static void sdhci_pci_set_bus_width(struct sdhci_host *host, int width);
+static void sdhci_pci_hw_reset(struct sdhci_host *host);
+static int sdhci_pci_select_drive_strength(struct sdhci_host *host,
+                                           struct mmc_card *card,
+                                           unsigned int max_dtr, int host_drv,
+                                           int card_drv, int *drv_type);
 /*****************************************************************************\
 *                                                                           *
 * Hardware specific quirk handling                                          *
@@ -390,6 +398,45 @@ static int byt_sd_probe_slot(struct sdhci_pci_slot *slot)
        return 0;
 }
+#define SDHCI_INTEL_PWR_TIMEOUT_CNT     20
+#define SDHCI_INTEL_PWR_TIMEOUT_UDELAY  100
+static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode,
+                                  unsigned short vdd)
+{
+        int cntr;
+        u8 reg;
+        sdhci_set_power(host, mode, vdd);
+        if (mode == MMC_POWER_OFF)
+                return;
+        /*
+         * Bus power might not enable after D3 -> D0 transition due to the
+         * present state not yet having propagated. Retry for up to 2ms.
+         */
+        for (cntr = 0; cntr < SDHCI_INTEL_PWR_TIMEOUT_CNT; cntr++) {
+                reg = sdhci_readb(host, SDHCI_POWER_CONTROL);
+                if (reg & SDHCI_POWER_ON)
+                        break;
+                udelay(SDHCI_INTEL_PWR_TIMEOUT_UDELAY);
+                reg |= SDHCI_POWER_ON;
+                sdhci_writeb(host, reg, SDHCI_POWER_CONTROL);
+        }
+}
+static const struct sdhci_ops sdhci_intel_byt_ops = {
+        .set_clock              = sdhci_set_clock,
+        .set_power              = sdhci_intel_set_power,
+        .enable_dma             = sdhci_pci_enable_dma,
+        .set_bus_width          = sdhci_pci_set_bus_width,
+        .reset                  = sdhci_reset,
+        .set_uhs_signaling      = sdhci_set_uhs_signaling,
+        .hw_reset               = sdhci_pci_hw_reset,
+        .select_drive_strength  = sdhci_pci_select_drive_strength,
+};
 static const struct sdhci_pci_fixes sdhci_intel_byt_emmc = {
        .allow_runtime_pm = true,
        .probe_slot     = byt_emmc_probe_slot,
@@ -397,6 +444,7 @@ static const struct sdhci_pci_fixes sdhci_intel_byt_emmc = {
        .quirks2        = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
                          SDHCI_QUIRK2_CAPS_BIT63_FOR_HS400 |
                          SDHCI_QUIRK2_STOP_WITH_TC,
+        .ops            = &sdhci_intel_byt_ops,
 };
 static const struct sdhci_pci_fixes sdhci_intel_byt_sdio = {
@@ -405,6 +453,7 @@ static const struct sdhci_pci_fixes sdhci_intel_byt_sdio = {
                        SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
        .allow_runtime_pm = true,
        .probe_slot     = byt_sdio_probe_slot,
+        .ops            = &sdhci_intel_byt_ops,
 };
 static const struct sdhci_pci_fixes sdhci_intel_byt_sd = {
@@ -415,6 +464,7 @@ static const struct sdhci_pci_fixes sdhci_intel_byt_sd = {
        .allow_runtime_pm = true,
        .own_cd_for_runtime_pm = true,
        .probe_slot     = byt_sd_probe_slot,
+        .ops            = &sdhci_intel_byt_ops,
 };
 /* Define Host controllers for Intel Merrifield platform */
@@ -1648,7 +1698,9 @@ static struct sdhci_pci_slot *sdhci_pci_probe_slot(
        }
        host->hw_name = "PCI";
-        host->ops = &sdhci_pci_ops;
+        host->ops = chip->fixes && chip->fixes->ops ?
+                    chip->fixes->ops :
+                    &sdhci_pci_ops;
        host->quirks = chip->quirks;
        host->quirks2 = chip->quirks2;
diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h
index 9c7c08b93223..6bccf56bc5ff 100644
--- a/drivers/mmc/host/sdhci-pci.h
+++ b/drivers/mmc/host/sdhci-pci.h
@@ -65,6 +65,8 @@ struct sdhci_pci_fixes {
        int                     (*suspend) (struct sdhci_pci_chip *);
        int                     (*resume) (struct sdhci_pci_chip *);
+        const struct sdhci_ops  *ops;
 };
 struct sdhci_pci_slot {
diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
index dd1938d341f7..d0f5c05fbc19 100644
--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -315,7 +315,7 @@ static void pxav3_set_power(struct sdhci_host *host, unsigned char mode,
        struct mmc_host *mmc = host->mmc;
        u8 pwr = host->pwr;
-        sdhci_set_power(host, mode, vdd);
+        sdhci_set_power_noreg(host, mode, vdd);
        if (host->pwr == pwr)
                return;
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 48055666c655..42ef3ebb1d8c 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -687,7 +687,7 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
                         * host->clock is in Hz.  target_timeout is in us.
                         * Hence, us = 1000000 * cycles / Hz.  Round up.
                         */
-                        val = 1000000 * data->timeout_clks;
+                        val = 1000000ULL * data->timeout_clks;
                        if (do_div(val, host->clock))
                                target_timeout++;
                        target_timeout += val;
@@ -1077,6 +1077,10 @@ void sdhci_send_command(struct sdhci_host *host, struct mmc_command *cmd)
        /* Initially, a command has no error */
        cmd->error = 0;
+        if ((host->quirks2 & SDHCI_QUIRK2_STOP_WITH_TC) &&
+            cmd->opcode == MMC_STOP_TRANSMISSION)
+                cmd->flags |= MMC_RSP_BUSY;
        /* Wait max 10 ms */
        timeout = 10;
@@ -1390,8 +1394,8 @@ static void sdhci_set_power_reg(struct sdhci_host *host, unsigned char mode,
                sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
 }
-void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
+void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode,
-                     unsigned short vdd)
+                           unsigned short vdd)
 {
        u8 pwr = 0;
@@ -1455,20 +1459,17 @@ void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
                        mdelay(10);
        }
 }
-EXPORT_SYMBOL_GPL(sdhci_set_power);
+EXPORT_SYMBOL_GPL(sdhci_set_power_noreg);
-static void __sdhci_set_power(struct sdhci_host *host, unsigned char mode,
+void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
-                              unsigned short vdd)
+                     unsigned short vdd)
 {
-        struct mmc_host *mmc = host->mmc;
+        if (IS_ERR(host->mmc->supply.vmmc))
+                sdhci_set_power_noreg(host, mode, vdd);
-        if (host->ops->set_power)
-                host->ops->set_power(host, mode, vdd);
-        else if (!IS_ERR(mmc->supply.vmmc))
-                sdhci_set_power_reg(host, mode, vdd);
        else
-                sdhci_set_power(host, mode, vdd);
+                sdhci_set_power_reg(host, mode, vdd);
 }
+EXPORT_SYMBOL_GPL(sdhci_set_power);
 /*****************************************************************************\
 *                                                                           *
@@ -1609,7 +1610,10 @@ static void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                }
        }
-        __sdhci_set_power(host, ios->power_mode, ios->vdd);
+        if (host->ops->set_power)
+                host->ops->set_power(host, ios->power_mode, ios->vdd);
+        else
+                sdhci_set_power(host, ios->power_mode, ios->vdd);
        if (host->ops->platform_send_init_74_clocks)
                host->ops->platform_send_init_74_clocks(host, ios->power_mode);
@@ -2082,6 +2086,10 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
                if (!host->tuning_done) {
                        pr_info(DRIVER_NAME ": Timeout waiting for Buffer Read Ready interrupt during tuning procedure, falling back to fixed sampling clock\n");
+                        sdhci_do_reset(host, SDHCI_RESET_CMD);
+                        sdhci_do_reset(host, SDHCI_RESET_DATA);
                        ctrl = sdhci_readw(host, SDHCI_HOST_CONTROL2);
                        ctrl &= ~SDHCI_CTRL_TUNED_CLK;
                        ctrl &= ~SDHCI_CTRL_EXEC_TUNING;
@@ -2282,10 +2290,8 @@ static bool sdhci_request_done(struct sdhci_host *host)
        for (i = 0; i < SDHCI_MAX_MRQS; i++) {
                mrq = host->mrqs_done[i];
-                if (mrq) {
+                if (mrq)
-                        host->mrqs_done[i] = NULL;
                        break;
-                }
        }
        if (!mrq) {
@@ -2316,6 +2322,17 @@ static bool sdhci_request_done(struct sdhci_host *host)
         * upon error conditions.
         */
        if (sdhci_needs_reset(host, mrq)) {
+                /*
+                 * Do not finish until command and data lines are available for
+                 * reset. Note there can only be one other mrq, so it cannot
+                 * also be in mrqs_done, otherwise host->cmd and host->data_cmd
+                 * would both be null.
+                 */
+                if (host->cmd || host->data_cmd) {
+                        spin_unlock_irqrestore(&host->lock, flags);
+                        return true;
+                }
                /* Some controllers need this kick or reset won't work here */
                if (host->quirks & SDHCI_QUIRK_CLOCK_BEFORE_RESET)
                        /* This is to force an update */
@@ -2323,10 +2340,8 @@ static bool sdhci_request_done(struct sdhci_host *host)
                /* Spec says we should do both at the same time, but Ricoh
                   controllers do not like that. */
-                if (!host->cmd)
+                sdhci_do_reset(host, SDHCI_RESET_CMD);
-                        sdhci_do_reset(host, SDHCI_RESET_CMD);
+                sdhci_do_reset(host, SDHCI_RESET_DATA);
-                if (!host->data_cmd)
-                        sdhci_do_reset(host, SDHCI_RESET_DATA);
                host->pending_reset = false;
        }
@@ -2334,6 +2349,8 @@ static bool sdhci_request_done(struct sdhci_host *host)
        if (!sdhci_has_requests(host))
                sdhci_led_deactivate(host);
+        host->mrqs_done[i] = NULL;
        mmiowb();
        spin_unlock_irqrestore(&host->lock, flags);
@@ -2409,7 +2426,7 @@ static void sdhci_timeout_data_timer(unsigned long data)
 *                                                                           *
 \*****************************************************************************/
-static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *mask)
+static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask)
 {
        if (!host->cmd) {
                /*
@@ -2453,11 +2470,6 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *mask)
                return;
        }
-        if ((host->quirks2 & SDHCI_QUIRK2_STOP_WITH_TC) &&
-            !(host->cmd->flags & MMC_RSP_BUSY) && !host->data &&
-            host->cmd->opcode == MMC_STOP_TRANSMISSION)
-                *mask &= ~SDHCI_INT_DATA_END;
        if (intmask & SDHCI_INT_RESPONSE)
                sdhci_finish_command(host);
 }
@@ -2513,9 +2525,6 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
        if (!host->data) {
                struct mmc_command *data_cmd = host->data_cmd;
-                if (data_cmd)
-                        host->data_cmd = NULL;
                /*
                 * The "data complete" interrupt is also used to
                 * indicate that a busy state has ended. See comment
@@ -2523,11 +2532,13 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
                 */
                if (data_cmd && (data_cmd->flags & MMC_RSP_BUSY)) {
                        if (intmask & SDHCI_INT_DATA_TIMEOUT) {
+                                host->data_cmd = NULL;
                                data_cmd->error = -ETIMEDOUT;
                                sdhci_finish_mrq(host, data_cmd->mrq);
                                return;
                        }
                        if (intmask & SDHCI_INT_DATA_END) {
+                                host->data_cmd = NULL;
                                /*
                                 * Some cards handle busy-end interrupt
                                 * before the command completed, so make
@@ -2680,8 +2691,7 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id)
                }
                if (intmask & SDHCI_INT_CMD_MASK)
-                        sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK,
+                        sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK);
-                                      &intmask);
                if (intmask & SDHCI_INT_DATA_MASK)
                        sdhci_data_irq(host, intmask & SDHCI_INT_DATA_MASK);
@@ -2914,6 +2924,10 @@ int sdhci_runtime_resume_host(struct sdhci_host *host)
                spin_unlock_irqrestore(&host->lock, flags);
        }
+        if ((mmc->caps2 & MMC_CAP2_HS400_ES) &&
+            mmc->ops->hs400_enhanced_strobe)
+                mmc->ops->hs400_enhanced_strobe(mmc, &mmc->ios);
        spin_lock_irqsave(&host->lock, flags);
        host->runtime_suspended = false;
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index c722cd23205c..2570455b219a 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -73,6 +73,7 @@
 #define  SDHCI_DATA_LVL_MASK    0x00F00000
 #define   SDHCI_DATA_LVL_SHIFT  20
 #define   SDHCI_DATA_0_LVL_MASK 0x00100000
+#define  SDHCI_CMD_LVL          0x01000000
 #define SDHCI_HOST_CONTROL      0x28
 #define  SDHCI_CTRL_LED         0x01
@@ -683,6 +684,8 @@ u16 sdhci_calc_clk(struct sdhci_host *host, unsigned int clock,
 void sdhci_set_clock(struct sdhci_host *host, unsigned int clock);
 void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
                     unsigned short vdd);
+void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode,
+                           unsigned short vdd);
 void sdhci_set_bus_width(struct sdhci_host *host, int width);
 void sdhci_reset(struct sdhci_host *host, u8 mask);
 void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing);
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
index 0f68a99fc4ad..141bd70a49c2 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
@@ -161,7 +161,7 @@ int gpmi_init(struct gpmi_nand_data *this)
        ret = gpmi_enable_clk(this);
        if (ret)
-                goto err_out;
+                return ret;
        ret = gpmi_reset_block(r->gpmi_regs, false);
        if (ret)
                goto err_out;
@@ -197,6 +197,7 @@ int gpmi_init(struct gpmi_nand_data *this)
        gpmi_disable_clk(this);
        return 0;
 err_out:
+        gpmi_disable_clk(this);
        return ret;
 }
@@ -270,7 +271,7 @@ int bch_set_geometry(struct gpmi_nand_data *this)
        ret = gpmi_enable_clk(this);
        if (ret)
-                goto err_out;
+                return ret;
        /*
        * Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this
@@ -308,6 +309,7 @@ int bch_set_geometry(struct gpmi_nand_data *this)
        gpmi_disable_clk(this);
        return 0;
 err_out:
+        gpmi_disable_clk(this);
        return ret;
 }
diff --git a/drivers/mtd/nand/mtk_ecc.c b/drivers/mtd/nand/mtk_ecc.c
index d54f666417e1..dbf256217b3e 100644
--- a/drivers/mtd/nand/mtk_ecc.c
+++ b/drivers/mtd/nand/mtk_ecc.c
@@ -86,6 +86,8 @@ struct mtk_ecc {
        struct completion done;
        struct mutex lock;
        u32 sectors;
+        u8 eccdata[112];
 };
 static inline void mtk_ecc_wait_idle(struct mtk_ecc *ecc,
@@ -366,9 +368,8 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
                   u8 *data, u32 bytes)
 {
        dma_addr_t addr;
-        u8 *p;
+        u32 len;
-        u32 len, i, val;
+        int ret;
-        int ret = 0;
        addr = dma_map_single(ecc->dev, data, bytes, DMA_TO_DEVICE);
        ret = dma_mapping_error(ecc->dev, addr);
@@ -393,14 +394,12 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
        /* Program ECC bytes to OOB: per sector oob = FDM + ECC + SPARE */
        len = (config->strength * ECC_PARITY_BITS + 7) >> 3;
-        p = data + bytes;
-        /* write the parity bytes generated by the ECC back to the OOB region */
+        /* write the parity bytes generated by the ECC back to temp buffer */
-        for (i = 0; i < len; i++) {
+        __ioread32_copy(ecc->eccdata, ecc->regs + ECC_ENCPAR(0), round_up(len, 4));
-                if ((i % 4) == 0)
-                        val = readl(ecc->regs + ECC_ENCPAR(i / 4));
+        /* copy into possibly unaligned OOB region with actual length */
-                p[i] = (val >> ((i % 4) * 8)) & 0xff;
+        memcpy(data + bytes, ecc->eccdata, len);
-        }
 timeout:
        dma_unmap_single(ecc->dev, addr, bytes, DMA_TO_DEVICE);
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index e5718e5ecf92..3bde96a3f7bf 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1095,10 +1095,11 @@ static void nand_release_data_interface(struct nand_chip *chip)
 /**
 * nand_reset - Reset and initialize a NAND device
 * @chip: The NAND chip
+ * @chipnr: Internal die id
 *
 * Returns 0 for success or negative error code otherwise
 */
-int nand_reset(struct nand_chip *chip)
+int nand_reset(struct nand_chip *chip, int chipnr)
 {
        struct mtd_info *mtd = nand_to_mtd(chip);
        int ret;
@@ -1107,9 +1108,17 @@ int nand_reset(struct nand_chip *chip)
        if (ret)
                return ret;
+        /*
+         * The CS line has to be released before we can apply the new NAND
+         * interface settings, hence this weird ->select_chip() dance.
+         */
+        chip->select_chip(mtd, chipnr);
        chip->cmdfunc(mtd, NAND_CMD_RESET, -1, -1);
+        chip->select_chip(mtd, -1);
+        chip->select_chip(mtd, chipnr);
        ret = nand_setup_data_interface(chip);
+        chip->select_chip(mtd, -1);
        if (ret)
                return ret;
@@ -1185,8 +1194,6 @@ int nand_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
        /* Shift to get chip number */
        chipnr = ofs >> chip->chip_shift;
-        chip->select_chip(mtd, chipnr);
        /*
         * Reset the chip.
         * If we want to check the WP through READ STATUS and check the bit 7
@@ -1194,7 +1201,9 @@ int nand_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
         * some operation can also clear the bit 7 of status register
         * eg. erase/program a locked block
         */
-        nand_reset(chip);
+        nand_reset(chip, chipnr);
+        chip->select_chip(mtd, chipnr);
        /* Check, if it is write protected */
        if (nand_check_wp(mtd)) {
@@ -1244,8 +1253,6 @@ int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
        /* Shift to get chip number */
        chipnr = ofs >> chip->chip_shift;
-        chip->select_chip(mtd, chipnr);
        /*
         * Reset the chip.
         * If we want to check the WP through READ STATUS and check the bit 7
@@ -1253,7 +1260,9 @@ int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
         * some operation can also clear the bit 7 of status register
         * eg. erase/program a locked block
         */
-        nand_reset(chip);
+        nand_reset(chip, chipnr);
+        chip->select_chip(mtd, chipnr);
        /* Check, if it is write protected */
        if (nand_check_wp(mtd)) {
@@ -2940,10 +2949,6 @@ static int nand_do_write_oob(struct mtd_info *mtd, loff_t to,
        }
        chipnr = (int)(to >> chip->chip_shift);
-        chip->select_chip(mtd, chipnr);
-        /* Shift to get page */
-        page = (int)(to >> chip->page_shift);
        /*
         * Reset the chip. Some chips (like the Toshiba TC5832DC found in one
@@ -2951,7 +2956,12 @@ static int nand_do_write_oob(struct mtd_info *mtd, loff_t to,
         * if we don't do this. I have no clue why, but I seem to have 'fixed'
         * it in the doc2000 driver in August 1999.  dwmw2.
         */
-        nand_reset(chip);
+        nand_reset(chip, chipnr);
+        chip->select_chip(mtd, chipnr);
+        /* Shift to get page */
+        page = (int)(to >> chip->page_shift);
        /* Check, if it is write protected */
        if (nand_check_wp(mtd)) {
@@ -3984,14 +3994,14 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd,
        int i, maf_idx;
        u8 id_data[8];
-        /* Select the device */
-        chip->select_chip(mtd, 0);
        /*
         * Reset the chip, required by some chips (e.g. Micron MT29FxGxxxxx)
         * after power-up.
         */
-        nand_reset(chip);
+        nand_reset(chip, 0);
+        /* Select the device */
+        chip->select_chip(mtd, 0);
        /* Send the command for reading device ID */
        chip->cmdfunc(mtd, NAND_CMD_READID, 0x00, -1);
@@ -4329,17 +4339,31 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
                return PTR_ERR(type);
        }
+        /* Initialize the ->data_interface field. */
        ret = nand_init_data_interface(chip);
        if (ret)
                return ret;
+        /*
+         * Setup the data interface correctly on the chip and controller side.
+         * This explicit call to nand_setup_data_interface() is only required
+         * for the first die, because nand_reset() has been called before
+         * ->data_interface and ->default_onfi_timing_mode were set.
+         * For the other dies, nand_reset() will automatically switch to the
+         * best mode for us.
+         */
+        ret = nand_setup_data_interface(chip);
+        if (ret)
+                return ret;
        chip->select_chip(mtd, -1);
        /* Check for a chip array */
        for (i = 1; i < maxchips; i++) {
-                chip->select_chip(mtd, i);
                /* See comment in nand_get_flash_type for reset */
-                nand_reset(chip);
+                nand_reset(chip, i);
+                chip->select_chip(mtd, i);
                /* Send the command for reading device ID */
                chip->cmdfunc(mtd, NAND_CMD_READID, 0x00, -1);
                /* Read manufacturer and device IDs */
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index 95c4048a371e..388e46be6ad9 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -741,6 +741,7 @@ static int try_recover_peb(struct ubi_volume *vol, int pnum, int lnum,
                goto out_put;
        }
+        vid_hdr = ubi_get_vid_hdr(vidb);
        ubi_assert(vid_hdr->vol_type == UBI_VID_DYNAMIC);
        mutex_lock(&ubi->buf_mutex);
diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
index d6384d965788..c1f5c29e458e 100644
--- a/drivers/mtd/ubi/fastmap.c
+++ b/drivers/mtd/ubi/fastmap.c
@@ -287,7 +287,7 @@ static int update_vol(struct ubi_device *ubi, struct ubi_attach_info *ai,
                /* new_aeb is newer */
                if (cmp_res & 1) {
-                        victim = ubi_alloc_aeb(ai, aeb->ec, aeb->pnum);
+                        victim = ubi_alloc_aeb(ai, aeb->pnum, aeb->ec);
                        if (!victim)
                                return -ENOMEM;
@@ -707,11 +707,11 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
                             fmvhdr->vol_type,
                             be32_to_cpu(fmvhdr->last_eb_bytes));
-                if (!av)
+                if (IS_ERR(av)) {
-                        goto fail_bad;
+                        if (PTR_ERR(av) == -EEXIST)
-                if (PTR_ERR(av) == -EINVAL) {
+                                ubi_err(ubi, "volume (ID %i) already exists",
-                        ubi_err(ubi, "volume (ID %i) already exists",
+                                        fmvhdr->vol_id);
-                                fmvhdr->vol_id);
                        goto fail_bad;
                }
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index 3eb7430dffbf..f8ff25c8ee2e 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -142,6 +142,9 @@ struct plx_pci_card {
 #define CTI_PCI_VENDOR_ID               0x12c4
 #define CTI_PCI_DEVICE_ID_CRG001        0x0900
+#define MOXA_PCI_VENDOR_ID              0x1393
+#define MOXA_PCI_DEVICE_ID              0x0100
 static void plx_pci_reset_common(struct pci_dev *pdev);
 static void plx9056_pci_reset_common(struct pci_dev *pdev);
 static void plx_pci_reset_marathon_pci(struct pci_dev *pdev);
@@ -258,6 +261,14 @@ static struct plx_pci_card_info plx_pci_card_info_elcus = {
        /* based on PLX9030 */
 };
+static struct plx_pci_card_info plx_pci_card_info_moxa = {
+        "MOXA", 2,
+        PLX_PCI_CAN_CLOCK, PLX_PCI_OCR, PLX_PCI_CDR,
+        {0, 0x00, 0x00}, { {0, 0x00, 0x80}, {1, 0x00, 0x80} },
+        &plx_pci_reset_common
+         /* based on PLX9052 */
+};
 static const struct pci_device_id plx_pci_tbl[] = {
        {
                /* Adlink PCI-7841/cPCI-7841 */
@@ -357,6 +368,13 @@ static const struct pci_device_id plx_pci_tbl[] = {
                0, 0,
                (kernel_ulong_t)&plx_pci_card_info_elcus
        },
+        {
+                /* moxa */
+                MOXA_PCI_VENDOR_ID, MOXA_PCI_DEVICE_ID,
+                PCI_ANY_ID, PCI_ANY_ID,
+                0, 0,
+                (kernel_ulong_t)&plx_pci_card_info_moxa
+        },
        { 0,}
 };
 MODULE_DEVICE_TABLE(pci, plx_pci_tbl);
diff --git a/drivers/net/can/usb/peak_usb/pcan_ucan.h b/drivers/net/can/usb/peak_usb/pcan_ucan.h
index e8fc4952c6b0..2147678f0225 100644
--- a/drivers/net/can/usb/peak_usb/pcan_ucan.h
+++ b/drivers/net/can/usb/peak_usb/pcan_ucan.h
@@ -43,11 +43,22 @@ struct __packed pucan_command {
        u16     args[3];
 };
+#define PUCAN_TSLOW_BRP_BITS            10
+#define PUCAN_TSLOW_TSGEG1_BITS         8
+#define PUCAN_TSLOW_TSGEG2_BITS         7
+#define PUCAN_TSLOW_SJW_BITS            7
+#define PUCAN_TSLOW_BRP_MASK            ((1 << PUCAN_TSLOW_BRP_BITS) - 1)
+#define PUCAN_TSLOW_TSEG1_MASK          ((1 << PUCAN_TSLOW_TSGEG1_BITS) - 1)
+#define PUCAN_TSLOW_TSEG2_MASK          ((1 << PUCAN_TSLOW_TSGEG2_BITS) - 1)
+#define PUCAN_TSLOW_SJW_MASK            ((1 << PUCAN_TSLOW_SJW_BITS) - 1)
 /* uCAN TIMING_SLOW command fields */
-#define PUCAN_TSLOW_SJW_T(s, t)         (((s) & 0xf) | ((!!(t)) << 7))
+#define PUCAN_TSLOW_SJW_T(s, t)         (((s) & PUCAN_TSLOW_SJW_MASK) | \
-#define PUCAN_TSLOW_TSEG2(t)            ((t) & 0xf)
+                                                                ((!!(t)) << 7))
-#define PUCAN_TSLOW_TSEG1(t)            ((t) & 0x3f)
+#define PUCAN_TSLOW_TSEG2(t)            ((t) & PUCAN_TSLOW_TSEG2_MASK)
-#define PUCAN_TSLOW_BRP(b)              ((b) & 0x3ff)
+#define PUCAN_TSLOW_TSEG1(t)            ((t) & PUCAN_TSLOW_TSEG1_MASK)
+#define PUCAN_TSLOW_BRP(b)              ((b) & PUCAN_TSLOW_BRP_MASK)
 struct __packed pucan_timing_slow {
        __le16  opcode_channel;
@@ -60,11 +71,21 @@ struct __packed pucan_timing_slow {
        __le16  brp;            /* BaudRate Prescaler */
 };
+#define PUCAN_TFAST_BRP_BITS            10
+#define PUCAN_TFAST_TSGEG1_BITS         5
+#define PUCAN_TFAST_TSGEG2_BITS         4
+#define PUCAN_TFAST_SJW_BITS            4
+#define PUCAN_TFAST_BRP_MASK            ((1 << PUCAN_TFAST_BRP_BITS) - 1)
+#define PUCAN_TFAST_TSEG1_MASK          ((1 << PUCAN_TFAST_TSGEG1_BITS) - 1)
+#define PUCAN_TFAST_TSEG2_MASK          ((1 << PUCAN_TFAST_TSGEG2_BITS) - 1)
+#define PUCAN_TFAST_SJW_MASK            ((1 << PUCAN_TFAST_SJW_BITS) - 1)
 /* uCAN TIMING_FAST command fields */
-#define PUCAN_TFAST_SJW(s)              ((s) & 0x3)
+#define PUCAN_TFAST_SJW(s)              ((s) & PUCAN_TFAST_SJW_MASK)
-#define PUCAN_TFAST_TSEG2(t)            ((t) & 0x7)
+#define PUCAN_TFAST_TSEG2(t)            ((t) & PUCAN_TFAST_TSEG2_MASK)
-#define PUCAN_TFAST_TSEG1(t)            ((t) & 0xf)
+#define PUCAN_TFAST_TSEG1(t)            ((t) & PUCAN_TFAST_TSEG1_MASK)
-#define PUCAN_TFAST_BRP(b)              ((b) & 0x3ff)
+#define PUCAN_TFAST_BRP(b)              ((b) & PUCAN_TFAST_BRP_MASK)
 struct __packed pucan_timing_fast {
        __le16  opcode_channel;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index c06382cdfdfe..0b0302af3bd2 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -39,6 +39,7 @@ static struct usb_device_id peak_usb_table[] = {
        {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBPRO_PRODUCT_ID)},
        {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBFD_PRODUCT_ID)},
        {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBPROFD_PRODUCT_ID)},
+        {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBX6_PRODUCT_ID)},
        {} /* Terminating entry */
 };
@@ -50,6 +51,7 @@ static const struct peak_usb_adapter *const peak_usb_adapters_list[] = {
        &pcan_usb_pro,
        &pcan_usb_fd,
        &pcan_usb_pro_fd,
+        &pcan_usb_x6,
 };
 /*
@@ -868,23 +870,25 @@ lbl_free_candev:
 static void peak_usb_disconnect(struct usb_interface *intf)
 {
        struct peak_usb_device *dev;
+        struct peak_usb_device *dev_prev_siblings;
        /* unregister as many netdev devices as siblings */
-        for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) {
+        for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) {
                struct net_device *netdev = dev->netdev;
                char name[IFNAMSIZ];
+                dev_prev_siblings = dev->prev_siblings;
                dev->state &= ~PCAN_USB_STATE_CONNECTED;
                strncpy(name, netdev->name, IFNAMSIZ);
                unregister_netdev(netdev);
-                free_candev(netdev);
                kfree(dev->cmd_buf);
                dev->next_siblings = NULL;
                if (dev->adapter->dev_free)
                        dev->adapter->dev_free(dev);
+                free_candev(netdev);
                dev_info(&intf->dev, "%s removed\n", name);
        }
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.h b/drivers/net/can/usb/peak_usb/pcan_usb_core.h
index 506fe506c9d3..3cbfb069893d 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.h
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.h
@@ -27,6 +27,7 @@
 #define PCAN_USBPRO_PRODUCT_ID          0x000d
 #define PCAN_USBPROFD_PRODUCT_ID        0x0011
 #define PCAN_USBFD_PRODUCT_ID           0x0012
+#define PCAN_USBX6_PRODUCT_ID           0x0014
 #define PCAN_USB_DRIVER_NAME            "peak_usb"
@@ -90,6 +91,7 @@ extern const struct peak_usb_adapter pcan_usb;
 extern const struct peak_usb_adapter pcan_usb_pro;
 extern const struct peak_usb_adapter pcan_usb_fd;
 extern const struct peak_usb_adapter pcan_usb_pro_fd;
+extern const struct peak_usb_adapter pcan_usb_x6;
 struct peak_time_ref {
        struct timeval tv_host_0, tv_host;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index ce44a033f63b..304732550f0a 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -993,24 +993,24 @@ static void pcan_usb_fd_free(struct peak_usb_device *dev)
 static const struct can_bittiming_const pcan_usb_fd_const = {
        .name = "pcan_usb_fd",
        .tseg1_min = 1,
-        .tseg1_max = 64,
+        .tseg1_max = (1 << PUCAN_TSLOW_TSGEG1_BITS),
        .tseg2_min = 1,
-        .tseg2_max = 16,
+        .tseg2_max = (1 << PUCAN_TSLOW_TSGEG2_BITS),
-        .sjw_max = 16,
+        .sjw_max = (1 << PUCAN_TSLOW_SJW_BITS),
        .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TSLOW_BRP_BITS),
        .brp_inc = 1,
 };
 static const struct can_bittiming_const pcan_usb_fd_data_const = {
        .name = "pcan_usb_fd",
        .tseg1_min = 1,
-        .tseg1_max = 16,
+        .tseg1_max = (1 << PUCAN_TFAST_TSGEG1_BITS),
        .tseg2_min = 1,
-        .tseg2_max = 8,
+        .tseg2_max = (1 << PUCAN_TFAST_TSGEG2_BITS),
-        .sjw_max = 4,
+        .sjw_max = (1 << PUCAN_TFAST_SJW_BITS),
        .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TFAST_BRP_BITS),
        .brp_inc = 1,
 };
@@ -1065,24 +1065,24 @@ const struct peak_usb_adapter pcan_usb_fd = {
 static const struct can_bittiming_const pcan_usb_pro_fd_const = {
        .name = "pcan_usb_pro_fd",
        .tseg1_min = 1,
-        .tseg1_max = 64,
+        .tseg1_max = (1 << PUCAN_TSLOW_TSGEG1_BITS),
        .tseg2_min = 1,
-        .tseg2_max = 16,
+        .tseg2_max = (1 << PUCAN_TSLOW_TSGEG2_BITS),
-        .sjw_max = 16,
+        .sjw_max = (1 << PUCAN_TSLOW_SJW_BITS),
        .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TSLOW_BRP_BITS),
        .brp_inc = 1,
 };
 static const struct can_bittiming_const pcan_usb_pro_fd_data_const = {
        .name = "pcan_usb_pro_fd",
        .tseg1_min = 1,
-        .tseg1_max = 16,
+        .tseg1_max = (1 << PUCAN_TFAST_TSGEG1_BITS),
        .tseg2_min = 1,
-        .tseg2_max = 8,
+        .tseg2_max = (1 << PUCAN_TFAST_TSGEG2_BITS),
-        .sjw_max = 4,
+        .sjw_max = (1 << PUCAN_TFAST_SJW_BITS),
        .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TFAST_BRP_BITS),
        .brp_inc = 1,
 };
@@ -1132,3 +1132,75 @@ const struct peak_usb_adapter pcan_usb_pro_fd = {
        .do_get_berr_counter = pcan_usb_fd_get_berr_counter,
 };
+/* describes the PCAN-USB X6 adapter */
+static const struct can_bittiming_const pcan_usb_x6_const = {
+        .name = "pcan_usb_x6",
+        .tseg1_min = 1,
+        .tseg1_max = (1 << PUCAN_TSLOW_TSGEG1_BITS),
+        .tseg2_min = 1,
+        .tseg2_max = (1 << PUCAN_TSLOW_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TSLOW_SJW_BITS),
+        .brp_min = 1,
+        .brp_max = (1 << PUCAN_TSLOW_BRP_BITS),
+        .brp_inc = 1,
+};
+static const struct can_bittiming_const pcan_usb_x6_data_const = {
+        .name = "pcan_usb_x6",
+        .tseg1_min = 1,
+        .tseg1_max = (1 << PUCAN_TFAST_TSGEG1_BITS),
+        .tseg2_min = 1,
+        .tseg2_max = (1 << PUCAN_TFAST_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TFAST_SJW_BITS),
+        .brp_min = 1,
+        .brp_max = (1 << PUCAN_TFAST_BRP_BITS),
+        .brp_inc = 1,
+};
+const struct peak_usb_adapter pcan_usb_x6 = {
+        .name = "PCAN-USB X6",
+        .device_id = PCAN_USBX6_PRODUCT_ID,
+        .ctrl_count = PCAN_USBPROFD_CHANNEL_COUNT,
+        .ctrlmode_supported = CAN_CTRLMODE_FD |
+                        CAN_CTRLMODE_3_SAMPLES | CAN_CTRLMODE_LISTENONLY,
+        .clock = {
+                .freq = PCAN_UFD_CRYSTAL_HZ,
+        },
+        .bittiming_const = &pcan_usb_x6_const,
+        .data_bittiming_const = &pcan_usb_x6_data_const,
+        /* size of device private data */
+        .sizeof_dev_private = sizeof(struct pcan_usb_fd_device),
+        /* timestamps usage */
+        .ts_used_bits = 32,
+        .ts_period = 1000000, /* calibration period in ts. */
+        .us_per_ts_scale = 1, /* us = (ts * scale) >> shift */
+        .us_per_ts_shift = 0,
+        /* give here messages in/out endpoints */
+        .ep_msg_in = PCAN_USBPRO_EP_MSGIN,
+        .ep_msg_out = {PCAN_USBPRO_EP_MSGOUT_0, PCAN_USBPRO_EP_MSGOUT_1},
+        /* size of rx/tx usb buffers */
+        .rx_buffer_size = PCAN_UFD_RX_BUFFER_SIZE,
+        .tx_buffer_size = PCAN_UFD_TX_BUFFER_SIZE,
+        /* device callbacks */
+        .intf_probe = pcan_usb_pro_probe,       /* same as PCAN-USB Pro */
+        .dev_init = pcan_usb_fd_init,
+        .dev_exit = pcan_usb_fd_exit,
+        .dev_free = pcan_usb_fd_free,
+        .dev_set_bus = pcan_usb_fd_set_bus,
+        .dev_set_bittiming = pcan_usb_fd_set_bittiming_slow,
+        .dev_set_data_bittiming = pcan_usb_fd_set_bittiming_fast,
+        .dev_decode_buf = pcan_usb_fd_decode_buf,
+        .dev_start = pcan_usb_fd_start,
+        .dev_stop = pcan_usb_fd_stop,
+        .dev_restart_async = pcan_usb_fd_restart_async,
+        .dev_encode_msg = pcan_usb_fd_encode_msg,
+        .do_get_berr_counter = pcan_usb_fd_get_berr_counter,
+};
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 7717b19dc806..947adda3397d 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -962,9 +962,10 @@ static void b53_vlan_add(struct dsa_switch *ds, int port,
                vl->members |= BIT(port) | BIT(cpu_port);
                if (untagged)
-                        vl->untag |= BIT(port) | BIT(cpu_port);
+                        vl->untag |= BIT(port);
                else
-                        vl->untag &= ~(BIT(port) | BIT(cpu_port));
+                        vl->untag &= ~BIT(port);
+                vl->untag &= ~BIT(cpu_port);
                b53_set_vlan_entry(dev, vid, vl);
                b53_fast_age_vlan(dev, vid);
@@ -973,8 +974,6 @@ static void b53_vlan_add(struct dsa_switch *ds, int port,
        if (pvid) {
                b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
                            vlan->vid_end);
-                b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(cpu_port),
-                            vlan->vid_end);
                b53_fast_age_vlan(dev, vid);
        }
 }
@@ -984,7 +983,6 @@ static int b53_vlan_del(struct dsa_switch *ds, int port,
 {
        struct b53_device *dev = ds->priv;
        bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED;
-        unsigned int cpu_port = dev->cpu_port;
        struct b53_vlan *vl;
        u16 vid;
        u16 pvid;
@@ -997,8 +995,6 @@ static int b53_vlan_del(struct dsa_switch *ds, int port,
                b53_get_vlan_entry(dev, vid, vl);
                vl->members &= ~BIT(port);
-                if ((vl->members & BIT(cpu_port)) == BIT(cpu_port))
-                        vl->members = 0;
                if (pvid == vid) {
                        if (is5325(dev) || is5365(dev))
@@ -1007,18 +1003,14 @@ static int b53_vlan_del(struct dsa_switch *ds, int port,
                                pvid = 0;
                }
-                if (untagged) {
+                if (untagged)
                        vl->untag &= ~(BIT(port));
-                        if ((vl->untag & BIT(cpu_port)) == BIT(cpu_port))
-                                vl->untag = 0;
-                }
                b53_set_vlan_entry(dev, vid, vl);
                b53_fast_age_vlan(dev, vid);
        }
        b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port), pvid);
-        b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(cpu_port), pvid);
        b53_fast_age_vlan(dev, pvid);
        return 0;
diff --git a/drivers/net/dsa/b53/b53_mmap.c b/drivers/net/dsa/b53/b53_mmap.c
index 76fb8552c9d9..ef63d24fef81 100644
--- a/drivers/net/dsa/b53/b53_mmap.c
+++ b/drivers/net/dsa/b53/b53_mmap.c
@@ -256,6 +256,7 @@ static const struct of_device_id b53_mmap_of_table[] = {
        { .compatible = "brcm,bcm63xx-switch" },
        { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(of, b53_mmap_of_table);
 static struct platform_driver b53_mmap_driver = {
        .probe = b53_mmap_probe,
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index e218887f18b7..9ec33b51a0ed 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -588,6 +588,7 @@ static void bcm_sf2_sw_adjust_link(struct dsa_switch *ds, int port,
                                   struct phy_device *phydev)
 {
        struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
+        struct ethtool_eee *p = &priv->port_sts[port].eee;
        u32 id_mode_dis = 0, port_mode;
        const char *str = NULL;
        u32 reg;
@@ -662,6 +663,9 @@ force_link:
                reg |= DUPLX_MODE;
        core_writel(priv, reg, CORE_STS_OVERRIDE_GMIIP_PORT(port));
+        if (!phydev->is_pseudo_fixed_link)
+                p->eee_enabled = bcm_sf2_eee_init(ds, port, phydev);
 }
 static void bcm_sf2_sw_fixed_link_update(struct dsa_switch *ds, int port,
@@ -1133,6 +1137,20 @@ static int bcm_sf2_sw_remove(struct platform_device *pdev)
        return 0;
 }
+static void bcm_sf2_sw_shutdown(struct platform_device *pdev)
+{
+        struct bcm_sf2_priv *priv = platform_get_drvdata(pdev);
+        /* For a kernel about to be kexec'd we want to keep the GPHY on for a
+         * successful MDIO bus scan to occur. If we did turn off the GPHY
+         * before (e.g: port_disable), this will also power it back on.
+         *
+         * Do not rely on kexec_in_progress, just power the PHY on.
+         */
+        if (priv->hw_params.num_gphy == 1)
+                bcm_sf2_gphy_enable_set(priv->dev->ds, true);
+}
 #ifdef CONFIG_PM_SLEEP
 static int bcm_sf2_suspend(struct device *dev)
 {
@@ -1158,10 +1176,12 @@ static const struct of_device_id bcm_sf2_of_match[] = {
        { .compatible = "brcm,bcm7445-switch-v4.0" },
        { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(of, bcm_sf2_of_match);
 static struct platform_driver bcm_sf2_driver = {
        .probe  = bcm_sf2_sw_probe,
        .remove = bcm_sf2_sw_remove,
+        .shutdown = bcm_sf2_sw_shutdown,
        .driver = {
                .name = "brcm-sf2",
                .of_match_table = bcm_sf2_of_match,
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index bda31f308cc2..a0eee7218695 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -400,12 +400,6 @@ static int tse_rx(struct altera_tse_private *priv, int limit)
                skb_put(skb, pktlength);
-                /* make cache consistent with receive packet buffer */
-                dma_sync_single_for_cpu(priv->device,
-                                        priv->rx_ring[entry].dma_addr,
-                                        priv->rx_ring[entry].len,
-                                        DMA_FROM_DEVICE);
                dma_unmap_single(priv->device, priv->rx_ring[entry].dma_addr,
                                 priv->rx_ring[entry].len, DMA_FROM_DEVICE);
@@ -469,7 +463,6 @@ static int tse_tx_complete(struct altera_tse_private *priv)
        if (unlikely(netif_queue_stopped(priv->dev) &&
                     tse_tx_avail(priv) > TSE_TX_THRESH(priv))) {
-                netif_tx_lock(priv->dev);
                if (netif_queue_stopped(priv->dev) &&
                    tse_tx_avail(priv) > TSE_TX_THRESH(priv)) {
                        if (netif_msg_tx_done(priv))
@@ -477,7 +470,6 @@ static int tse_tx_complete(struct altera_tse_private *priv)
                                           __func__);
                        netif_wake_queue(priv->dev);
                }
-                netif_tx_unlock(priv->dev);
        }
        spin_unlock(&priv->tx_lock);
@@ -592,10 +584,6 @@ static int tse_start_xmit(struct sk_buff *skb, struct net_device *dev)
        buffer->dma_addr = dma_addr;
        buffer->len = nopaged_len;
-        /* Push data out of the cache hierarchy into main memory */
-        dma_sync_single_for_device(priv->device, buffer->dma_addr,
-                                   buffer->len, DMA_TO_DEVICE);
        priv->dmaops->tx_buffer(priv, buffer);
        skb_tx_timestamp(skb);
@@ -819,6 +807,8 @@ static int init_phy(struct net_device *dev)
        if (!phydev) {
                netdev_err(dev, "Could not find the PHY\n");
+                if (fixed_link)
+                        of_phy_deregister_fixed_link(priv->device->of_node);
                return -ENODEV;
        }
@@ -1545,10 +1535,15 @@ err_free_netdev:
 static int altera_tse_remove(struct platform_device *pdev)
 {
        struct net_device *ndev = platform_get_drvdata(pdev);
+        struct altera_tse_private *priv = netdev_priv(ndev);
-        if (ndev->phydev)
+        if (ndev->phydev) {
                phy_disconnect(ndev->phydev);
+                if (of_phy_is_fixed_link(priv->device->of_node))
+                        of_phy_deregister_fixed_link(priv->device->of_node);
+        }
        platform_set_drvdata(pdev, NULL);
        altera_tse_mdio_destroy(ndev);
        unregister_netdev(ndev);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
index 9de078819aa6..4f7635178200 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
@@ -829,7 +829,7 @@ static int xgbe_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int xgbe_suspend(struct device *dev)
 {
        struct net_device *netdev = dev_get_drvdata(dev);
@@ -874,7 +874,7 @@ static int xgbe_resume(struct device *dev)
        return ret;
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id xgbe_acpi_match[] = {
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index c481f104a8fe..5390ae89136c 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -204,17 +204,6 @@ static u32 xgene_enet_ring_len(struct xgene_enet_desc_ring *ring)
        return num_msgs;
 }
-static void xgene_enet_setup_coalescing(struct xgene_enet_desc_ring *ring)
-{
-        u32 data = 0x7777;
-        xgene_enet_ring_wr32(ring, CSR_PBM_COAL, 0x8e);
-        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK1, data);
-        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK2, data << 16);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD0_SET1, 0x40);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD1_SET1, 0x80);
-}
 void xgene_enet_parse_error(struct xgene_enet_desc_ring *ring,
                            struct xgene_enet_pdata *pdata,
                            enum xgene_enet_err_code status)
@@ -929,5 +918,4 @@ struct xgene_ring_ops xgene_ring1_ops = {
        .clear = xgene_enet_clear_ring,
        .wr_cmd = xgene_enet_wr_cmd,
        .len = xgene_enet_ring_len,
-        .coalesce = xgene_enet_setup_coalescing,
 };
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
index 8456337a237d..06e598c8bc16 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
@@ -55,8 +55,10 @@ enum xgene_enet_rm {
 #define PREFETCH_BUF_EN         BIT(21)
 #define CSR_RING_ID_BUF         0x000c
 #define CSR_PBM_COAL            0x0014
+#define CSR_PBM_CTICK0          0x0018
 #define CSR_PBM_CTICK1          0x001c
 #define CSR_PBM_CTICK2          0x0020
+#define CSR_PBM_CTICK3          0x0024
 #define CSR_THRESHOLD0_SET1     0x0030
 #define CSR_THRESHOLD1_SET1     0x0034
 #define CSR_RING_NE_INT_MODE    0x017c
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 429f18fc5503..8158d4698734 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -1188,7 +1188,8 @@ static int xgene_enet_create_desc_rings(struct net_device *ndev)
                tx_ring->dst_ring_num = xgene_enet_dst_ring_num(cp_ring);
        }
-        pdata->ring_ops->coalesce(pdata->tx_ring[0]);
+        if (pdata->ring_ops->coalesce)
+                pdata->ring_ops->coalesce(pdata->tx_ring[0]);
        pdata->tx_qcnt_hi = pdata->tx_ring[0]->slots - 128;
        return 0;
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c b/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c
index 2b76732add5d..af51dd5844ce 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c
@@ -30,7 +30,7 @@ static void xgene_enet_ring_init(struct xgene_enet_desc_ring *ring)
                ring_cfg[0] |= SET_VAL(X2_INTLINE, ring->id & RING_BUFNUM_MASK);
                ring_cfg[3] |= SET_BIT(X2_DEQINTEN);
        }
-        ring_cfg[0] |= SET_VAL(X2_CFGCRID, 1);
+        ring_cfg[0] |= SET_VAL(X2_CFGCRID, 2);
        addr >>= 8;
        ring_cfg[2] |= QCOHERENT | SET_VAL(RINGADDRL, addr);
@@ -192,13 +192,15 @@ static u32 xgene_enet_ring_len(struct xgene_enet_desc_ring *ring)
 static void xgene_enet_setup_coalescing(struct xgene_enet_desc_ring *ring)
 {
-        u32 data = 0x7777;
+        u32 data = 0x77777777;
        xgene_enet_ring_wr32(ring, CSR_PBM_COAL, 0x8e);
+        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK0, data);
        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK1, data);
-        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK2, data << 16);
+        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK2, data);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD0_SET1, 0x40);
+        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK3, data);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD1_SET1, 0x80);
+        xgene_enet_ring_wr32(ring, CSR_THRESHOLD0_SET1, 0x08);
+        xgene_enet_ring_wr32(ring, CSR_THRESHOLD1_SET1, 0x10);
 }
 struct xgene_ring_ops xgene_ring2_ops = {
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index b0da9693f28a..be865b4dada2 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -460,7 +460,7 @@ static void arc_emac_set_rx_mode(struct net_device *ndev)
                if (ndev->flags & IFF_ALLMULTI) {
                        arc_reg_set(priv, R_LAFL, ~0);
                        arc_reg_set(priv, R_LAFH, ~0);
-                } else {
+                } else if (ndev->flags & IFF_MULTICAST) {
                        struct netdev_hw_addr *ha;
                        unsigned int filter[2] = { 0, 0 };
                        int bit;
@@ -472,6 +472,9 @@ static void arc_emac_set_rx_mode(struct net_device *ndev)
                        arc_reg_set(priv, R_LAFL, filter[0]);
                        arc_reg_set(priv, R_LAFH, filter[1]);
+                } else {
+                        arc_reg_set(priv, R_LAFL, 0);
+                        arc_reg_set(priv, R_LAFH, 0);
                }
        }
 }
@@ -764,8 +767,6 @@ int arc_emac_probe(struct net_device *ndev, int interface)
        ndev->netdev_ops = &arc_emac_netdev_ops;
        ndev->ethtool_ops = &arc_emac_ethtool_ops;
        ndev->watchdog_timeo = TX_TIMEOUT;
-        /* FIXME :: no multicast support yet */
-        ndev->flags &= ~IFF_MULTICAST;
        priv = netdev_priv(ndev);
        priv->dev = dev;
diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c
index b047fd607b83..e078d8da978c 100644
--- a/drivers/net/ethernet/aurora/nb8800.c
+++ b/drivers/net/ethernet/aurora/nb8800.c
@@ -1358,6 +1358,7 @@ static const struct of_device_id nb8800_dt_ids[] = {
        },
        { }
 };
+MODULE_DEVICE_TABLE(of, nb8800_dt_ids);
 static int nb8800_probe(struct platform_device *pdev)
 {
@@ -1465,12 +1466,12 @@ static int nb8800_probe(struct platform_device *pdev)
        ret = nb8800_hw_init(dev);
        if (ret)
-                goto err_free_bus;
+                goto err_deregister_fixed_link;
        if (ops && ops->init) {
                ret = ops->init(dev);
                if (ret)
-                        goto err_free_bus;
+                        goto err_deregister_fixed_link;
        }
        dev->netdev_ops = &nb8800_netdev_ops;
@@ -1503,6 +1504,9 @@ static int nb8800_probe(struct platform_device *pdev)
 err_free_dma:
        nb8800_dma_free(dev);
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                of_phy_deregister_fixed_link(pdev->dev.of_node);
 err_free_bus:
        of_node_put(priv->phy_node);
        mdiobus_unregister(bus);
@@ -1520,6 +1524,8 @@ static int nb8800_remove(struct platform_device *pdev)
        struct nb8800_priv *priv = netdev_priv(ndev);
        unregister_netdev(ndev);
+        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                of_phy_deregister_fixed_link(pdev->dev.of_node);
        of_node_put(priv->phy_node);
        mdiobus_unregister(priv->mii_bus);
diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
index ae364c74baf3..537090952c45 100644
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -1126,7 +1126,8 @@ out_freeirq:
        free_irq(dev->irq, dev);
 out_phy_disconnect:
-        phy_disconnect(phydev);
+        if (priv->has_phy)
+                phy_disconnect(phydev);
        return ret;
 }
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index c3354b9941d1..25d1eb4933d0 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1755,13 +1755,13 @@ static int bcm_sysport_probe(struct platform_device *pdev)
        if (priv->irq0 <= 0 || priv->irq1 <= 0) {
                dev_err(&pdev->dev, "invalid interrupts\n");
                ret = -EINVAL;
-                goto err;
+                goto err_free_netdev;
        }
        priv->base = devm_ioremap_resource(&pdev->dev, r);
        if (IS_ERR(priv->base)) {
                ret = PTR_ERR(priv->base);
-                goto err;
+                goto err_free_netdev;
        }
        priv->netdev = dev;
@@ -1779,7 +1779,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
                ret = of_phy_register_fixed_link(dn);
                if (ret) {
                        dev_err(&pdev->dev, "failed to register fixed PHY\n");
-                        goto err;
+                        goto err_free_netdev;
                }
                priv->phy_dn = dn;
@@ -1821,7 +1821,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
        ret = register_netdev(dev);
        if (ret) {
                dev_err(&pdev->dev, "failed to register net_device\n");
-                goto err;
+                goto err_deregister_fixed_link;
        }
        priv->rev = topctrl_readl(priv, REV_CNTL) & REV_MASK;
@@ -1832,7 +1832,11 @@ static int bcm_sysport_probe(struct platform_device *pdev)
                 priv->base, priv->irq0, priv->irq1, txq, rxq);
        return 0;
-err:
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
+err_free_netdev:
        free_netdev(dev);
        return ret;
 }
@@ -1840,11 +1844,14 @@ err:
 static int bcm_sysport_remove(struct platform_device *pdev)
 {
        struct net_device *dev = dev_get_drvdata(&pdev->dev);
+        struct device_node *dn = pdev->dev.of_node;
        /* Not much to do, ndo_close has been called
         * and we use managed allocations
         */
        unregister_netdev(dev);
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
        free_netdev(dev);
        dev_set_drvdata(&pdev->dev, NULL);
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 856379cbb402..49f4cafe5438 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -307,6 +307,10 @@ static void bgmac_dma_rx_enable(struct bgmac *bgmac,
        u32 ctl;
        ctl = bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_CTL);
+        /* preserve ONLY bits 16-17 from current hardware value */
+        ctl &= BGMAC_DMA_RX_ADDREXT_MASK;
        if (bgmac->feature_flags & BGMAC_FEAT_RX_MASK_SETUP) {
                ctl &= ~BGMAC_DMA_RX_BL_MASK;
                ctl |= BGMAC_DMA_RX_BL_128 << BGMAC_DMA_RX_BL_SHIFT;
@@ -317,7 +321,6 @@ static void bgmac_dma_rx_enable(struct bgmac *bgmac,
                ctl &= ~BGMAC_DMA_RX_PT_MASK;
                ctl |= BGMAC_DMA_RX_PT_1 << BGMAC_DMA_RX_PT_SHIFT;
        }
-        ctl &= BGMAC_DMA_RX_ADDREXT_MASK;
        ctl |= BGMAC_DMA_RX_ENABLE;
        ctl |= BGMAC_DMA_RX_PARITY_DISABLE;
        ctl |= BGMAC_DMA_RX_OVERFLOW_CONT;
@@ -1046,9 +1049,9 @@ static void bgmac_enable(struct bgmac *bgmac)
        mode = (bgmac_read(bgmac, BGMAC_DEV_STATUS) & BGMAC_DS_MM_MASK) >>
                BGMAC_DS_MM_SHIFT;
-        if (!(bgmac->feature_flags & BGMAC_FEAT_CLKCTLST) || mode != 0)
+        if (bgmac->feature_flags & BGMAC_FEAT_CLKCTLST || mode != 0)
                bgmac_set(bgmac, BCMA_CLKCTLST, BCMA_CLKCTLST_FORCEHT);
-        if (bgmac->feature_flags & BGMAC_FEAT_CLKCTLST && mode == 2)
+        if (!(bgmac->feature_flags & BGMAC_FEAT_CLKCTLST) && mode == 2)
                bgmac_cco_ctl_maskset(bgmac, 1, ~0,
                                      BGMAC_CHIPCTL_1_RXC_DLL_BYPASS);
@@ -1449,7 +1452,7 @@ static int bgmac_phy_connect(struct bgmac *bgmac)
        phy_dev = phy_connect(bgmac->net_dev, bus_id, &bgmac_adjust_link,
                              PHY_INTERFACE_MODE_MII);
        if (IS_ERR(phy_dev)) {
-                dev_err(bgmac->dev, "PHY connecton failed\n");
+                dev_err(bgmac->dev, "PHY connection failed\n");
                return PTR_ERR(phy_dev);
        }
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 27f11a5d5fe2..1f7034d739b0 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -49,6 +49,7 @@
 #include <linux/firmware.h>
 #include <linux/log2.h>
 #include <linux/aer.h>
+#include <linux/crash_dump.h>
 #if IS_ENABLED(CONFIG_CNIC)
 #define BCM_CNIC 1
@@ -271,22 +272,25 @@ static inline u32 bnx2_tx_avail(struct bnx2 *bp, struct bnx2_tx_ring_info *txr)
 static u32
 bnx2_reg_rd_ind(struct bnx2 *bp, u32 offset)
 {
+        unsigned long flags;
        u32 val;
-        spin_lock_bh(&bp->indirect_lock);
+        spin_lock_irqsave(&bp->indirect_lock, flags);
        BNX2_WR(bp, BNX2_PCICFG_REG_WINDOW_ADDRESS, offset);
        val = BNX2_RD(bp, BNX2_PCICFG_REG_WINDOW);
-        spin_unlock_bh(&bp->indirect_lock);
+        spin_unlock_irqrestore(&bp->indirect_lock, flags);
        return val;
 }
 static void
 bnx2_reg_wr_ind(struct bnx2 *bp, u32 offset, u32 val)
 {
-        spin_lock_bh(&bp->indirect_lock);
+        unsigned long flags;
+        spin_lock_irqsave(&bp->indirect_lock, flags);
        BNX2_WR(bp, BNX2_PCICFG_REG_WINDOW_ADDRESS, offset);
        BNX2_WR(bp, BNX2_PCICFG_REG_WINDOW, val);
-        spin_unlock_bh(&bp->indirect_lock);
+        spin_unlock_irqrestore(&bp->indirect_lock, flags);
 }
 static void
@@ -304,8 +308,10 @@ bnx2_shmem_rd(struct bnx2 *bp, u32 offset)
 static void
 bnx2_ctx_wr(struct bnx2 *bp, u32 cid_addr, u32 offset, u32 val)
 {
+        unsigned long flags;
        offset += cid_addr;
-        spin_lock_bh(&bp->indirect_lock);
+        spin_lock_irqsave(&bp->indirect_lock, flags);
        if (BNX2_CHIP(bp) == BNX2_CHIP_5709) {
                int i;
@@ -322,7 +328,7 @@ bnx2_ctx_wr(struct bnx2 *bp, u32 cid_addr, u32 offset, u32 val)
                BNX2_WR(bp, BNX2_CTX_DATA_ADR, offset);
                BNX2_WR(bp, BNX2_CTX_DATA, val);
        }
-        spin_unlock_bh(&bp->indirect_lock);
+        spin_unlock_irqrestore(&bp->indirect_lock, flags);
 }
 #ifdef BCM_CNIC
@@ -4759,15 +4765,16 @@ bnx2_setup_msix_tbl(struct bnx2 *bp)
        BNX2_WR(bp, BNX2_PCI_GRC_WINDOW3_ADDR, BNX2_MSIX_PBA_ADDR);
 }
-static int
+static void
-bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
+bnx2_wait_dma_complete(struct bnx2 *bp)
 {
        u32 val;
-        int i, rc = 0;
+        int i;
-        u8 old_port;
-        /* Wait for the current PCI transaction to complete before
+        /*
-         * issuing a reset. */
+         * Wait for the current PCI transaction to complete before
+         * issuing a reset.
+         */
        if ((BNX2_CHIP(bp) == BNX2_CHIP_5706) ||
            (BNX2_CHIP(bp) == BNX2_CHIP_5708)) {
                BNX2_WR(bp, BNX2_MISC_ENABLE_CLR_BITS,
@@ -4791,6 +4798,21 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
                }
        }
+        return;
+}
+static int
+bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
+{
+        u32 val;
+        int i, rc = 0;
+        u8 old_port;
+        /* Wait for the current PCI transaction to complete before
+         * issuing a reset. */
+        bnx2_wait_dma_complete(bp);
        /* Wait for the firmware to tell us it is ok to issue a reset. */
        bnx2_fw_sync(bp, BNX2_DRV_MSG_DATA_WAIT0 | reset_code, 1, 1);
@@ -6356,6 +6378,10 @@ bnx2_open(struct net_device *dev)
        struct bnx2 *bp = netdev_priv(dev);
        int rc;
+        rc = bnx2_request_firmware(bp);
+        if (rc < 0)
+                goto out;
        netif_carrier_off(dev);
        bnx2_disable_int(bp);
@@ -6424,6 +6450,7 @@ open_err:
        bnx2_free_irq(bp);
        bnx2_free_mem(bp);
        bnx2_del_napi(bp);
+        bnx2_release_firmware(bp);
        goto out;
 }
@@ -8570,12 +8597,15 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        pci_set_drvdata(pdev, dev);
-        rc = bnx2_request_firmware(bp);
+        /*
-        if (rc < 0)
+         * In-flight DMA from 1st kernel could continue going in kdump kernel.
-                goto error;
+         * New io-page table has been created before bnx2 does reset at open stage.
+         * We have to wait for the in-flight DMA to complete to avoid it look up
+         * into the newly created io-page table.
+         */
+        if (is_kdump_kernel())
+                bnx2_wait_dma_complete(bp);
-        bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
        memcpy(dev->dev_addr, bp->mac_addr, ETH_ALEN);
        dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_SG |
@@ -8608,7 +8638,6 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        return 0;
 error:
-        bnx2_release_firmware(bp);
        pci_iounmap(pdev, bp->regview);
        pci_release_regions(pdev);
        pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 85a7800bfc12..5f19427c7b27 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -1872,8 +1872,16 @@ static void bnx2x_get_ringparam(struct net_device *dev,
        ering->rx_max_pending = MAX_RX_AVAIL;
+        /* If size isn't already set, we give an estimation of the number
+         * of buffers we'll have. We're neglecting some possible conditions
+         * [we couldn't know for certain at this point if number of queues
+         * might shrink] but the number would be correct for the likely
+         * scenario.
+         */
        if (bp->rx_ring_size)
                ering->rx_pending = bp->rx_ring_size;
+        else if (BNX2X_NUM_RX_QUEUES(bp))
+                ering->rx_pending = MAX_RX_AVAIL / BNX2X_NUM_RX_QUEUES(bp);
        else
                ering->rx_pending = MAX_RX_AVAIL;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 20fe6a8c35c1..4febe60eadc2 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -10138,7 +10138,7 @@ static void __bnx2x_add_udp_port(struct bnx2x *bp, u16 port,
 {
        struct bnx2x_udp_tunnel *udp_port = &bp->udp_tunnel_ports[type];
-        if (!netif_running(bp->dev) || !IS_PF(bp))
+        if (!netif_running(bp->dev) || !IS_PF(bp) || CHIP_IS_E1x(bp))
                return;
        if (udp_port->count && udp_port->dst_port == port) {
@@ -10163,7 +10163,7 @@ static void __bnx2x_del_udp_port(struct bnx2x *bp, u16 port,
 {
        struct bnx2x_udp_tunnel *udp_port = &bp->udp_tunnel_ports[type];
-        if (!IS_PF(bp))
+        if (!IS_PF(bp) || CHIP_IS_E1x(bp))
                return;
        if (!udp_port->count || udp_port->dst_port != port) {
@@ -13505,6 +13505,7 @@ static int bnx2x_init_firmware(struct bnx2x *bp)
        /* Initialize the pointers to the init arrays */
        /* Blob */
+        rc = -ENOMEM;
        BNX2X_ALLOC_AND_SET(init_data, request_firmware_exit, be32_to_cpu_n);
        /* Opcodes */
@@ -15241,7 +15242,7 @@ static void bnx2x_init_cyclecounter(struct bnx2x *bp)
        memset(&bp->cyclecounter, 0, sizeof(bp->cyclecounter));
        bp->cyclecounter.read = bnx2x_cyclecounter_read;
        bp->cyclecounter.mask = CYCLECOUNTER_MASK(64);
-        bp->cyclecounter.shift = 1;
+        bp->cyclecounter.shift = 0;
        bp->cyclecounter.mult = 1;
 }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index a9f9f3738022..f08a20b921e7 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1811,6 +1811,9 @@ static int bnxt_busy_poll(struct napi_struct *napi)
        if (atomic_read(&bp->intr_sem) != 0)
                return LL_FLUSH_FAILED;
+        if (!bp->link_info.link_up)
+                return LL_FLUSH_FAILED;
        if (!bnxt_lock_poll(bnapi))
                return LL_FLUSH_BUSY;
@@ -3210,11 +3213,17 @@ static int bnxt_hwrm_tunnel_dst_port_alloc(struct bnxt *bp, __be16 port,
                goto err_out;
        }
-        if (tunnel_type & TUNNEL_DST_PORT_ALLOC_REQ_TUNNEL_TYPE_VXLAN)
+        switch (tunnel_type) {
+        case TUNNEL_DST_PORT_ALLOC_REQ_TUNNEL_TYPE_VXLAN:
                bp->vxlan_fw_dst_port_id = resp->tunnel_dst_port_id;
+                break;
-        else if (tunnel_type & TUNNEL_DST_PORT_ALLOC_REQ_TUNNEL_TYPE_GENEVE)
+        case TUNNEL_DST_PORT_ALLOC_REQ_TUNNEL_TYPE_GENEVE:
                bp->nge_fw_dst_port_id = resp->tunnel_dst_port_id;
+                break;
+        default:
+                break;
+        }
 err_out:
        mutex_unlock(&bp->hwrm_cmd_lock);
        return rc;
@@ -4111,7 +4120,7 @@ static int bnxt_hwrm_stat_ctx_alloc(struct bnxt *bp)
                bp->grp_info[i].fw_stats_ctx = cpr->hw_stats_ctx_id;
        }
        mutex_unlock(&bp->hwrm_cmd_lock);
-        return 0;
+        return rc;
 }
 static int bnxt_hwrm_func_qcfg(struct bnxt *bp)
@@ -4934,6 +4943,10 @@ static void bnxt_del_napi(struct bnxt *bp)
                napi_hash_del(&bnapi->napi);
                netif_napi_del(&bnapi->napi);
        }
+        /* We called napi_hash_del() before netif_napi_del(), we need
+         * to respect an RCU grace period before freeing napi structures.
+         */
+        synchronize_net();
 }
 static void bnxt_init_napi(struct bnxt *bp)
@@ -6309,6 +6322,7 @@ static int bnxt_setup_tc(struct net_device *dev, u32 handle, __be16 proto,
                         struct tc_to_netdev *ntc)
 {
        struct bnxt *bp = netdev_priv(dev);
+        bool sh = false;
        u8 tc;
        if (ntc->type != TC_SETUP_MQPRIO)
@@ -6325,12 +6339,11 @@ static int bnxt_setup_tc(struct net_device *dev, u32 handle, __be16 proto,
        if (netdev_get_num_tc(dev) == tc)
                return 0;
+        if (bp->flags & BNXT_FLAG_SHARED_RINGS)
+                sh = true;
        if (tc) {
                int max_rx_rings, max_tx_rings, rc;
-                bool sh = false;
-                if (bp->flags & BNXT_FLAG_SHARED_RINGS)
-                        sh = true;
                rc = bnxt_get_max_rings(bp, &max_rx_rings, &max_tx_rings, sh);
                if (rc || bp->tx_nr_rings_per_tc * tc > max_tx_rings)
@@ -6348,7 +6361,8 @@ static int bnxt_setup_tc(struct net_device *dev, u32 handle, __be16 proto,
                bp->tx_nr_rings = bp->tx_nr_rings_per_tc;
                netdev_reset_tc(dev);
        }
-        bp->cp_nr_rings = max_t(int, bp->tx_nr_rings, bp->rx_nr_rings);
+        bp->cp_nr_rings = sh ? max_t(int, bp->tx_nr_rings, bp->rx_nr_rings) :
+                               bp->tx_nr_rings + bp->rx_nr_rings;
        bp->num_stat_ctxs = bp->cp_nr_rings;
        if (netif_running(bp->dev))
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index ec6cd18842c3..60e2af8678bd 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -774,8 +774,8 @@ static int bnxt_vf_set_link(struct bnxt *bp, struct bnxt_vf_info *vf)
                if (vf->flags & BNXT_VF_LINK_UP) {
                        /* if physical link is down, force link up on VF */
-                        if (phy_qcfg_resp.link ==
+                        if (phy_qcfg_resp.link !=
-                            PORT_PHY_QCFG_RESP_LINK_NO_LINK) {
+                            PORT_PHY_QCFG_RESP_LINK_LINK) {
                                phy_qcfg_resp.link =
                                        PORT_PHY_QCFG_RESP_LINK_LINK;
                                phy_qcfg_resp.link_speed = cpu_to_le16(
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 4464bc5db934..a4e60e56c14f 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1172,6 +1172,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
                                          struct bcmgenet_tx_ring *ring)
 {
        struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device *kdev = &priv->pdev->dev;
        struct enet_cb *tx_cb_ptr;
        struct netdev_queue *txq;
        unsigned int pkts_compl = 0;
@@ -1199,13 +1200,13 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
                if (tx_cb_ptr->skb) {
                        pkts_compl++;
                        bytes_compl += GENET_CB(tx_cb_ptr->skb)->bytes_sent;
-                        dma_unmap_single(&dev->dev,
+                        dma_unmap_single(kdev,
                                         dma_unmap_addr(tx_cb_ptr, dma_addr),
                                         dma_unmap_len(tx_cb_ptr, dma_len),
                                         DMA_TO_DEVICE);
                        bcmgenet_free_cb(tx_cb_ptr);
                } else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) {
-                        dma_unmap_page(&dev->dev,
+                        dma_unmap_page(kdev,
                                       dma_unmap_addr(tx_cb_ptr, dma_addr),
                                       dma_unmap_len(tx_cb_ptr, dma_len),
                                       DMA_TO_DEVICE);
@@ -1775,6 +1776,7 @@ static int bcmgenet_alloc_rx_buffers(struct bcmgenet_priv *priv,
 static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv)
 {
+        struct device *kdev = &priv->pdev->dev;
        struct enet_cb *cb;
        int i;
@@ -1782,7 +1784,7 @@ static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv)
                cb = &priv->rx_cbs[i];
                if (dma_unmap_addr(cb, dma_addr)) {
-                        dma_unmap_single(&priv->dev->dev,
+                        dma_unmap_single(kdev,
                                         dma_unmap_addr(cb, dma_addr),
                                         priv->rx_buf_len, DMA_FROM_DEVICE);
                        dma_unmap_addr_set(cb, dma_addr, 0);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 457c3bc8cfff..e87607621e62 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -542,8 +542,10 @@ static int bcmgenet_mii_of_init(struct bcmgenet_priv *priv)
        /* Make sure we initialize MoCA PHYs with a link down */
        if (phy_mode == PHY_INTERFACE_MODE_MOCA) {
                phydev = of_phy_find_device(dn);
-                if (phydev)
+                if (phydev) {
                        phydev->link = 0;
+                        put_device(&phydev->mdio.dev);
+                }
        }
        return 0;
@@ -625,6 +627,7 @@ static int bcmgenet_mii_bus_init(struct bcmgenet_priv *priv)
 int bcmgenet_mii_init(struct net_device *dev)
 {
        struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device_node *dn = priv->pdev->dev.of_node;
        int ret;
        ret = bcmgenet_mii_alloc(priv);
@@ -638,6 +641,8 @@ int bcmgenet_mii_init(struct net_device *dev)
        return 0;
 out:
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
        of_node_put(priv->phy_dn);
        mdiobus_unregister(priv->mii_bus);
        mdiobus_free(priv->mii_bus);
@@ -647,7 +652,10 @@ out:
 void bcmgenet_mii_exit(struct net_device *dev)
 {
        struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device_node *dn = priv->pdev->dev.of_node;
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
        of_node_put(priv->phy_dn);
        mdiobus_unregister(priv->mii_bus);
        mdiobus_free(priv->mii_bus);
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index f9df4b5ae90e..f42f672b0e7e 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -177,6 +177,7 @@ bnad_txcmpl_process(struct bnad *bnad, struct bna_tcb *tcb)
                return 0;
        hw_cons = *(tcb->hw_consumer_index);
+        rmb();
        cons = tcb->consumer_index;
        q_depth = tcb->q_depth;
@@ -3094,7 +3095,7 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
        BNA_QE_INDX_INC(prod, q_depth);
        tcb->producer_index = prod;
-        smp_mb();
+        wmb();
        if (unlikely(!test_bit(BNAD_TXQ_TX_STARTED, &tcb->flags)))
                return NETDEV_TX_OK;
@@ -3102,7 +3103,6 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
        skb_tx_timestamp(skb);
        bna_txq_prod_indx_doorbell(tcb);
-        smp_mb();
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index b32444a3ed79..ec09fcece711 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -975,6 +975,7 @@ static inline void macb_init_rx_ring(struct macb *bp)
                addr += bp->rx_buffer_size;
        }
        bp->rx_ring[RX_RING_SIZE - 1].addr |= MACB_BIT(RX_WRAP);
+        bp->rx_tail = 0;
 }
 static int macb_rx(struct macb *bp, int budget)
@@ -1156,6 +1157,7 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                if (status & MACB_BIT(RXUBR)) {
                        ctrl = macb_readl(bp, NCR);
                        macb_writel(bp, NCR, ctrl & ~MACB_BIT(RE));
+                        wmb();
                        macb_writel(bp, NCR, ctrl | MACB_BIT(RE));
                        if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
@@ -1616,8 +1618,6 @@ static void macb_init_rings(struct macb *bp)
        bp->queues[0].tx_head = 0;
        bp->queues[0].tx_tail = 0;
        bp->queues[0].tx_ring[TX_RING_SIZE - 1].ctrl |= MACB_BIT(TX_WRAP);
-        bp->rx_tail = 0;
 }
 static void macb_reset_hw(struct macb *bp)
@@ -2673,6 +2673,12 @@ static int at91ether_start_xmit(struct sk_buff *skb, struct net_device *dev)
                lp->skb_length = skb->len;
                lp->skb_physaddr = dma_map_single(NULL, skb->data, skb->len,
                                                        DMA_TO_DEVICE);
+                if (dma_mapping_error(NULL, lp->skb_physaddr)) {
+                        dev_kfree_skb_any(skb);
+                        dev->stats.tx_dropped++;
+                        netdev_err(dev, "%s: DMA mapping error\n", __func__);
+                        return NETDEV_TX_OK;
+                }
                /* Set address of the data in the Transmit Address register */
                macb_writel(lp, TAR, lp->skb_physaddr);
@@ -2764,6 +2770,7 @@ static irqreturn_t at91ether_interrupt(int irq, void *dev_id)
        if (intstatus & MACB_BIT(RXUBR)) {
                ctl = macb_readl(lp, NCR);
                macb_writel(lp, NCR, ctl & ~MACB_BIT(RE));
+                wmb();
                macb_writel(lp, NCR, ctl | MACB_BIT(RE));
        }
diff --git a/drivers/net/ethernet/cavium/thunder/nic.h b/drivers/net/ethernet/cavium/thunder/nic.h
index 30426109711c..86bd93ce2ea3 100644
--- a/drivers/net/ethernet/cavium/thunder/nic.h
+++ b/drivers/net/ethernet/cavium/thunder/nic.h
@@ -47,7 +47,7 @@
 /* Min/Max packet size */
 #define NIC_HW_MIN_FRS                  64
-#define NIC_HW_MAX_FRS                  9200 /* 9216 max packet including FCS */
+#define NIC_HW_MAX_FRS                  9190 /* Excluding L2 header and FCS */
 /* Max pkinds */
 #define NIC_MAX_PKIND                   16
@@ -178,11 +178,11 @@ enum tx_stats_reg_offset {
 struct nicvf_hw_stats {
        u64 rx_bytes;
+        u64 rx_frames;
        u64 rx_ucast_frames;
        u64 rx_bcast_frames;
        u64 rx_mcast_frames;
-        u64 rx_fcs_errors;
+        u64 rx_drops;
-        u64 rx_l2_errors;
        u64 rx_drop_red;
        u64 rx_drop_red_bytes;
        u64 rx_drop_overrun;
@@ -191,6 +191,19 @@ struct nicvf_hw_stats {
        u64 rx_drop_mcast;
        u64 rx_drop_l3_bcast;
        u64 rx_drop_l3_mcast;
+        u64 rx_fcs_errors;
+        u64 rx_l2_errors;
+        u64 tx_bytes;
+        u64 tx_frames;
+        u64 tx_ucast_frames;
+        u64 tx_bcast_frames;
+        u64 tx_mcast_frames;
+        u64 tx_drops;
+};
+struct nicvf_drv_stats {
+        /* CQE Rx errs */
        u64 rx_bgx_truncated_pkts;
        u64 rx_jabber_errs;
        u64 rx_fcs_errs;
@@ -216,34 +229,30 @@ struct nicvf_hw_stats {
        u64 rx_l4_pclp;
        u64 rx_truncated_pkts;
-        u64 tx_bytes_ok;
+        /* CQE Tx errs */
-        u64 tx_ucast_frames_ok;
+        u64 tx_desc_fault;
-        u64 tx_bcast_frames_ok;
+        u64 tx_hdr_cons_err;
-        u64 tx_mcast_frames_ok;
+        u64 tx_subdesc_err;
-        u64 tx_drops;
+        u64 tx_max_size_exceeded;
-};
+        u64 tx_imm_size_oflow;
+        u64 tx_data_seq_err;
-struct nicvf_drv_stats {
+        u64 tx_mem_seq_err;
-        /* Rx */
+        u64 tx_lock_viol;
-        u64 rx_frames_ok;
+        u64 tx_data_fault;
-        u64 rx_frames_64;
+        u64 tx_tstmp_conflict;
-        u64 rx_frames_127;
+        u64 tx_tstmp_timeout;
-        u64 rx_frames_255;
+        u64 tx_mem_fault;
-        u64 rx_frames_511;
+        u64 tx_csum_overlap;
-        u64 rx_frames_1023;
+        u64 tx_csum_overflow;
-        u64 rx_frames_1518;
-        u64 rx_frames_jumbo;
+        /* driver debug stats */
-        u64 rx_drops;
        u64 rcv_buffer_alloc_failures;
-        /* Tx */
-        u64 tx_frames_ok;
-        u64 tx_drops;
        u64 tx_tso;
        u64 tx_timeout;
        u64 txq_stop;
        u64 txq_wake;
+        struct u64_stats_sync   syncp;
 };
 struct nicvf {
@@ -282,7 +291,6 @@ struct nicvf {
        u8                      node;
        u8                      cpi_alg;
-        u16                     mtu;
        bool                    link_up;
        u8                      duplex;
        u32                     speed;
@@ -298,7 +306,7 @@ struct nicvf {
        /* Stats */
        struct nicvf_hw_stats   hw_stats;
-        struct nicvf_drv_stats  drv_stats;
+        struct nicvf_drv_stats  __percpu *drv_stats;
        struct bgx_stats        bgx_stats;
        /* MSI-X  */
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 2bbf4cbf08b2..6677b96e1f3f 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -11,6 +11,7 @@
 #include <linux/pci.h>
 #include <linux/etherdevice.h>
 #include <linux/of.h>
+#include <linux/if_vlan.h>
 #include "nic_reg.h"
 #include "nic.h"
@@ -260,18 +261,31 @@ static void nic_get_bgx_stats(struct nicpf *nic, struct bgx_stats_msg *bgx)
 /* Update hardware min/max frame size */
 static int nic_update_hw_frs(struct nicpf *nic, int new_frs, int vf)
 {
-        if ((new_frs > NIC_HW_MAX_FRS) || (new_frs < NIC_HW_MIN_FRS)) {
+        int bgx, lmac, lmac_cnt;
-                dev_err(&nic->pdev->dev,
+        u64 lmac_credits;
-                        "Invalid MTU setting from VF%d rejected, should be between %d and %d\n",
-                           vf, NIC_HW_MIN_FRS, NIC_HW_MAX_FRS);
+        if ((new_frs > NIC_HW_MAX_FRS) || (new_frs < NIC_HW_MIN_FRS))
                return 1;
-        }
-        new_frs += ETH_HLEN;
-        if (new_frs <= nic->pkind.maxlen)
-                return 0;
-        nic->pkind.maxlen = new_frs;
+        bgx = NIC_GET_BGX_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]);
-        nic_reg_write(nic, NIC_PF_PKIND_0_15_CFG, *(u64 *)&nic->pkind);
+        lmac = NIC_GET_LMAC_FROM_VF_LMAC_MAP(nic->vf_lmac_map[vf]);
+        lmac += bgx * MAX_LMAC_PER_BGX;
+        new_frs += VLAN_ETH_HLEN + ETH_FCS_LEN + 4;
+        /* Update corresponding LMAC credits */
+        lmac_cnt = bgx_get_lmac_count(nic->node, bgx);
+        lmac_credits = nic_reg_read(nic, NIC_PF_LMAC_0_7_CREDIT + (lmac * 8));
+        lmac_credits &= ~(0xFFFFFULL << 12);
+        lmac_credits |= (((((48 * 1024) / lmac_cnt) - new_frs) / 16) << 12);
+        nic_reg_write(nic, NIC_PF_LMAC_0_7_CREDIT + (lmac * 8), lmac_credits);
+        /* Enforce MTU in HW
+         * This config is supported only from 88xx pass 2.0 onwards.
+         */
+        if (!pass1_silicon(nic->pdev))
+                nic_reg_write(nic,
+                              NIC_PF_LMAC_0_7_CFG2 + (lmac * 8), new_frs);
        return 0;
 }
@@ -464,7 +478,7 @@ static int nic_init_hw(struct nicpf *nic)
        /* PKIND configuration */
        nic->pkind.minlen = 0;
-        nic->pkind.maxlen = NIC_HW_MAX_FRS + ETH_HLEN;
+        nic->pkind.maxlen = NIC_HW_MAX_FRS + VLAN_ETH_HLEN + ETH_FCS_LEN + 4;
        nic->pkind.lenerr_en = 1;
        nic->pkind.rx_hdr = 0;
        nic->pkind.hdr_sl = 0;
@@ -837,6 +851,7 @@ static int nic_reset_stat_counters(struct nicpf *nic,
                        nic_reg_write(nic, reg_addr, 0);
                }
        }
        return 0;
 }
diff --git a/drivers/net/ethernet/cavium/thunder/nic_reg.h b/drivers/net/ethernet/cavium/thunder/nic_reg.h
index edf779f5a227..80d46337cf29 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_reg.h
+++ b/drivers/net/ethernet/cavium/thunder/nic_reg.h
@@ -106,6 +106,7 @@
 #define   NIC_PF_MPI_0_2047_CFG                 (0x210000)
 #define   NIC_PF_RSSI_0_4097_RQ                 (0x220000)
 #define   NIC_PF_LMAC_0_7_CFG                   (0x240000)
+#define   NIC_PF_LMAC_0_7_CFG2                  (0x240100)
 #define   NIC_PF_LMAC_0_7_SW_XOFF               (0x242000)
 #define   NIC_PF_LMAC_0_7_CREDIT                (0x244000)
 #define   NIC_PF_CHAN_0_255_TX_CFG              (0x400000)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
index ad4fddb55421..432bf6be57cb 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
@@ -36,11 +36,11 @@ struct nicvf_stat {
 static const struct nicvf_stat nicvf_hw_stats[] = {
        NICVF_HW_STAT(rx_bytes),
+        NICVF_HW_STAT(rx_frames),
        NICVF_HW_STAT(rx_ucast_frames),
        NICVF_HW_STAT(rx_bcast_frames),
        NICVF_HW_STAT(rx_mcast_frames),
-        NICVF_HW_STAT(rx_fcs_errors),
+        NICVF_HW_STAT(rx_drops),
-        NICVF_HW_STAT(rx_l2_errors),
        NICVF_HW_STAT(rx_drop_red),
        NICVF_HW_STAT(rx_drop_red_bytes),
        NICVF_HW_STAT(rx_drop_overrun),
@@ -49,50 +49,59 @@ static const struct nicvf_stat nicvf_hw_stats[] = {
        NICVF_HW_STAT(rx_drop_mcast),
        NICVF_HW_STAT(rx_drop_l3_bcast),
        NICVF_HW_STAT(rx_drop_l3_mcast),
-        NICVF_HW_STAT(rx_bgx_truncated_pkts),
+        NICVF_HW_STAT(rx_fcs_errors),
-        NICVF_HW_STAT(rx_jabber_errs),
+        NICVF_HW_STAT(rx_l2_errors),
-        NICVF_HW_STAT(rx_fcs_errs),
+        NICVF_HW_STAT(tx_bytes),
-        NICVF_HW_STAT(rx_bgx_errs),
+        NICVF_HW_STAT(tx_frames),
-        NICVF_HW_STAT(rx_prel2_errs),
+        NICVF_HW_STAT(tx_ucast_frames),
-        NICVF_HW_STAT(rx_l2_hdr_malformed),
+        NICVF_HW_STAT(tx_bcast_frames),
-        NICVF_HW_STAT(rx_oversize),
+        NICVF_HW_STAT(tx_mcast_frames),
-        NICVF_HW_STAT(rx_undersize),
+        NICVF_HW_STAT(tx_drops),
-        NICVF_HW_STAT(rx_l2_len_mismatch),
-        NICVF_HW_STAT(rx_l2_pclp),
-        NICVF_HW_STAT(rx_ip_ver_errs),
-        NICVF_HW_STAT(rx_ip_csum_errs),
-        NICVF_HW_STAT(rx_ip_hdr_malformed),
-        NICVF_HW_STAT(rx_ip_payload_malformed),
-        NICVF_HW_STAT(rx_ip_ttl_errs),
-        NICVF_HW_STAT(rx_l3_pclp),
-        NICVF_HW_STAT(rx_l4_malformed),
-        NICVF_HW_STAT(rx_l4_csum_errs),
-        NICVF_HW_STAT(rx_udp_len_errs),
-        NICVF_HW_STAT(rx_l4_port_errs),
-        NICVF_HW_STAT(rx_tcp_flag_errs),
-        NICVF_HW_STAT(rx_tcp_offset_errs),
-        NICVF_HW_STAT(rx_l4_pclp),
-        NICVF_HW_STAT(rx_truncated_pkts),
-        NICVF_HW_STAT(tx_bytes_ok),
-        NICVF_HW_STAT(tx_ucast_frames_ok),
-        NICVF_HW_STAT(tx_bcast_frames_ok),
-        NICVF_HW_STAT(tx_mcast_frames_ok),
 };
 static const struct nicvf_stat nicvf_drv_stats[] = {
-        NICVF_DRV_STAT(rx_frames_ok),
+        NICVF_DRV_STAT(rx_bgx_truncated_pkts),
-        NICVF_DRV_STAT(rx_frames_64),
+        NICVF_DRV_STAT(rx_jabber_errs),
-        NICVF_DRV_STAT(rx_frames_127),
+        NICVF_DRV_STAT(rx_fcs_errs),
-        NICVF_DRV_STAT(rx_frames_255),
+        NICVF_DRV_STAT(rx_bgx_errs),
-        NICVF_DRV_STAT(rx_frames_511),
+        NICVF_DRV_STAT(rx_prel2_errs),
-        NICVF_DRV_STAT(rx_frames_1023),
+        NICVF_DRV_STAT(rx_l2_hdr_malformed),
-        NICVF_DRV_STAT(rx_frames_1518),
+        NICVF_DRV_STAT(rx_oversize),
-        NICVF_DRV_STAT(rx_frames_jumbo),
+        NICVF_DRV_STAT(rx_undersize),
-        NICVF_DRV_STAT(rx_drops),
+        NICVF_DRV_STAT(rx_l2_len_mismatch),
+        NICVF_DRV_STAT(rx_l2_pclp),
+        NICVF_DRV_STAT(rx_ip_ver_errs),
+        NICVF_DRV_STAT(rx_ip_csum_errs),
+        NICVF_DRV_STAT(rx_ip_hdr_malformed),
+        NICVF_DRV_STAT(rx_ip_payload_malformed),
+        NICVF_DRV_STAT(rx_ip_ttl_errs),
+        NICVF_DRV_STAT(rx_l3_pclp),
+        NICVF_DRV_STAT(rx_l4_malformed),
+        NICVF_DRV_STAT(rx_l4_csum_errs),
+        NICVF_DRV_STAT(rx_udp_len_errs),
+        NICVF_DRV_STAT(rx_l4_port_errs),
+        NICVF_DRV_STAT(rx_tcp_flag_errs),
+        NICVF_DRV_STAT(rx_tcp_offset_errs),
+        NICVF_DRV_STAT(rx_l4_pclp),
+        NICVF_DRV_STAT(rx_truncated_pkts),
+        NICVF_DRV_STAT(tx_desc_fault),
+        NICVF_DRV_STAT(tx_hdr_cons_err),
+        NICVF_DRV_STAT(tx_subdesc_err),
+        NICVF_DRV_STAT(tx_max_size_exceeded),
+        NICVF_DRV_STAT(tx_imm_size_oflow),
+        NICVF_DRV_STAT(tx_data_seq_err),
+        NICVF_DRV_STAT(tx_mem_seq_err),
+        NICVF_DRV_STAT(tx_lock_viol),
+        NICVF_DRV_STAT(tx_data_fault),
+        NICVF_DRV_STAT(tx_tstmp_conflict),
+        NICVF_DRV_STAT(tx_tstmp_timeout),
+        NICVF_DRV_STAT(tx_mem_fault),
+        NICVF_DRV_STAT(tx_csum_overlap),
+        NICVF_DRV_STAT(tx_csum_overflow),
        NICVF_DRV_STAT(rcv_buffer_alloc_failures),
-        NICVF_DRV_STAT(tx_frames_ok),
        NICVF_DRV_STAT(tx_tso),
-        NICVF_DRV_STAT(tx_drops),
        NICVF_DRV_STAT(tx_timeout),
        NICVF_DRV_STAT(txq_stop),
        NICVF_DRV_STAT(txq_wake),
@@ -278,8 +287,8 @@ static void nicvf_get_ethtool_stats(struct net_device *netdev,
                                    struct ethtool_stats *stats, u64 *data)
 {
        struct nicvf *nic = netdev_priv(netdev);
-        int stat;
+        int stat, tmp_stats;
-        int sqs;
+        int sqs, cpu;
        nicvf_update_stats(nic);
@@ -289,9 +298,13 @@ static void nicvf_get_ethtool_stats(struct net_device *netdev,
        for (stat = 0; stat < nicvf_n_hw_stats; stat++)
                *(data++) = ((u64 *)&nic->hw_stats)
                                [nicvf_hw_stats[stat].index];
-        for (stat = 0; stat < nicvf_n_drv_stats; stat++)
+        for (stat = 0; stat < nicvf_n_drv_stats; stat++) {
-                *(data++) = ((u64 *)&nic->drv_stats)
+                tmp_stats = 0;
-                                [nicvf_drv_stats[stat].index];
+                for_each_possible_cpu(cpu)
+                        tmp_stats += ((u64 *)per_cpu_ptr(nic->drv_stats, cpu))
+                                     [nicvf_drv_stats[stat].index];
+                *(data++) = tmp_stats;
+        }
        nicvf_get_qset_stats(nic, stats, &data);
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 45a13f718863..8a37012c9c89 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -69,25 +69,6 @@ static inline u8 nicvf_netdev_qidx(struct nicvf *nic, u8 qidx)
                return qidx;
 }
-static inline void nicvf_set_rx_frame_cnt(struct nicvf *nic,
-                                          struct sk_buff *skb)
-{
-        if (skb->len <= 64)
-                nic->drv_stats.rx_frames_64++;
-        else if (skb->len <= 127)
-                nic->drv_stats.rx_frames_127++;
-        else if (skb->len <= 255)
-                nic->drv_stats.rx_frames_255++;
-        else if (skb->len <= 511)
-                nic->drv_stats.rx_frames_511++;
-        else if (skb->len <= 1023)
-                nic->drv_stats.rx_frames_1023++;
-        else if (skb->len <= 1518)
-                nic->drv_stats.rx_frames_1518++;
-        else
-                nic->drv_stats.rx_frames_jumbo++;
-}
 /* The Cavium ThunderX network controller can *only* be found in SoCs
 * containing the ThunderX ARM64 CPU implementation.  All accesses to the device
 * registers on this platform are implicitly strongly ordered with respect
@@ -492,9 +473,6 @@ int nicvf_set_real_num_queues(struct net_device *netdev,
 static int nicvf_init_resources(struct nicvf *nic)
 {
        int err;
-        union nic_mbx mbx = {};
-        mbx.msg.msg = NIC_MBOX_MSG_CFG_DONE;
        /* Enable Qset */
        nicvf_qset_config(nic, true);
@@ -507,14 +485,10 @@ static int nicvf_init_resources(struct nicvf *nic)
                return err;
        }
-        /* Send VF config done msg to PF */
-        nicvf_write_to_mbx(nic, &mbx);
        return 0;
 }
 static void nicvf_snd_pkt_handler(struct net_device *netdev,
-                                  struct cmp_queue *cq,
                                  struct cqe_send_t *cqe_tx,
                                  int cqe_type, int budget,
                                  unsigned int *tx_pkts, unsigned int *tx_bytes)
@@ -536,7 +510,7 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
                   __func__, cqe_tx->sq_qs, cqe_tx->sq_idx,
                   cqe_tx->sqe_ptr, hdr->subdesc_cnt);
-        nicvf_check_cqe_tx_errs(nic, cq, cqe_tx);
+        nicvf_check_cqe_tx_errs(nic, cqe_tx);
        skb = (struct sk_buff *)sq->skbuff[cqe_tx->sqe_ptr];
        if (skb) {
                /* Check for dummy descriptor used for HW TSO offload on 88xx */
@@ -630,8 +604,6 @@ static void nicvf_rcv_pkt_handler(struct net_device *netdev,
                return;
        }
-        nicvf_set_rx_frame_cnt(nic, skb);
        nicvf_set_rxhash(netdev, cqe_rx, skb);
        skb_record_rx_queue(skb, rq_idx);
@@ -703,7 +675,7 @@ loop:
                        work_done++;
                break;
                case CQE_TYPE_SEND:
-                        nicvf_snd_pkt_handler(netdev, cq,
+                        nicvf_snd_pkt_handler(netdev,
                                              (void *)cq_desc, CQE_TYPE_SEND,
                                              budget, &tx_pkts, &tx_bytes);
                        tx_done++;
@@ -740,7 +712,7 @@ done:
                nic = nic->pnicvf;
                if (netif_tx_queue_stopped(txq) && netif_carrier_ok(netdev)) {
                        netif_tx_start_queue(txq);
-                        nic->drv_stats.txq_wake++;
+                        this_cpu_inc(nic->drv_stats->txq_wake);
                        if (netif_msg_tx_err(nic))
                                netdev_warn(netdev,
                                            "%s: Transmit queue wakeup SQ%d\n",
@@ -1084,7 +1056,7 @@ static netdev_tx_t nicvf_xmit(struct sk_buff *skb, struct net_device *netdev)
        if (!netif_tx_queue_stopped(txq) && !nicvf_sq_append_skb(nic, skb)) {
                netif_tx_stop_queue(txq);
-                nic->drv_stats.txq_stop++;
+                this_cpu_inc(nic->drv_stats->txq_stop);
                if (netif_msg_tx_err(nic))
                        netdev_warn(netdev,
                                    "%s: Transmit ring full, stopping SQ%d\n",
@@ -1189,14 +1161,24 @@ int nicvf_stop(struct net_device *netdev)
        return 0;
 }
+static int nicvf_update_hw_max_frs(struct nicvf *nic, int mtu)
+{
+        union nic_mbx mbx = {};
+        mbx.frs.msg = NIC_MBOX_MSG_SET_MAX_FRS;
+        mbx.frs.max_frs = mtu;
+        mbx.frs.vf_id = nic->vf_id;
+        return nicvf_send_msg_to_pf(nic, &mbx);
+}
 int nicvf_open(struct net_device *netdev)
 {
-        int err, qidx;
+        int cpu, err, qidx;
        struct nicvf *nic = netdev_priv(netdev);
        struct queue_set *qs = nic->qs;
        struct nicvf_cq_poll *cq_poll = NULL;
+        union nic_mbx mbx = {};
-        nic->mtu = netdev->mtu;
        netif_carrier_off(netdev);
@@ -1248,9 +1230,17 @@ int nicvf_open(struct net_device *netdev)
        if (nic->sqs_mode)
                nicvf_get_primary_vf_struct(nic);
-        /* Configure receive side scaling */
+        /* Configure receive side scaling and MTU */
-        if (!nic->sqs_mode)
+        if (!nic->sqs_mode) {
                nicvf_rss_init(nic);
+                if (nicvf_update_hw_max_frs(nic, netdev->mtu))
+                        goto cleanup;
+                /* Clear percpu stats */
+                for_each_possible_cpu(cpu)
+                        memset(per_cpu_ptr(nic->drv_stats, cpu), 0,
+                               sizeof(struct nicvf_drv_stats));
+        }
        err = nicvf_register_interrupts(nic);
        if (err)
@@ -1276,8 +1266,9 @@ int nicvf_open(struct net_device *netdev)
        for (qidx = 0; qidx < qs->rbdr_cnt; qidx++)
                nicvf_enable_intr(nic, NICVF_INTR_RBDR, qidx);
-        nic->drv_stats.txq_stop = 0;
+        /* Send VF config done msg to PF */
-        nic->drv_stats.txq_wake = 0;
+        mbx.msg.msg = NIC_MBOX_MSG_CFG_DONE;
+        nicvf_write_to_mbx(nic, &mbx);
        return 0;
 cleanup:
@@ -1297,17 +1288,6 @@ napi_del:
        return err;
 }
-static int nicvf_update_hw_max_frs(struct nicvf *nic, int mtu)
-{
-        union nic_mbx mbx = {};
-        mbx.frs.msg = NIC_MBOX_MSG_SET_MAX_FRS;
-        mbx.frs.max_frs = mtu;
-        mbx.frs.vf_id = nic->vf_id;
-        return nicvf_send_msg_to_pf(nic, &mbx);
-}
 static int nicvf_change_mtu(struct net_device *netdev, int new_mtu)
 {
        struct nicvf *nic = netdev_priv(netdev);
@@ -1318,10 +1298,13 @@ static int nicvf_change_mtu(struct net_device *netdev, int new_mtu)
        if (new_mtu < NIC_HW_MIN_FRS)
                return -EINVAL;
+        netdev->mtu = new_mtu;
+        if (!netif_running(netdev))
+                return 0;
        if (nicvf_update_hw_max_frs(nic, new_mtu))
                return -EINVAL;
-        netdev->mtu = new_mtu;
-        nic->mtu = new_mtu;
        return 0;
 }
@@ -1379,9 +1362,10 @@ void nicvf_update_lmac_stats(struct nicvf *nic)
 void nicvf_update_stats(struct nicvf *nic)
 {
-        int qidx;
+        int qidx, cpu;
+        u64 tmp_stats = 0;
        struct nicvf_hw_stats *stats = &nic->hw_stats;
-        struct nicvf_drv_stats *drv_stats = &nic->drv_stats;
+        struct nicvf_drv_stats *drv_stats;
        struct queue_set *qs = nic->qs;
 #define GET_RX_STATS(reg) \
@@ -1404,21 +1388,33 @@ void nicvf_update_stats(struct nicvf *nic)
        stats->rx_drop_l3_bcast = GET_RX_STATS(RX_DRP_L3BCAST);
        stats->rx_drop_l3_mcast = GET_RX_STATS(RX_DRP_L3MCAST);
-        stats->tx_bytes_ok = GET_TX_STATS(TX_OCTS);
+        stats->tx_bytes = GET_TX_STATS(TX_OCTS);
-        stats->tx_ucast_frames_ok = GET_TX_STATS(TX_UCAST);
+        stats->tx_ucast_frames = GET_TX_STATS(TX_UCAST);
-        stats->tx_bcast_frames_ok = GET_TX_STATS(TX_BCAST);
+        stats->tx_bcast_frames = GET_TX_STATS(TX_BCAST);
-        stats->tx_mcast_frames_ok = GET_TX_STATS(TX_MCAST);
+        stats->tx_mcast_frames = GET_TX_STATS(TX_MCAST);
        stats->tx_drops = GET_TX_STATS(TX_DROP);
-        drv_stats->tx_frames_ok = stats->tx_ucast_frames_ok +
+        /* On T88 pass 2.0, the dummy SQE added for TSO notification
-                                  stats->tx_bcast_frames_ok +
+         * via CQE has 'dont_send' set. Hence HW drops the pkt pointed
-                                  stats->tx_mcast_frames_ok;
+         * pointed by dummy SQE and results in tx_drops counter being
-        drv_stats->rx_frames_ok = stats->rx_ucast_frames +
+         * incremented. Subtracting it from tx_tso counter will give
-                                  stats->rx_bcast_frames +
+         * exact tx_drops counter.
-                                  stats->rx_mcast_frames;
+         */
-        drv_stats->rx_drops = stats->rx_drop_red +
+        if (nic->t88 && nic->hw_tso) {
-                              stats->rx_drop_overrun;
+                for_each_possible_cpu(cpu) {
-        drv_stats->tx_drops = stats->tx_drops;
+                        drv_stats = per_cpu_ptr(nic->drv_stats, cpu);
+                        tmp_stats += drv_stats->tx_tso;
+                }
+                stats->tx_drops = tmp_stats - stats->tx_drops;
+        }
+        stats->tx_frames = stats->tx_ucast_frames +
+                           stats->tx_bcast_frames +
+                           stats->tx_mcast_frames;
+        stats->rx_frames = stats->rx_ucast_frames +
+                           stats->rx_bcast_frames +
+                           stats->rx_mcast_frames;
+        stats->rx_drops = stats->rx_drop_red +
+                          stats->rx_drop_overrun;
        /* Update RQ and SQ stats */
        for (qidx = 0; qidx < qs->rq_cnt; qidx++)
@@ -1432,18 +1428,17 @@ static struct rtnl_link_stats64 *nicvf_get_stats64(struct net_device *netdev,
 {
        struct nicvf *nic = netdev_priv(netdev);
        struct nicvf_hw_stats *hw_stats = &nic->hw_stats;
-        struct nicvf_drv_stats *drv_stats = &nic->drv_stats;
        nicvf_update_stats(nic);
        stats->rx_bytes = hw_stats->rx_bytes;
-        stats->rx_packets = drv_stats->rx_frames_ok;
+        stats->rx_packets = hw_stats->rx_frames;
-        stats->rx_dropped = drv_stats->rx_drops;
+        stats->rx_dropped = hw_stats->rx_drops;
        stats->multicast = hw_stats->rx_mcast_frames;
-        stats->tx_bytes = hw_stats->tx_bytes_ok;
+        stats->tx_bytes = hw_stats->tx_bytes;
-        stats->tx_packets = drv_stats->tx_frames_ok;
+        stats->tx_packets = hw_stats->tx_frames;
-        stats->tx_dropped = drv_stats->tx_drops;
+        stats->tx_dropped = hw_stats->tx_drops;
        return stats;
 }
@@ -1456,7 +1451,7 @@ static void nicvf_tx_timeout(struct net_device *dev)
                netdev_warn(dev, "%s: Transmit timed out, resetting\n",
                            dev->name);
-        nic->drv_stats.tx_timeout++;
+        this_cpu_inc(nic->drv_stats->tx_timeout);
        schedule_work(&nic->reset_task);
 }
@@ -1590,6 +1585,12 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                goto err_free_netdev;
        }
+        nic->drv_stats = netdev_alloc_pcpu_stats(struct nicvf_drv_stats);
+        if (!nic->drv_stats) {
+                err = -ENOMEM;
+                goto err_free_netdev;
+        }
        err = nicvf_set_qset_resources(nic);
        if (err)
                goto err_free_netdev;
@@ -1648,6 +1649,8 @@ err_unregister_interrupts:
        nicvf_unregister_interrupts(nic);
 err_free_netdev:
        pci_set_drvdata(pdev, NULL);
+        if (nic->drv_stats)
+                free_percpu(nic->drv_stats);
        free_netdev(netdev);
 err_release_regions:
        pci_release_regions(pdev);
@@ -1675,6 +1678,8 @@ static void nicvf_remove(struct pci_dev *pdev)
                unregister_netdev(pnetdev);
        nicvf_unregister_interrupts(nic);
        pci_set_drvdata(pdev, NULL);
+        if (nic->drv_stats)
+                free_percpu(nic->drv_stats);
        free_netdev(netdev);
        pci_release_regions(pdev);
        pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index a4fc50155881..747ef0882976 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -104,7 +104,8 @@ static inline int nicvf_alloc_rcv_buffer(struct nicvf *nic, gfp_t gfp,
                nic->rb_page = alloc_pages(gfp | __GFP_COMP | __GFP_NOWARN,
                                           order);
                if (!nic->rb_page) {
-                        nic->drv_stats.rcv_buffer_alloc_failures++;
+                        this_cpu_inc(nic->pnicvf->drv_stats->
+                                     rcv_buffer_alloc_failures);
                        return -ENOMEM;
                }
                nic->rb_page_offset = 0;
@@ -270,7 +271,8 @@ refill:
                              rbdr_idx, new_rb);
 next_rbdr:
        /* Re-enable RBDR interrupts only if buffer allocation is success */
-        if (!nic->rb_alloc_fail && rbdr->enable)
+        if (!nic->rb_alloc_fail && rbdr->enable &&
+            netif_running(nic->pnicvf->netdev))
                nicvf_enable_intr(nic, NICVF_INTR_RBDR, rbdr_idx);
        if (rbdr_idx)
@@ -361,6 +363,8 @@ static int nicvf_init_snd_queue(struct nicvf *nic,
 static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
 {
+        struct sk_buff *skb;
        if (!sq)
                return;
        if (!sq->dmem.base)
@@ -371,6 +375,15 @@ static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
                                  sq->dmem.q_len * TSO_HEADER_SIZE,
                                  sq->tso_hdrs, sq->tso_hdrs_phys);
+        /* Free pending skbs in the queue */
+        smp_rmb();
+        while (sq->head != sq->tail) {
+                skb = (struct sk_buff *)sq->skbuff[sq->head];
+                if (skb)
+                        dev_kfree_skb_any(skb);
+                sq->head++;
+                sq->head &= (sq->dmem.q_len - 1);
+        }
        kfree(sq->skbuff);
        nicvf_free_q_desc_mem(nic, &sq->dmem);
 }
@@ -483,9 +496,12 @@ static void nicvf_reset_rcv_queue_stats(struct nicvf *nic)
 {
        union nic_mbx mbx = {};
-        /* Reset all RXQ's stats */
+        /* Reset all RQ/SQ and VF stats */
        mbx.reset_stat.msg = NIC_MBOX_MSG_RESET_STAT_COUNTER;
+        mbx.reset_stat.rx_stat_mask = 0x3FFF;
+        mbx.reset_stat.tx_stat_mask = 0x1F;
        mbx.reset_stat.rq_stat_mask = 0xFFFF;
+        mbx.reset_stat.sq_stat_mask = 0xFFFF;
        nicvf_send_msg_to_pf(nic, &mbx);
 }
@@ -538,9 +554,12 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs,
        mbx.rq.cfg = (1ULL << 62) | (RQ_CQ_DROP << 8);
        nicvf_send_msg_to_pf(nic, &mbx);
-        nicvf_queue_reg_write(nic, NIC_QSET_RQ_GEN_CFG, 0, 0x00);
+        if (!nic->sqs_mode && (qidx == 0)) {
-        if (!nic->sqs_mode)
+                /* Enable checking L3/L4 length and TCP/UDP checksums */
+                nicvf_queue_reg_write(nic, NIC_QSET_RQ_GEN_CFG, 0,
+                                      (BIT(24) | BIT(23) | BIT(21)));
                nicvf_config_vlan_stripping(nic, nic->netdev->features);
+        }
        /* Enable Receive queue */
        memset(&rq_cfg, 0, sizeof(struct rq_cfg));
@@ -1029,7 +1048,7 @@ nicvf_sq_add_hdr_subdesc(struct nicvf *nic, struct snd_queue *sq, int qentry,
                hdr->tso_max_paysize = skb_shinfo(skb)->gso_size;
                /* For non-tunneled pkts, point this to L2 ethertype */
                hdr->inner_l3_offset = skb_network_offset(skb) - 2;
-                nic->drv_stats.tx_tso++;
+                this_cpu_inc(nic->pnicvf->drv_stats->tx_tso);
        }
 }
@@ -1161,7 +1180,7 @@ static int nicvf_sq_append_tso(struct nicvf *nic, struct snd_queue *sq,
        nicvf_sq_doorbell(nic, skb, sq_num, desc_cnt);
-        nic->drv_stats.tx_tso++;
+        this_cpu_inc(nic->pnicvf->drv_stats->tx_tso);
        return 1;
 }
@@ -1422,8 +1441,6 @@ void nicvf_update_sq_stats(struct nicvf *nic, int sq_idx)
 /* Check for errors in the receive cmp.queue entry */
 int nicvf_check_cqe_rx_errs(struct nicvf *nic, struct cqe_rx_t *cqe_rx)
 {
-        struct nicvf_hw_stats *stats = &nic->hw_stats;
        if (!cqe_rx->err_level && !cqe_rx->err_opcode)
                return 0;
@@ -1435,76 +1452,76 @@ int nicvf_check_cqe_rx_errs(struct nicvf *nic, struct cqe_rx_t *cqe_rx)
        switch (cqe_rx->err_opcode) {
        case CQ_RX_ERROP_RE_PARTIAL:
-                stats->rx_bgx_truncated_pkts++;
+                this_cpu_inc(nic->drv_stats->rx_bgx_truncated_pkts);
                break;
        case CQ_RX_ERROP_RE_JABBER:
-                stats->rx_jabber_errs++;
+                this_cpu_inc(nic->drv_stats->rx_jabber_errs);
                break;
        case CQ_RX_ERROP_RE_FCS:
-                stats->rx_fcs_errs++;
+                this_cpu_inc(nic->drv_stats->rx_fcs_errs);
                break;
        case CQ_RX_ERROP_RE_RX_CTL:
-                stats->rx_bgx_errs++;
+                this_cpu_inc(nic->drv_stats->rx_bgx_errs);
                break;
        case CQ_RX_ERROP_PREL2_ERR:
-                stats->rx_prel2_errs++;
+                this_cpu_inc(nic->drv_stats->rx_prel2_errs);
                break;
        case CQ_RX_ERROP_L2_MAL:
-                stats->rx_l2_hdr_malformed++;
+                this_cpu_inc(nic->drv_stats->rx_l2_hdr_malformed);
                break;
        case CQ_RX_ERROP_L2_OVERSIZE:
-                stats->rx_oversize++;
+                this_cpu_inc(nic->drv_stats->rx_oversize);
                break;
        case CQ_RX_ERROP_L2_UNDERSIZE:
-                stats->rx_undersize++;
+                this_cpu_inc(nic->drv_stats->rx_undersize);
                break;
        case CQ_RX_ERROP_L2_LENMISM:
-                stats->rx_l2_len_mismatch++;
+                this_cpu_inc(nic->drv_stats->rx_l2_len_mismatch);
                break;
        case CQ_RX_ERROP_L2_PCLP:
-                stats->rx_l2_pclp++;
+                this_cpu_inc(nic->drv_stats->rx_l2_pclp);
                break;
        case CQ_RX_ERROP_IP_NOT:
-                stats->rx_ip_ver_errs++;
+                this_cpu_inc(nic->drv_stats->rx_ip_ver_errs);
                break;
        case CQ_RX_ERROP_IP_CSUM_ERR:
-                stats->rx_ip_csum_errs++;
+                this_cpu_inc(nic->drv_stats->rx_ip_csum_errs);
                break;
        case CQ_RX_ERROP_IP_MAL:
-                stats->rx_ip_hdr_malformed++;
+                this_cpu_inc(nic->drv_stats->rx_ip_hdr_malformed);
                break;
        case CQ_RX_ERROP_IP_MALD:
-                stats->rx_ip_payload_malformed++;
+                this_cpu_inc(nic->drv_stats->rx_ip_payload_malformed);
                break;
        case CQ_RX_ERROP_IP_HOP:
-                stats->rx_ip_ttl_errs++;
+                this_cpu_inc(nic->drv_stats->rx_ip_ttl_errs);
                break;
        case CQ_RX_ERROP_L3_PCLP:
-                stats->rx_l3_pclp++;
+                this_cpu_inc(nic->drv_stats->rx_l3_pclp);
                break;
        case CQ_RX_ERROP_L4_MAL:
-                stats->rx_l4_malformed++;
+                this_cpu_inc(nic->drv_stats->rx_l4_malformed);
                break;
        case CQ_RX_ERROP_L4_CHK:
-                stats->rx_l4_csum_errs++;
+                this_cpu_inc(nic->drv_stats->rx_l4_csum_errs);
                break;
        case CQ_RX_ERROP_UDP_LEN:
-                stats->rx_udp_len_errs++;
+                this_cpu_inc(nic->drv_stats->rx_udp_len_errs);
                break;
        case CQ_RX_ERROP_L4_PORT:
-                stats->rx_l4_port_errs++;
+                this_cpu_inc(nic->drv_stats->rx_l4_port_errs);
                break;
        case CQ_RX_ERROP_TCP_FLAG:
-                stats->rx_tcp_flag_errs++;
+                this_cpu_inc(nic->drv_stats->rx_tcp_flag_errs);
                break;
        case CQ_RX_ERROP_TCP_OFFSET:
-                stats->rx_tcp_offset_errs++;
+                this_cpu_inc(nic->drv_stats->rx_tcp_offset_errs);
                break;
        case CQ_RX_ERROP_L4_PCLP:
-                stats->rx_l4_pclp++;
+                this_cpu_inc(nic->drv_stats->rx_l4_pclp);
                break;
        case CQ_RX_ERROP_RBDR_TRUNC:
-                stats->rx_truncated_pkts++;
+                this_cpu_inc(nic->drv_stats->rx_truncated_pkts);
                break;
        }
@@ -1512,53 +1529,52 @@ int nicvf_check_cqe_rx_errs(struct nicvf *nic, struct cqe_rx_t *cqe_rx)
 }
 /* Check for errors in the send cmp.queue entry */
-int nicvf_check_cqe_tx_errs(struct nicvf *nic,
+int nicvf_check_cqe_tx_errs(struct nicvf *nic, struct cqe_send_t *cqe_tx)
-                            struct cmp_queue *cq, struct cqe_send_t *cqe_tx)
 {
-        struct cmp_queue_stats *stats = &cq->stats;
        switch (cqe_tx->send_status) {
        case CQ_TX_ERROP_GOOD:
-                stats->tx.good++;
                return 0;
        case CQ_TX_ERROP_DESC_FAULT:
-                stats->tx.desc_fault++;
+                this_cpu_inc(nic->drv_stats->tx_desc_fault);
                break;
        case CQ_TX_ERROP_HDR_CONS_ERR:
-                stats->tx.hdr_cons_err++;
+                this_cpu_inc(nic->drv_stats->tx_hdr_cons_err);
                break;
        case CQ_TX_ERROP_SUBDC_ERR:
-                stats->tx.subdesc_err++;
+                this_cpu_inc(nic->drv_stats->tx_subdesc_err);
+                break;
+        case CQ_TX_ERROP_MAX_SIZE_VIOL:
+                this_cpu_inc(nic->drv_stats->tx_max_size_exceeded);
                break;
        case CQ_TX_ERROP_IMM_SIZE_OFLOW:
-                stats->tx.imm_size_oflow++;
+                this_cpu_inc(nic->drv_stats->tx_imm_size_oflow);
                break;
        case CQ_TX_ERROP_DATA_SEQUENCE_ERR:
-                stats->tx.data_seq_err++;
+                this_cpu_inc(nic->drv_stats->tx_data_seq_err);
                break;
        case CQ_TX_ERROP_MEM_SEQUENCE_ERR:
-                stats->tx.mem_seq_err++;
+                this_cpu_inc(nic->drv_stats->tx_mem_seq_err);
                break;
        case CQ_TX_ERROP_LOCK_VIOL:
-                stats->tx.lock_viol++;
+                this_cpu_inc(nic->drv_stats->tx_lock_viol);
                break;
        case CQ_TX_ERROP_DATA_FAULT:
-                stats->tx.data_fault++;
+                this_cpu_inc(nic->drv_stats->tx_data_fault);
                break;
        case CQ_TX_ERROP_TSTMP_CONFLICT:
-                stats->tx.tstmp_conflict++;
+                this_cpu_inc(nic->drv_stats->tx_tstmp_conflict);
                break;
        case CQ_TX_ERROP_TSTMP_TIMEOUT:
-                stats->tx.tstmp_timeout++;
+                this_cpu_inc(nic->drv_stats->tx_tstmp_timeout);
                break;
        case CQ_TX_ERROP_MEM_FAULT:
-                stats->tx.mem_fault++;
+                this_cpu_inc(nic->drv_stats->tx_mem_fault);
                break;
        case CQ_TX_ERROP_CK_OVERLAP:
-                stats->tx.csum_overlap++;
+                this_cpu_inc(nic->drv_stats->tx_csum_overlap);
                break;
        case CQ_TX_ERROP_CK_OFLOW:
-                stats->tx.csum_overflow++;
+                this_cpu_inc(nic->drv_stats->tx_csum_overflow);
                break;
        }
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
index 869f3386028b..2e3c940c1093 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
@@ -158,6 +158,7 @@ enum CQ_TX_ERROP_E {
        CQ_TX_ERROP_DESC_FAULT = 0x10,
        CQ_TX_ERROP_HDR_CONS_ERR = 0x11,
        CQ_TX_ERROP_SUBDC_ERR = 0x12,
+        CQ_TX_ERROP_MAX_SIZE_VIOL = 0x13,
        CQ_TX_ERROP_IMM_SIZE_OFLOW = 0x80,
        CQ_TX_ERROP_DATA_SEQUENCE_ERR = 0x81,
        CQ_TX_ERROP_MEM_SEQUENCE_ERR = 0x82,
@@ -171,25 +172,6 @@ enum CQ_TX_ERROP_E {
        CQ_TX_ERROP_ENUM_LAST = 0x8a,
 };
-struct cmp_queue_stats {
-        struct tx_stats {
-                u64 good;
-                u64 desc_fault;
-                u64 hdr_cons_err;
-                u64 subdesc_err;
-                u64 imm_size_oflow;
-                u64 data_seq_err;
-                u64 mem_seq_err;
-                u64 lock_viol;
-                u64 data_fault;
-                u64 tstmp_conflict;
-                u64 tstmp_timeout;
-                u64 mem_fault;
-                u64 csum_overlap;
-                u64 csum_overflow;
-        } tx;
-} ____cacheline_aligned_in_smp;
 enum RQ_SQ_STATS {
        RQ_SQ_STATS_OCTS,
        RQ_SQ_STATS_PKTS,
@@ -241,7 +223,6 @@ struct cmp_queue {
        spinlock_t      lock;  /* lock to serialize processing CQEs */
        void            *desc;
        struct q_desc_mem   dmem;
-        struct cmp_queue_stats  stats;
        int             irq;
 } ____cacheline_aligned_in_smp;
@@ -336,6 +317,5 @@ u64  nicvf_queue_reg_read(struct nicvf *nic,
 void nicvf_update_rq_stats(struct nicvf *nic, int rq_idx);
 void nicvf_update_sq_stats(struct nicvf *nic, int sq_idx);
 int nicvf_check_cqe_rx_errs(struct nicvf *nic, struct cqe_rx_t *cqe_rx);
-int nicvf_check_cqe_tx_errs(struct nicvf *nic,
+int nicvf_check_cqe_tx_errs(struct nicvf *nic, struct cqe_send_t *cqe_tx);
-                            struct cmp_queue *cq, struct cqe_send_t *cqe_tx);
 #endif /* NICVF_QUEUES_H */
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 8bbaedbb7b94..050e21fbb147 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -1242,8 +1242,8 @@ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        pci_read_config_word(pdev, PCI_DEVICE_ID, &sdevid);
        if (sdevid != PCI_DEVICE_ID_THUNDER_RGX) {
-                bgx->bgx_id =
+                bgx->bgx_id = (pci_resource_start(pdev,
-                    (pci_resource_start(pdev, PCI_CFG_REG_BAR_NUM) >> 24) & 1;
+                        PCI_CFG_REG_BAR_NUM) >> 24) & BGX_ID_MASK;
                bgx->bgx_id += nic_get_node_id(pdev) * MAX_BGX_PER_NODE;
                bgx->max_lmac = MAX_LMAC_PER_BGX;
                bgx_vnic[bgx->bgx_id] = bgx;
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
index d59c71e4a000..01cc7c859131 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
@@ -28,6 +28,8 @@
 #define    MAX_DMAC_PER_LMAC                    8
 #define    MAX_FRAME_SIZE                       9216
+#define    BGX_ID_MASK                          0x3
 #define    MAX_DMAC_PER_LMAC_TNS_BYPASS_MODE    2
 /* Registers */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index f320497368f4..19dc9e25aa72 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4057,7 +4057,7 @@ static void cfg_queues(struct adapter *adap)
                 * capped by the number of available cores.
                 */
                if (n10g) {
-                        i = num_online_cpus();
+                        i = min_t(int, MAX_OFLD_QSETS, num_online_cpus());
                        s->ofldqsets = roundup(i, adap->params.nports);
                } else {
                        s->ofldqsets = adap->params.nports;
@@ -4931,6 +4931,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         */
        for_each_port(adapter, i) {
                pi = adap2pinfo(adapter, i);
+                adapter->port[i]->dev_port = pi->lport;
                netif_set_real_num_tx_queues(adapter->port[i], pi->nqsets);
                netif_set_real_num_rx_queues(adapter->port[i], pi->nqsets);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
index 0945fa49a5dd..2471ff465d5c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
@@ -135,15 +135,17 @@ static int uldrx_handler(struct sge_rspq *q, const __be64 *rsp,
 }
 static int alloc_uld_rxqs(struct adapter *adap,
-                          struct sge_uld_rxq_info *rxq_info,
+                          struct sge_uld_rxq_info *rxq_info, bool lro)
-                          unsigned int nq, unsigned int offset, bool lro)
 {
        struct sge *s = &adap->sge;
-        struct sge_ofld_rxq *q = rxq_info->uldrxq + offset;
+        unsigned int nq = rxq_info->nrxq + rxq_info->nciq;
-        unsigned short *ids = rxq_info->rspq_id + offset;
+        struct sge_ofld_rxq *q = rxq_info->uldrxq;
-        unsigned int per_chan = nq / adap->params.nports;
+        unsigned short *ids = rxq_info->rspq_id;
        unsigned int bmap_idx = 0;
-        int i, err, msi_idx;
+        unsigned int per_chan;
+        int i, err, msi_idx, que_idx = 0;
+        per_chan = rxq_info->nrxq / adap->params.nports;
        if (adap->flags & USING_MSIX)
                msi_idx = 1;
@@ -151,12 +153,18 @@ static int alloc_uld_rxqs(struct adapter *adap,
                msi_idx = -((int)s->intrq.abs_id + 1);
        for (i = 0; i < nq; i++, q++) {
+                if (i == rxq_info->nrxq) {
+                        /* start allocation of concentrator queues */
+                        per_chan = rxq_info->nciq / adap->params.nports;
+                        que_idx = 0;
+                }
                if (msi_idx >= 0) {
                        bmap_idx = get_msix_idx_from_bmap(adap);
                        msi_idx = adap->msix_info_ulds[bmap_idx].idx;
                }
                err = t4_sge_alloc_rxq(adap, &q->rspq, false,
-                                       adap->port[i / per_chan],
+                                       adap->port[que_idx++ / per_chan],
                                       msi_idx,
                                       q->fl.size ? &q->fl : NULL,
                                       uldrx_handler,
@@ -165,29 +173,19 @@ static int alloc_uld_rxqs(struct adapter *adap,
                if (err)
                        goto freeout;
                if (msi_idx >= 0)
-                        rxq_info->msix_tbl[i + offset] = bmap_idx;
+                        rxq_info->msix_tbl[i] = bmap_idx;
                memset(&q->stats, 0, sizeof(q->stats));
                if (ids)
                        ids[i] = q->rspq.abs_id;
        }
        return 0;
 freeout:
-        q = rxq_info->uldrxq + offset;
+        q = rxq_info->uldrxq;
        for ( ; i; i--, q++) {
                if (q->rspq.desc)
                        free_rspq_fl(adap, &q->rspq,
                                     q->fl.size ? &q->fl : NULL);
        }
-        /* We need to free rxq also in case of ciq allocation failure */
-        if (offset) {
-                q = rxq_info->uldrxq + offset;
-                for ( ; i; i--, q++) {
-                        if (q->rspq.desc)
-                                free_rspq_fl(adap, &q->rspq,
-                                             q->fl.size ? &q->fl : NULL);
-                }
-        }
        return err;
 }
@@ -205,9 +203,7 @@ setup_sge_queues_uld(struct adapter *adap, unsigned int uld_type, bool lro)
                        return -ENOMEM;
        }
-        ret = !(!alloc_uld_rxqs(adap, rxq_info, rxq_info->nrxq, 0, lro) &&
+        ret = !(!alloc_uld_rxqs(adap, rxq_info, lro));
-                 !alloc_uld_rxqs(adap, rxq_info, rxq_info->nciq,
-                                 rxq_info->nrxq, lro));
        /* Tell uP to route control queue completions to rdma rspq */
        if (adap->flags & FULL_INIT_DONE &&
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sched.c b/drivers/net/ethernet/chelsio/cxgb4/sched.c
index 539de764bbd3..cbd68a8fe2e4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sched.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sched.c
@@ -210,8 +210,10 @@ static int t4_sched_queue_bind(struct port_info *pi, struct ch_sched_queue *p)
        /* Unbind queue from any existing class */
        err = t4_sched_queue_unbind(pi, p);
-        if (err)
+        if (err) {
+                t4_free_mem(qe);
                goto out;
+        }
        /* Bind queue to specified class */
        memset(qe, 0, sizeof(*qe));
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 1e74fd6085df..e19a0ca8e5dd 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2951,7 +2951,6 @@ void free_rspq_fl(struct adapter *adap, struct sge_rspq *rq,
                   rq->cntxt_id, fl_id, 0xffff);
        dma_free_coherent(adap->pdev_dev, (rq->size + 1) * rq->iqe_len,
                          rq->desc, rq->phys_addr);
-        napi_hash_del(&rq->napi);
        netif_napi_del(&rq->napi);
        rq->netdev = NULL;
        rq->cntxt_id = rq->abs_id = 0;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 20dec85da63d..e8139514d32c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -7851,7 +7851,6 @@ int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
                        return ret;
                memcpy(adap->port[i]->dev_addr, addr, ETH_ALEN);
-                adap->port[i]->dev_port = j;
                j++;
        }
        return 0;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index 50812a1d67bd..ecf3ccc257bc 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -168,6 +168,7 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
        CH_PCI_ID_TABLE_FENTRY(0x509a), /* Custom T520-CR */
        CH_PCI_ID_TABLE_FENTRY(0x509b), /* Custom T540-CR LOM */
        CH_PCI_ID_TABLE_FENTRY(0x509c), /* Custom T520-CR*/
+        CH_PCI_ID_TABLE_FENTRY(0x509d), /* Custom T540-CR*/
        /* T6 adapters:
         */
@@ -178,9 +179,9 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
        CH_PCI_ID_TABLE_FENTRY(0x6005),
        CH_PCI_ID_TABLE_FENTRY(0x6006),
        CH_PCI_ID_TABLE_FENTRY(0x6007),
+        CH_PCI_ID_TABLE_FENTRY(0x6008),
        CH_PCI_ID_TABLE_FENTRY(0x6009),
        CH_PCI_ID_TABLE_FENTRY(0x600d),
-        CH_PCI_ID_TABLE_FENTRY(0x6010),
        CH_PCI_ID_TABLE_FENTRY(0x6011),
        CH_PCI_ID_TABLE_FENTRY(0x6014),
        CH_PCI_ID_TABLE_FENTRY(0x6015),
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index 100b2cc064a3..a37481c04a87 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2969,6 +2969,7 @@ static int cxgb4vf_pci_probe(struct pci_dev *pdev,
                netdev->netdev_ops = &cxgb4vf_netdev_ops;
                netdev->ethtool_ops = &cxgb4vf_ethtool_ops;
+                netdev->dev_port = pi->port_id;
                /*
                 * Initialize the hardware/software state for the port.
diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c
index de9f7c97d916..9a161e981529 100644
--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c
+++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c
@@ -468,6 +468,9 @@ static void ep93xx_free_buffers(struct ep93xx_priv *ep)
        struct device *dev = ep->dev->dev.parent;
        int i;
+        if (!ep->descs)
+                return;
        for (i = 0; i < RX_QUEUE_ENTRIES; i++) {
                dma_addr_t d;
@@ -490,6 +493,7 @@ static void ep93xx_free_buffers(struct ep93xx_priv *ep)
        dma_free_coherent(dev, sizeof(struct ep93xx_descs), ep->descs,
                                                        ep->descs_dma_addr);
+        ep->descs = NULL;
 }
 static int ep93xx_alloc_buffers(struct ep93xx_priv *ep)
diff --git a/drivers/net/ethernet/cisco/enic/vnic_rq.c b/drivers/net/ethernet/cisco/enic/vnic_rq.c
index e572a527b18d..36bc2c71fba9 100644
--- a/drivers/net/ethernet/cisco/enic/vnic_rq.c
+++ b/drivers/net/ethernet/cisco/enic/vnic_rq.c
@@ -169,19 +169,28 @@ int vnic_rq_disable(struct vnic_rq *rq)
 {
        unsigned int wait;
        struct vnic_dev *vdev = rq->vdev;
+        int i;
-        iowrite32(0, &rq->ctrl->enable);
+        /* Due to a race condition with clearing RQ "mini-cache" in hw, we need
+         * to disable the RQ twice to guarantee that stale descriptors are not
+         * used when this RQ is re-enabled.
+         */
+        for (i = 0; i < 2; i++) {
+                iowrite32(0, &rq->ctrl->enable);
-        /* Wait for HW to ACK disable request */
+                /* Wait for HW to ACK disable request */
-        for (wait = 0; wait < 1000; wait++) {
+                for (wait = 20000; wait > 0; wait--)
-                if (!(ioread32(&rq->ctrl->running)))
+                        if (!ioread32(&rq->ctrl->running))
-                        return 0;
+                                break;
-                udelay(10);
+                if (!wait) {
-        }
+                        vdev_neterr(vdev, "Failed to disable RQ[%d]\n",
+                                    rq->index);
-        vdev_neterr(vdev, "Failed to disable RQ[%d]\n", rq->index);
+                        return -ETIMEDOUT;
+                }
+        }
-        return -ETIMEDOUT;
+        return 0;
 }
 void vnic_rq_clean(struct vnic_rq *rq,
@@ -212,6 +221,11 @@ void vnic_rq_clean(struct vnic_rq *rq,
                        [fetch_index % VNIC_RQ_BUF_BLK_ENTRIES(count)];
        iowrite32(fetch_index, &rq->ctrl->posted_index);
+        /* Anytime we write fetch_index, we need to re-write 0 to rq->enable
+         * to re-sync internal VIC state.
+         */
+        iowrite32(0, &rq->ctrl->enable);
        vnic_dev_clear_desc_ring(&rq->ring);
 }
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 1fb5d7239254..0e74529a4209 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -90,7 +90,8 @@ static struct be_cmd_priv_map cmd_priv_map[] = {
        {
                OPCODE_COMMON_SET_HSW_CONFIG,
                CMD_SUBSYSTEM_COMMON,
-                BE_PRIV_DEVCFG | BE_PRIV_VHADM
+                BE_PRIV_DEVCFG | BE_PRIV_VHADM |
+                BE_PRIV_DEVSEC
        },
        {
                OPCODE_COMMON_GET_EXT_FAT_CAPABILITIES,
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index cece8a08edca..93aa2939142a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2813,7 +2813,6 @@ static void be_evt_queues_destroy(struct be_adapter *adapter)
                if (eqo->q.created) {
                        be_eq_clean(eqo);
                        be_cmd_q_destroy(adapter, &eqo->q, QTYPE_EQ);
-                        napi_hash_del(&eqo->napi);
                        netif_napi_del(&eqo->napi);
                        free_cpumask_var(eqo->affinity_mask);
                }
diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c
index f928e6f79c89..223f35cc034c 100644
--- a/drivers/net/ethernet/ezchip/nps_enet.c
+++ b/drivers/net/ethernet/ezchip/nps_enet.c
@@ -669,6 +669,7 @@ static const struct of_device_id nps_enet_dt_ids[] = {
        { .compatible = "ezchip,nps-mgt-enet" },
        { /* Sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, nps_enet_dt_ids);
 static struct platform_driver nps_enet_driver = {
        .probe = nps_enet_probe,
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index c865135f3cb9..5ea740b4cf14 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -574,6 +574,8 @@ struct fec_enet_private {
        unsigned int reload_period;
        int pps_enable;
        unsigned int next_counter;
+        u64 ethtool_stats[0];
 };
 void fec_ptp_init(struct platform_device *pdev);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 48a033e64423..12aef1b15356 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1430,14 +1430,14 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
                skb_put(skb, pkt_len - 4);
                data = skb->data;
+                if (!is_copybreak && need_swap)
+                        swap_buffer(data, pkt_len);
 #if !defined(CONFIG_M5272)
                if (fep->quirks & FEC_QUIRK_HAS_RACC)
                        data = skb_pull_inline(skb, 2);
 #endif
-                if (!is_copybreak && need_swap)
-                        swap_buffer(data, pkt_len);
                /* Extract the enhanced buffer descriptor */
                ebdp = NULL;
                if (fep->bufdesc_ex)
@@ -2313,14 +2313,26 @@ static const struct fec_stat {
        { "IEEE_rx_octets_ok", IEEE_R_OCTETS_OK },
 };
-static void fec_enet_get_ethtool_stats(struct net_device *dev,
+#define FEC_STATS_SIZE          (ARRAY_SIZE(fec_stats) * sizeof(u64))
-        struct ethtool_stats *stats, u64 *data)
+static void fec_enet_update_ethtool_stats(struct net_device *dev)
 {
        struct fec_enet_private *fep = netdev_priv(dev);
        int i;
        for (i = 0; i < ARRAY_SIZE(fec_stats); i++)
-                data[i] = readl(fep->hwp + fec_stats[i].offset);
+                fep->ethtool_stats[i] = readl(fep->hwp + fec_stats[i].offset);
+}
+static void fec_enet_get_ethtool_stats(struct net_device *dev,
+                                       struct ethtool_stats *stats, u64 *data)
+{
+        struct fec_enet_private *fep = netdev_priv(dev);
+        if (netif_running(dev))
+                fec_enet_update_ethtool_stats(dev);
+        memcpy(data, fep->ethtool_stats, FEC_STATS_SIZE);
 }
 static void fec_enet_get_strings(struct net_device *netdev,
@@ -2345,6 +2357,12 @@ static int fec_enet_get_sset_count(struct net_device *dev, int sset)
                return -EOPNOTSUPP;
        }
 }
+#else   /* !defined(CONFIG_M5272) */
+#define FEC_STATS_SIZE  0
+static inline void fec_enet_update_ethtool_stats(struct net_device *dev)
+{
+}
 #endif /* !defined(CONFIG_M5272) */
 static int fec_enet_nway_reset(struct net_device *dev)
@@ -2874,6 +2892,8 @@ fec_enet_close(struct net_device *ndev)
        if (fep->quirks & FEC_QUIRK_ERR006687)
                imx6q_cpuidle_fec_irqs_unused();
+        fec_enet_update_ethtool_stats(ndev);
        fec_enet_clk_enable(ndev, false);
        pinctrl_pm_select_sleep_state(&fep->pdev->dev);
        pm_runtime_mark_last_busy(&fep->pdev->dev);
@@ -3180,6 +3200,8 @@ static int fec_enet_init(struct net_device *ndev)
        fec_restart(ndev);
+        fec_enet_update_ethtool_stats(ndev);
        return 0;
 }
@@ -3278,8 +3300,8 @@ fec_probe(struct platform_device *pdev)
        fec_enet_get_queue_num(pdev, &num_tx_qs, &num_rx_qs);
        /* Init network device */
-        ndev = alloc_etherdev_mqs(sizeof(struct fec_enet_private),
+        ndev = alloc_etherdev_mqs(sizeof(struct fec_enet_private) +
-                                  num_tx_qs, num_rx_qs);
+                                  FEC_STATS_SIZE, num_tx_qs, num_rx_qs);
        if (!ndev)
                return -ENOMEM;
@@ -3475,6 +3497,8 @@ failed_regulator:
 failed_clk_ipg:
        fec_enet_clk_enable(ndev, false);
 failed_clk:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
 failed_phy:
        of_node_put(phy_node);
 failed_ioremap:
@@ -3488,6 +3512,7 @@ fec_drv_remove(struct platform_device *pdev)
 {
        struct net_device *ndev = platform_get_drvdata(pdev);
        struct fec_enet_private *fep = netdev_priv(ndev);
+        struct device_node *np = pdev->dev.of_node;
        cancel_work_sync(&fep->tx_timeout_work);
        fec_ptp_stop(pdev);
@@ -3495,6 +3520,8 @@ fec_drv_remove(struct platform_device *pdev)
        fec_enet_mii_remove(fep);
        if (fep->reg_phy)
                regulator_disable(fep->reg_phy);
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
        of_node_put(fep->phy_node);
        free_netdev(ndev);
diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
index 53ef51e3bd9e..71a5ded9d1de 100644
--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
+++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
@@ -1107,6 +1107,9 @@ int memac_free(struct fman_mac *memac)
 {
        free_init_resources(memac);
+        if (memac->pcsphy)
+                put_device(&memac->pcsphy->mdio.dev);
        kfree(memac->memac_drv_param);
        kfree(memac);
diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c
index efabb04a1ae8..4b0f3a50b293 100644
--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c
+++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c
@@ -722,9 +722,6 @@ int tgec_free(struct fman_mac *tgec)
 {
        free_init_resources(tgec);
-        if (tgec->cfg)
-                tgec->cfg = NULL;
        kfree(tgec->cfg);
        kfree(tgec);
diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
index 8fe6b3e253fa..736db9d9b0ad 100644
--- a/drivers/net/ethernet/freescale/fman/mac.c
+++ b/drivers/net/ethernet/freescale/fman/mac.c
@@ -892,6 +892,8 @@ static int mac_probe(struct platform_device *_of_dev)
                priv->fixed_link->duplex = phy->duplex;
                priv->fixed_link->pause = phy->pause;
                priv->fixed_link->asym_pause = phy->asym_pause;
+                put_device(&phy->mdio.dev);
        }
        err = mac_dev->init(mac_dev);
diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
index dc120c148d97..4b86260584a0 100644
--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
@@ -980,7 +980,7 @@ static int fs_enet_probe(struct platform_device *ofdev)
                err = clk_prepare_enable(clk);
                if (err) {
                        ret = err;
-                        goto out_free_fpi;
+                        goto out_deregister_fixed_link;
                }
                fpi->clk_per = clk;
        }
@@ -1061,6 +1061,9 @@ out_put:
        of_node_put(fpi->phy_node);
        if (fpi->clk_per)
                clk_disable_unprepare(fpi->clk_per);
+out_deregister_fixed_link:
+        if (of_phy_is_fixed_link(ofdev->dev.of_node))
+                of_phy_deregister_fixed_link(ofdev->dev.of_node);
 out_free_fpi:
        kfree(fpi);
        return ret;
@@ -1079,6 +1082,8 @@ static int fs_enet_remove(struct platform_device *ofdev)
        of_node_put(fep->fpi->phy_node);
        if (fep->fpi->clk_per)
                clk_disable_unprepare(fep->fpi->clk_per);
+        if (of_phy_is_fixed_link(ofdev->dev.of_node))
+                of_phy_deregister_fixed_link(ofdev->dev.of_node);
        free_netdev(ndev);
        return 0;
 }
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 4b4f5bc0e279..9061c2f82b9c 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1312,6 +1312,7 @@ static void gfar_init_addr_hash_table(struct gfar_private *priv)
 */
 static int gfar_probe(struct platform_device *ofdev)
 {
+        struct device_node *np = ofdev->dev.of_node;
        struct net_device *dev = NULL;
        struct gfar_private *priv = NULL;
        int err = 0, i;
@@ -1462,6 +1463,8 @@ static int gfar_probe(struct platform_device *ofdev)
        return 0;
 register_fail:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
        unmap_group_regs(priv);
        gfar_free_rx_queues(priv);
        gfar_free_tx_queues(priv);
@@ -1474,11 +1477,16 @@ register_fail:
 static int gfar_remove(struct platform_device *ofdev)
 {
        struct gfar_private *priv = platform_get_drvdata(ofdev);
+        struct device_node *np = ofdev->dev.of_node;
        of_node_put(priv->phy_node);
        of_node_put(priv->tbi_node);
        unregister_netdev(priv->ndev);
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
        unmap_group_regs(priv);
        gfar_free_rx_queues(priv);
        gfar_free_tx_queues(priv);
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index 186ef8f16c80..f76d33279454 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -3868,9 +3868,8 @@ static int ucc_geth_probe(struct platform_device* ofdev)
        dev = alloc_etherdev(sizeof(*ugeth));
        if (dev == NULL) {
-                of_node_put(ug_info->tbi_node);
+                err = -ENOMEM;
-                of_node_put(ug_info->phy_node);
+                goto err_deregister_fixed_link;
-                return -ENOMEM;
        }
        ugeth = netdev_priv(dev);
@@ -3907,10 +3906,7 @@ static int ucc_geth_probe(struct platform_device* ofdev)
                if (netif_msg_probe(ugeth))
                        pr_err("%s: Cannot register net device, aborting\n",
                               dev->name);
-                free_netdev(dev);
+                goto err_free_netdev;
-                of_node_put(ug_info->tbi_node);
-                of_node_put(ug_info->phy_node);
-                return err;
        }
        mac_addr = of_get_mac_address(np);
@@ -3923,16 +3919,29 @@ static int ucc_geth_probe(struct platform_device* ofdev)
        ugeth->node = np;
        return 0;
+err_free_netdev:
+        free_netdev(dev);
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+        of_node_put(ug_info->tbi_node);
+        of_node_put(ug_info->phy_node);
+        return err;
 }
 static int ucc_geth_remove(struct platform_device* ofdev)
 {
        struct net_device *dev = platform_get_drvdata(ofdev);
        struct ucc_geth_private *ugeth = netdev_priv(dev);
+        struct device_node *np = ofdev->dev.of_node;
        unregister_netdev(dev);
        free_netdev(dev);
        ucc_geth_memclean(ugeth);
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
        of_node_put(ugeth->ug_info->tbi_node);
        of_node_put(ugeth->ug_info->phy_node);
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
index c54c6fac0d1d..b6ed818f78ff 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
@@ -332,8 +332,10 @@ struct hnae_handle *hnae_get_handle(struct device *owner_dev,
                return ERR_PTR(-ENODEV);
        handle = dev->ops->get_handle(dev, port_id);
-        if (IS_ERR(handle))
+        if (IS_ERR(handle)) {
+                put_device(&dev->cls_dev);
                return handle;
+        }
        handle->dev = dev;
        handle->owner_dev = owner_dev;
@@ -356,6 +358,8 @@ out_when_init_queue:
        for (j = i - 1; j >= 0; j--)
                hnae_fini_queue(handle->qs[j]);
+        put_device(&dev->cls_dev);
        return ERR_PTR(-ENOMEM);
 }
 EXPORT_SYMBOL(hnae_get_handle);
@@ -377,6 +381,8 @@ void hnae_put_handle(struct hnae_handle *h)
                dev->ops->put_handle(h);
        module_put(dev->owner);
+        put_device(&dev->cls_dev);
 }
 EXPORT_SYMBOL(hnae_put_handle);
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 8d70377f6624..8ea3d95fa483 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -2751,6 +2751,7 @@ static const struct of_device_id g_dsaf_match[] = {
        {.compatible = "hisilicon,hns-dsaf-v2"},
        {}
 };
+MODULE_DEVICE_TABLE(of, g_dsaf_match);
 static struct platform_driver g_dsaf_driver = {
        .probe = hns_dsaf_probe,
diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
index 33f4c483af0f..501eb2090ca6 100644
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -563,6 +563,7 @@ static const struct of_device_id hns_mdio_match[] = {
        {.compatible = "hisilicon,hns-mdio"},
        {}
 };
+MODULE_DEVICE_TABLE(of, hns_mdio_match);
 static const struct acpi_device_id hns_mdio_acpi_match[] = {
        { "HISI0141", 0 },
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 54efa9a5167b..bd719e25dd76 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -2446,6 +2446,8 @@ static int ehea_open(struct net_device *dev)
        netif_info(port, ifup, dev, "enabling port\n");
+        netif_carrier_off(dev);
        ret = ehea_up(dev);
        if (!ret) {
                port_napi_enable(port);
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index ebe60719e489..a36022ba4e42 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -58,7 +58,7 @@ static struct kobj_type ktype_veth_pool;
 static const char ibmveth_driver_name[] = "ibmveth";
 static const char ibmveth_driver_string[] = "IBM Power Virtual Ethernet Driver";
-#define ibmveth_driver_version "1.05"
+#define ibmveth_driver_version "1.06"
 MODULE_AUTHOR("Santiago Leon <santil@linux.vnet.ibm.com>");
 MODULE_DESCRIPTION("IBM Power Virtual Ethernet Driver");
@@ -137,6 +137,11 @@ static inline int ibmveth_rxq_frame_offset(struct ibmveth_adapter *adapter)
        return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_OFF_MASK;
 }
+static inline int ibmveth_rxq_large_packet(struct ibmveth_adapter *adapter)
+{
+        return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_LRG_PKT;
+}
 static inline int ibmveth_rxq_frame_length(struct ibmveth_adapter *adapter)
 {
        return be32_to_cpu(adapter->rx_queue.queue_addr[adapter->rx_queue.index].length);
@@ -1174,6 +1179,45 @@ map_failed:
        goto retry_bounce;
 }
+static void ibmveth_rx_mss_helper(struct sk_buff *skb, u16 mss, int lrg_pkt)
+{
+        int offset = 0;
+        /* only TCP packets will be aggregated */
+        if (skb->protocol == htons(ETH_P_IP)) {
+                struct iphdr *iph = (struct iphdr *)skb->data;
+                if (iph->protocol == IPPROTO_TCP) {
+                        offset = iph->ihl * 4;
+                        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
+                } else {
+                        return;
+                }
+        } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                struct ipv6hdr *iph6 = (struct ipv6hdr *)skb->data;
+                if (iph6->nexthdr == IPPROTO_TCP) {
+                        offset = sizeof(struct ipv6hdr);
+                        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
+                } else {
+                        return;
+                }
+        } else {
+                return;
+        }
+        /* if mss is not set through Large Packet bit/mss in rx buffer,
+         * expect that the mss will be written to the tcp header checksum.
+         */
+        if (lrg_pkt) {
+                skb_shinfo(skb)->gso_size = mss;
+        } else if (offset) {
+                struct tcphdr *tcph = (struct tcphdr *)(skb->data + offset);
+                skb_shinfo(skb)->gso_size = ntohs(tcph->check);
+                tcph->check = 0;
+        }
+}
 static int ibmveth_poll(struct napi_struct *napi, int budget)
 {
        struct ibmveth_adapter *adapter =
@@ -1182,6 +1226,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
        int frames_processed = 0;
        unsigned long lpar_rc;
        struct iphdr *iph;
+        u16 mss = 0;
 restart_poll:
        while (frames_processed < budget) {
@@ -1199,9 +1244,21 @@ restart_poll:
                        int length = ibmveth_rxq_frame_length(adapter);
                        int offset = ibmveth_rxq_frame_offset(adapter);
                        int csum_good = ibmveth_rxq_csum_good(adapter);
+                        int lrg_pkt = ibmveth_rxq_large_packet(adapter);
                        skb = ibmveth_rxq_get_buffer(adapter);
+                        /* if the large packet bit is set in the rx queue
+                         * descriptor, the mss will be written by PHYP eight
+                         * bytes from the start of the rx buffer, which is
+                         * skb->data at this stage
+                         */
+                        if (lrg_pkt) {
+                                __be64 *rxmss = (__be64 *)(skb->data + 8);
+                                mss = (u16)be64_to_cpu(*rxmss);
+                        }
                        new_skb = NULL;
                        if (length < rx_copybreak)
                                new_skb = netdev_alloc_skb(netdev, length);
@@ -1235,11 +1292,15 @@ restart_poll:
                                        if (iph->check == 0xffff) {
                                                iph->check = 0;
                                                iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
-                                                adapter->rx_large_packets++;
                                        }
                                }
                        }
+                        if (length > netdev->mtu + ETH_HLEN) {
+                                ibmveth_rx_mss_helper(skb, mss, lrg_pkt);
+                                adapter->rx_large_packets++;
+                        }
                        napi_gro_receive(napi, skb);    /* send it up */
                        netdev->stats.rx_packets++;
diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h
index 4eade67fe30c..7acda04d034e 100644
--- a/drivers/net/ethernet/ibm/ibmveth.h
+++ b/drivers/net/ethernet/ibm/ibmveth.h
@@ -209,6 +209,7 @@ struct ibmveth_rx_q_entry {
 #define IBMVETH_RXQ_TOGGLE              0x80000000
 #define IBMVETH_RXQ_TOGGLE_SHIFT        31
 #define IBMVETH_RXQ_VALID               0x40000000
+#define IBMVETH_RXQ_LRG_PKT             0x04000000
 #define IBMVETH_RXQ_NO_CSUM             0x02000000
 #define IBMVETH_RXQ_CSUM_GOOD           0x01000000
 #define IBMVETH_RXQ_OFF_MASK            0x0000FFFF
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index bfe17d9c022d..0fbf686f5e7c 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -74,7 +74,6 @@
 #include <asm/iommu.h>
 #include <linux/uaccess.h>
 #include <asm/firmware.h>
-#include <linux/seq_file.h>
 #include <linux/workqueue.h>
 #include "ibmvnic.h"
@@ -1190,7 +1189,7 @@ static struct ibmvnic_sub_crq_queue *init_sub_crq_queue(struct ibmvnic_adapter
        if (!scrq)
                return NULL;
-        scrq->msgs = (union sub_crq *)__get_free_pages(GFP_KERNEL, 2);
+        scrq->msgs = (union sub_crq *)__get_free_pages(GFP_ATOMIC, 2);
        memset(scrq->msgs, 0, 4 * PAGE_SIZE);
        if (!scrq->msgs) {
                dev_warn(dev, "Couldn't allocate crq queue messages page\n");
@@ -1461,14 +1460,16 @@ static int init_sub_crq_irqs(struct ibmvnic_adapter *adapter)
        return rc;
 req_rx_irq_failed:
-        for (j = 0; j < i; j++)
+        for (j = 0; j < i; j++) {
                free_irq(adapter->rx_scrq[j]->irq, adapter->rx_scrq[j]);
                irq_dispose_mapping(adapter->rx_scrq[j]->irq);
+        }
        i = adapter->req_tx_queues;
 req_tx_irq_failed:
-        for (j = 0; j < i; j++)
+        for (j = 0; j < i; j++) {
                free_irq(adapter->tx_scrq[j]->irq, adapter->tx_scrq[j]);
                irq_dispose_mapping(adapter->rx_scrq[j]->irq);
+        }
        release_sub_crqs_no_irqs(adapter);
        return rc;
 }
@@ -1503,9 +1504,8 @@ static void init_sub_crqs(struct ibmvnic_adapter *adapter, int retry)
                    adapter->max_rx_add_entries_per_subcrq > entries_page ?
                    entries_page : adapter->max_rx_add_entries_per_subcrq;
-                /* Choosing the maximum number of queues supported by firmware*/
+                adapter->req_tx_queues = adapter->opt_tx_comp_sub_queues;
-                adapter->req_tx_queues = adapter->max_tx_queues;
+                adapter->req_rx_queues = adapter->opt_rx_comp_queues;
-                adapter->req_rx_queues = adapter->max_rx_queues;
                adapter->req_rx_add_queues = adapter->max_rx_add_queues;
                adapter->req_mtu = adapter->max_mtu;
@@ -3232,6 +3232,27 @@ static void ibmvnic_free_inflight(struct ibmvnic_adapter *adapter)
        spin_unlock_irqrestore(&adapter->inflight_lock, flags);
 }
+static void ibmvnic_xport_event(struct work_struct *work)
+{
+        struct ibmvnic_adapter *adapter = container_of(work,
+                                                       struct ibmvnic_adapter,
+                                                       ibmvnic_xport);
+        struct device *dev = &adapter->vdev->dev;
+        long rc;
+        ibmvnic_free_inflight(adapter);
+        release_sub_crqs(adapter);
+        if (adapter->migrated) {
+                rc = ibmvnic_reenable_crq_queue(adapter);
+                if (rc)
+                        dev_err(dev, "Error after enable rc=%ld\n", rc);
+                adapter->migrated = false;
+                rc = ibmvnic_send_crq_init(adapter);
+                if (rc)
+                        dev_err(dev, "Error sending init rc=%ld\n", rc);
+        }
+}
 static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
                               struct ibmvnic_adapter *adapter)
 {
@@ -3267,15 +3288,7 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
                if (gen_crq->cmd == IBMVNIC_PARTITION_MIGRATED) {
                        dev_info(dev, "Re-enabling adapter\n");
                        adapter->migrated = true;
-                        ibmvnic_free_inflight(adapter);
+                        schedule_work(&adapter->ibmvnic_xport);
-                        release_sub_crqs(adapter);
-                        rc = ibmvnic_reenable_crq_queue(adapter);
-                        if (rc)
-                                dev_err(dev, "Error after enable rc=%ld\n", rc);
-                        adapter->migrated = false;
-                        rc = ibmvnic_send_crq_init(adapter);
-                        if (rc)
-                                dev_err(dev, "Error sending init rc=%ld\n", rc);
                } else if (gen_crq->cmd == IBMVNIC_DEVICE_FAILOVER) {
                        dev_info(dev, "Backing device failover detected\n");
                        netif_carrier_off(netdev);
@@ -3284,8 +3297,7 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
                        /* The adapter lost the connection */
                        dev_err(dev, "Virtual Adapter failed (rc=%d)\n",
                                gen_crq->cmd);
-                        ibmvnic_free_inflight(adapter);
+                        schedule_work(&adapter->ibmvnic_xport);
-                        release_sub_crqs(adapter);
                }
                return;
        case IBMVNIC_CRQ_CMD_RSP:
@@ -3654,6 +3666,7 @@ static void handle_crq_init_rsp(struct work_struct *work)
                goto task_failed;
        netdev->real_num_tx_queues = adapter->req_tx_queues;
+        netdev->mtu = adapter->req_mtu;
        if (adapter->failover) {
                adapter->failover = false;
@@ -3691,7 +3704,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
        struct net_device *netdev;
        unsigned char *mac_addr_p;
        struct dentry *ent;
-        char buf[16]; /* debugfs name buf */
+        char buf[17]; /* debugfs name buf */
        int rc;
        dev_dbg(&dev->dev, "entering ibmvnic_probe for UA 0x%x\n",
@@ -3725,6 +3738,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
        SET_NETDEV_DEV(netdev, &dev->dev);
        INIT_WORK(&adapter->vnic_crq_init, handle_crq_init_rsp);
+        INIT_WORK(&adapter->ibmvnic_xport, ibmvnic_xport_event);
        spin_lock_init(&adapter->stats_lock);
@@ -3792,6 +3806,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
        }
        netdev->real_num_tx_queues = adapter->req_tx_queues;
+        netdev->mtu = adapter->req_mtu;
        rc = register_netdev(netdev);
        if (rc) {
@@ -3828,6 +3843,9 @@ static int ibmvnic_remove(struct vio_dev *dev)
        if (adapter->debugfs_dir && !IS_ERR(adapter->debugfs_dir))
                debugfs_remove_recursive(adapter->debugfs_dir);
+        dma_unmap_single(&dev->dev, adapter->stats_token,
+                         sizeof(struct ibmvnic_statistics), DMA_FROM_DEVICE);
        if (adapter->ras_comps)
                dma_free_coherent(&dev->dev,
                                  adapter->ras_comp_num *
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index bfc84c7d0e11..dd775d951b73 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -27,7 +27,7 @@
 /**************************************************************************/
 #define IBMVNIC_NAME            "ibmvnic"
-#define IBMVNIC_DRIVER_VERSION  "1.0"
+#define IBMVNIC_DRIVER_VERSION  "1.0.1"
 #define IBMVNIC_INVALID_MAP     -1
 #define IBMVNIC_STATS_TIMEOUT   1
 /* basic structures plus 100 2k buffers */
@@ -1048,5 +1048,6 @@ struct ibmvnic_adapter {
        u8 map_id;
        struct work_struct vnic_crq_init;
+        struct work_struct ibmvnic_xport;
        bool failover;
 };
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index 2030d7c1dc94..6d61e443bdf8 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -92,6 +92,7 @@
 #define I40E_AQ_LEN                     256
 #define I40E_AQ_WORK_LIMIT              66 /* max number of VFs + a little */
 #define I40E_MAX_USER_PRIORITY          8
+#define I40E_DEFAULT_TRAFFIC_CLASS      BIT(0)
 #define I40E_DEFAULT_MSG_ENABLE         4
 #define I40E_QUEUE_WAIT_RETRY_LIMIT     10
 #define I40E_INT_NAME_STR_LEN           (IFNAMSIZ + 16)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index ac1faee2a5b8..31c97e3937a4 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -4641,29 +4641,6 @@ static u8 i40e_pf_get_num_tc(struct i40e_pf *pf)
 }
 /**
- * i40e_pf_get_default_tc - Get bitmap for first enabled TC
- * @pf: PF being queried
- *
- * Return a bitmap for first enabled traffic class for this PF.
- **/
-static u8 i40e_pf_get_default_tc(struct i40e_pf *pf)
-{
-        u8 enabled_tc = pf->hw.func_caps.enabled_tcmap;
-        u8 i = 0;
-        if (!enabled_tc)
-                return 0x1; /* TC0 */
-        /* Find the first enabled TC */
-        for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) {
-                if (enabled_tc & BIT(i))
-                        break;
-        }
-        return BIT(i);
-}
-/**
 * i40e_pf_get_pf_tc_map - Get bitmap for enabled traffic classes
 * @pf: PF being queried
 *
@@ -4673,7 +4650,7 @@ static u8 i40e_pf_get_tc_map(struct i40e_pf *pf)
 {
        /* If DCB is not enabled for this PF then just return default TC */
        if (!(pf->flags & I40E_FLAG_DCB_ENABLED))
-                return i40e_pf_get_default_tc(pf);
+                return I40E_DEFAULT_TRAFFIC_CLASS;
        /* SFP mode we want PF to be enabled for all TCs */
        if (!(pf->flags & I40E_FLAG_MFP_ENABLED))
@@ -4683,7 +4660,7 @@ static u8 i40e_pf_get_tc_map(struct i40e_pf *pf)
        if (pf->hw.func_caps.iscsi)
                return i40e_get_iscsi_tc_map(pf);
        else
-                return i40e_pf_get_default_tc(pf);
+                return I40E_DEFAULT_TRAFFIC_CLASS;
 }
 /**
@@ -5029,7 +5006,7 @@ static void i40e_dcb_reconfigure(struct i40e_pf *pf)
                if (v == pf->lan_vsi)
                        tc_map = i40e_pf_get_tc_map(pf);
                else
-                        tc_map = i40e_pf_get_default_tc(pf);
+                        tc_map = I40E_DEFAULT_TRAFFIC_CLASS;
 #ifdef I40E_FCOE
                if (pf->vsi[v]->type == I40E_VSI_FCOE)
                        tc_map = i40e_get_fcoe_tc_map(pf);
@@ -5717,7 +5694,7 @@ static int i40e_handle_lldp_event(struct i40e_pf *pf,
        u8 type;
        /* Not DCB capable or capability disabled */
-        if (!(pf->flags & I40E_FLAG_DCB_ENABLED))
+        if (!(pf->flags & I40E_FLAG_DCB_CAPABLE))
                return ret;
        /* Ignore if event is not for Nearest Bridge */
@@ -7707,6 +7684,7 @@ static int i40e_init_msix(struct i40e_pf *pf)
                pf->flags &= ~I40E_FLAG_MSIX_ENABLED;
                kfree(pf->msix_entries);
                pf->msix_entries = NULL;
+                pci_disable_msix(pf->pdev);
                return -ENODEV;
        } else if (v_actual == I40E_MIN_MSIX) {
@@ -9056,7 +9034,7 @@ static int i40e_ndo_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,
                return 0;
        return ndo_dflt_bridge_getlink(skb, pid, seq, dev, veb->bridge_mode,
-                                       nlflags, 0, 0, filter_mask, NULL);
+                                       0, 0, nlflags, filter_mask, NULL);
 }
 /* Hardware supports L4 tunnel length of 128B (=2^7) which includes
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index edc9a6ac5169..9affd7c198bd 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -4931,11 +4931,15 @@ static int igb_tso(struct igb_ring *tx_ring,
        /* initialize outer IP header fields */
        if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
                /* IP header will have to cancel out any data that
                 * is not a part of the outer IP header
                 */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
+                ip.v4->check = csum_fold(csum_partial(trans_start,
-                                                  csum_unfold(l4.tcp->check)));
+                                                      csum_start - trans_start,
+                                                      0));
                type_tucmd |= E1000_ADVTXD_TUCMD_IPV4;
                ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index 12bb877df860..7dff7f6239cd 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -1965,11 +1965,15 @@ static int igbvf_tso(struct igbvf_ring *tx_ring,
        /* initialize outer IP header fields */
        if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
                /* IP header will have to cancel out any data that
                 * is not a part of the outer IP header
                 */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
+                ip.v4->check = csum_fold(csum_partial(trans_start,
-                                                  csum_unfold(l4.tcp->check)));
+                                                      csum_start - trans_start,
+                                                      0));
                type_tucmd |= E1000_ADVTXD_TUCMD_IPV4;
                ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index a244d9a67264..fee1f2918ead 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -7277,11 +7277,15 @@ static int ixgbe_tso(struct ixgbe_ring *tx_ring,
        /* initialize outer IP header fields */
        if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
                /* IP header will have to cancel out any data that
                 * is not a part of the outer IP header
                 */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
+                ip.v4->check = csum_fold(csum_partial(trans_start,
-                                                  csum_unfold(l4.tcp->check)));
+                                                      csum_start - trans_start,
+                                                      0));
                type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
                ip.v4->tot_len = 0;
@@ -9135,10 +9139,14 @@ static void *ixgbe_fwd_add(struct net_device *pdev, struct net_device *vdev)
                goto fwd_add_err;
        fwd_adapter->pool = pool;
        fwd_adapter->real_adapter = adapter;
-        err = ixgbe_fwd_ring_up(vdev, fwd_adapter);
-        if (err)
+        if (netif_running(pdev)) {
-                goto fwd_add_err;
+                err = ixgbe_fwd_ring_up(vdev, fwd_adapter);
-        netif_tx_start_all_queues(vdev);
+                if (err)
+                        goto fwd_add_err;
+                netif_tx_start_all_queues(vdev);
+        }
        return fwd_adapter;
 fwd_add_err:
        /* unwind counter and free adapter struct */
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 7eaac3234049..cbf70fe4028a 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -3329,11 +3329,15 @@ static int ixgbevf_tso(struct ixgbevf_ring *tx_ring,
        /* initialize outer IP header fields */
        if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
                /* IP header will have to cancel out any data that
                 * is not a part of the outer IP header
                 */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
+                ip.v4->check = csum_fold(csum_partial(trans_start,
-                                                  csum_unfold(l4.tcp->check)));
+                                                      csum_start - trans_start,
+                                                      0));
                type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
                ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 91e09d68b7e2..a167fd7ee13e 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -704,6 +704,7 @@ ltq_etop_probe(struct platform_device *pdev)
        priv->pldata = dev_get_platdata(&pdev->dev);
        priv->netdev = dev;
        spin_lock_init(&priv->lock);
+        SET_NETDEV_DEV(dev, &pdev->dev);
        for (i = 0; i < MAX_DMA_CHAN; i++) {
                if (IS_TX(i))
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 55831188bc32..5b12022adf1f 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1381,6 +1381,7 @@ static unsigned int get_rx_coal(struct mv643xx_eth_private *mp)
                temp = (val & 0x003fff00) >> 8;
        temp *= 64000000;
+        temp += mp->t_clk / 2;
        do_div(temp, mp->t_clk);
        return (unsigned int)temp;
@@ -1417,6 +1418,7 @@ static unsigned int get_tx_coal(struct mv643xx_eth_private *mp)
        temp = (rdlp(mp, TX_FIFO_URGENT_THRESHOLD) & 0x3fff0) >> 4;
        temp *= 64000000;
+        temp += mp->t_clk / 2;
        do_div(temp, mp->t_clk);
        return (unsigned int)temp;
@@ -2968,6 +2970,22 @@ static void set_params(struct mv643xx_eth_private *mp,
        mp->txq_count = pd->tx_queue_count ? : 1;
 }
+static int get_phy_mode(struct mv643xx_eth_private *mp)
+{
+        struct device *dev = mp->dev->dev.parent;
+        int iface = -1;
+        if (dev->of_node)
+                iface = of_get_phy_mode(dev->of_node);
+        /* Historical default if unspecified. We could also read/write
+         * the interface state in the PSC1
+         */
+        if (iface < 0)
+                iface = PHY_INTERFACE_MODE_GMII;
+        return iface;
+}
 static struct phy_device *phy_scan(struct mv643xx_eth_private *mp,
                                   int phy_addr)
 {
@@ -2994,7 +3012,7 @@ static struct phy_device *phy_scan(struct mv643xx_eth_private *mp,
                                "orion-mdio-mii", addr);
                phydev = phy_connect(mp->dev, phy_id, mv643xx_eth_adjust_link,
-                                PHY_INTERFACE_MODE_GMII);
+                                     get_phy_mode(mp));
                if (!IS_ERR(phydev)) {
                        phy_addr_set(mp, addr);
                        break;
@@ -3090,6 +3108,7 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
        if (!dev)
                return -ENOMEM;
+        SET_NETDEV_DEV(dev, &pdev->dev);
        mp = netdev_priv(dev);
        platform_set_drvdata(pdev, mp);
@@ -3129,7 +3148,7 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
        if (pd->phy_node) {
                mp->phy = of_phy_connect(mp->dev, pd->phy_node,
                                         mv643xx_eth_adjust_link, 0,
-                                         PHY_INTERFACE_MODE_GMII);
+                                         get_phy_mode(mp));
                if (!mp->phy)
                        err = -ENODEV;
                else
@@ -3187,8 +3206,6 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
        dev->priv_flags |= IFF_UNICAST_FLT;
        dev->gso_max_segs = MV643XX_MAX_TSO_SEGS;
-        SET_NETDEV_DEV(dev, &pdev->dev);
        if (mp->shared->win_protect)
                wrl(mp, WINDOW_PROTECT(mp->port_num), mp->shared->win_protect);
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 5cb07c2017bf..707bc4680b9b 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -4151,7 +4151,7 @@ static int mvneta_probe(struct platform_device *pdev)
        dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
        dev->hw_features |= dev->features;
        dev->vlan_features |= dev->features;
-        dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE;
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
        dev->gso_max_segs = MVNETA_MAX_TSO_SEGS;
        err = register_netdev(dev);
@@ -4191,6 +4191,8 @@ err_clk:
        clk_disable_unprepare(pp->clk);
 err_put_phy_node:
        of_node_put(phy_node);
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
 err_free_irq:
        irq_dispose_mapping(dev->irq);
 err_free_netdev:
@@ -4202,6 +4204,7 @@ err_free_netdev:
 static int mvneta_remove(struct platform_device *pdev)
 {
        struct net_device  *dev = platform_get_drvdata(pdev);
+        struct device_node *dn = pdev->dev.of_node;
        struct mvneta_port *pp = netdev_priv(dev);
        unregister_netdev(dev);
@@ -4209,6 +4212,8 @@ static int mvneta_remove(struct platform_device *pdev)
        clk_disable_unprepare(pp->clk);
        free_percpu(pp->ports);
        free_percpu(pp->stats);
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
        irq_dispose_mapping(dev->irq);
        of_node_put(pp->phy_node);
        free_netdev(dev);
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 60227a3452a4..1026c452e39d 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -3293,7 +3293,7 @@ static void mvpp2_cls_init(struct mvpp2 *priv)
        mvpp2_write(priv, MVPP2_CLS_MODE_REG, MVPP2_CLS_MODE_ACTIVE_MASK);
        /* Clear classifier flow table */
-        memset(&fe.data, 0, MVPP2_CLS_FLOWS_TBL_DATA_WORDS);
+        memset(&fe.data, 0, sizeof(fe.data));
        for (index = 0; index < MVPP2_CLS_FLOWS_TBL_SIZE; index++) {
                fe.index = index;
                mvpp2_cls_flow_write(priv, &fe);
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index f05ea56dcff2..941c8e2c944e 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -5220,6 +5220,19 @@ static SIMPLE_DEV_PM_OPS(sky2_pm_ops, sky2_suspend, sky2_resume);
 static void sky2_shutdown(struct pci_dev *pdev)
 {
+        struct sky2_hw *hw = pci_get_drvdata(pdev);
+        int port;
+        for (port = 0; port < hw->ports; port++) {
+                struct net_device *ndev = hw->dev[port];
+                rtnl_lock();
+                if (netif_running(ndev)) {
+                        dev_close(ndev);
+                        netif_device_detach(ndev);
+                }
+                rtnl_unlock();
+        }
        sky2_suspend(&pdev->dev);
        pci_wake_from_d3(pdev, device_may_wakeup(&pdev->dev));
        pci_set_power_state(pdev, PCI_D3hot);
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 4a62ffd7729d..86a89cbd3ec9 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -318,6 +318,8 @@ static int mtk_phy_connect(struct net_device *dev)
        return 0;
 err_phy:
+        if (of_phy_is_fixed_link(mac->of_node))
+                of_phy_deregister_fixed_link(mac->of_node);
        of_node_put(np);
        dev_err(eth->dev, "%s: invalid phy\n", __func__);
        return -EINVAL;
@@ -1923,6 +1925,8 @@ static void mtk_uninit(struct net_device *dev)
        struct mtk_eth *eth = mac->hw;
        phy_disconnect(dev->phydev);
+        if (of_phy_is_fixed_link(mac->of_node))
+                of_phy_deregister_fixed_link(mac->of_node);
        mtk_irq_disable(eth, MTK_QDMA_INT_MASK, ~0);
        mtk_irq_disable(eth, MTK_PDMA_INT_MASK, ~0);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index b1cef7a0f7ca..e36bebcab3f2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2469,6 +2469,7 @@ err_comm_admin:
        kfree(priv->mfunc.master.slave_state);
 err_comm:
        iounmap(priv->mfunc.comm);
+        priv->mfunc.comm = NULL;
 err_vhcr:
        dma_free_coherent(&dev->persist->pdev->dev, PAGE_SIZE,
                          priv->mfunc.vhcr,
@@ -2537,6 +2538,13 @@ void mlx4_report_internal_err_comm_event(struct mlx4_dev *dev)
        int slave;
        u32 slave_read;
+        /* If the comm channel has not yet been initialized,
+         * skip reporting the internal error event to all
+         * the communication channels.
+         */
+        if (!priv->mfunc.comm)
+                return;
        /* Report an internal error event to all
         * communication channels.
         */
@@ -2571,6 +2579,7 @@ void mlx4_multi_func_cleanup(struct mlx4_dev *dev)
        }
        iounmap(priv->mfunc.comm);
+        priv->mfunc.comm = NULL;
 }
 void mlx4_cmd_cleanup(struct mlx4_dev *dev, int cleanup_mask)
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
index 08fc5fc56d43..a5fc46bbcbe2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
@@ -245,8 +245,11 @@ static u32 freq_to_shift(u16 freq)
 {
        u32 freq_khz = freq * 1000;
        u64 max_val_cycles = freq_khz * 1000 * MLX4_EN_WRAP_AROUND_SEC;
+        u64 tmp_rounded =
+                roundup_pow_of_two(max_val_cycles) > max_val_cycles ?
+                roundup_pow_of_two(max_val_cycles) - 1 : UINT_MAX;
        u64 max_val_cycles_rounded = is_power_of_2(max_val_cycles + 1) ?
-                max_val_cycles : roundup_pow_of_two(max_val_cycles) - 1;
+                max_val_cycles : tmp_rounded;
        /* calculate max possible multiplier in order to fit in 64bit */
        u64 max_mul = div_u64(0xffffffffffffffffULL, max_val_cycles_rounded);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
index 132cea655920..e3be7e44ff51 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
@@ -127,7 +127,15 @@ int mlx4_en_activate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq,
                /* For TX we use the same irq per
                ring we assigned for the RX    */
                struct mlx4_en_cq *rx_cq;
+                int xdp_index;
+                /* The xdp tx irq must align with the rx ring that forwards to
+                 * it, so reindex these from 0. This should only happen when
+                 * tx_ring_num is not a multiple of rx_ring_num.
+                 */
+                xdp_index = (priv->xdp_ring_num - priv->tx_ring_num) + cq_idx;
+                if (xdp_index >= 0)
+                        cq_idx = xdp_index;
                cq_idx = cq_idx % priv->rx_ring_num;
                rx_cq = priv->rx_cq[cq_idx];
                cq->vector = rx_cq->vector;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 7e703bed7b82..fb8bb027b69c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -129,6 +129,9 @@ static enum mlx4_net_trans_rule_id mlx4_ip_proto_to_trans_rule_id(u8 ip_proto)
        }
 };
+/* Must not acquire state_lock, as its corresponding work_sync
+ * is done under it.
+ */
 static void mlx4_en_filter_work(struct work_struct *work)
 {
        struct mlx4_en_filter *filter = container_of(work,
@@ -1733,6 +1736,13 @@ int mlx4_en_start_port(struct net_device *dev)
                udp_tunnel_get_rx_info(dev);
        priv->port_up = true;
+        /* Process all completions if exist to prevent
+         * the queues freezing if they are full
+         */
+        for (i = 0; i < priv->rx_ring_num; i++)
+                napi_schedule(&priv->rx_cq[i]->napi);
        netif_tx_start_all_queues(dev);
        netif_device_attach(dev);
@@ -1910,8 +1920,9 @@ static void mlx4_en_clear_stats(struct net_device *dev)
        struct mlx4_en_dev *mdev = priv->mdev;
        int i;
-        if (mlx4_en_DUMP_ETH_STATS(mdev, priv->port, 1))
+        if (!mlx4_is_slave(mdev->dev))
-                en_dbg(HW, priv, "Failed dumping statistics\n");
+                if (mlx4_en_DUMP_ETH_STATS(mdev, priv->port, 1))
+                        en_dbg(HW, priv, "Failed dumping statistics\n");
        memset(&priv->pstats, 0, sizeof(priv->pstats));
        memset(&priv->pkstats, 0, sizeof(priv->pkstats));
@@ -2068,13 +2079,6 @@ err:
        return -ENOMEM;
 }
-static void mlx4_en_shutdown(struct net_device *dev)
-{
-        rtnl_lock();
-        netif_device_detach(dev);
-        mlx4_en_close(dev);
-        rtnl_unlock();
-}
 static int mlx4_en_copy_priv(struct mlx4_en_priv *dst,
                             struct mlx4_en_priv *src,
@@ -2151,8 +2155,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
 {
        struct mlx4_en_priv *priv = netdev_priv(dev);
        struct mlx4_en_dev *mdev = priv->mdev;
-        bool shutdown = mdev->dev->persist->interface_state &
-                                            MLX4_INTERFACE_STATE_SHUTDOWN;
        en_dbg(DRV, priv, "Destroying netdev on port:%d\n", priv->port);
@@ -2160,10 +2162,7 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
        if (priv->registered) {
                devlink_port_type_clear(mlx4_get_devlink_port(mdev->dev,
                                                              priv->port));
-                if (shutdown)
+                unregister_netdev(dev);
-                        mlx4_en_shutdown(dev);
-                else
-                        unregister_netdev(dev);
        }
        if (priv->allocated)
@@ -2181,19 +2180,18 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
        mutex_lock(&mdev->state_lock);
        mdev->pndev[priv->port] = NULL;
        mdev->upper[priv->port] = NULL;
-        mutex_unlock(&mdev->state_lock);
 #ifdef CONFIG_RFS_ACCEL
        mlx4_en_cleanup_filters(priv);
 #endif
        mlx4_en_free_resources(priv);
+        mutex_unlock(&mdev->state_lock);
        kfree(priv->tx_ring);
        kfree(priv->tx_cq);
-        if (!shutdown)
+        free_netdev(dev);
-                free_netdev(dev);
 }
 static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_port.c b/drivers/net/ethernet/mellanox/mlx4/en_port.c
index 5aa8b751f417..59473a0ebcdf 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_port.c
@@ -166,7 +166,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
                return PTR_ERR(mailbox);
        err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma, in_mod, 0,
                           MLX4_CMD_DUMP_ETH_STATS, MLX4_CMD_TIME_CLASS_B,
-                           MLX4_CMD_WRAPPED);
+                           MLX4_CMD_NATIVE);
        if (err)
                goto out;
@@ -322,7 +322,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
                err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma,
                                   in_mod | MLX4_DUMP_ETH_STATS_FLOW_CONTROL,
                                   0, MLX4_CMD_DUMP_ETH_STATS,
-                                   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_WRAPPED);
+                                   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
                if (err)
                        goto out;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
index b66e03d9711f..c06346a82496 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
@@ -118,6 +118,29 @@ mlx4_en_test_loopback_exit:
        return !loopback_ok;
 }
+static int mlx4_en_test_interrupts(struct mlx4_en_priv *priv)
+{
+        struct mlx4_en_dev *mdev = priv->mdev;
+        int err = 0;
+        int i = 0;
+        err = mlx4_test_async(mdev->dev);
+        /* When not in MSI_X or slave, test only async */
+        if (!(mdev->dev->flags & MLX4_FLAG_MSI_X) || mlx4_is_slave(mdev->dev))
+                return err;
+        /* A loop over all completion vectors of current port,
+         * for each vector check whether it works by mapping command
+         * completions to that vector and performing a NOP command
+         */
+        for (i = 0; i < priv->rx_ring_num; i++) {
+                err = mlx4_test_interrupt(mdev->dev, priv->rx_cq[i]->vector);
+                if (err)
+                        break;
+        }
+        return err;
+}
 static int mlx4_en_test_link(struct mlx4_en_priv *priv)
 {
@@ -151,7 +174,6 @@ static int mlx4_en_test_speed(struct mlx4_en_priv *priv)
 void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
 {
        struct mlx4_en_priv *priv = netdev_priv(dev);
-        struct mlx4_en_dev *mdev = priv->mdev;
        int i, carrier_ok;
        memset(buf, 0, sizeof(u64) * MLX4_EN_NUM_SELF_TEST);
@@ -177,7 +199,7 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
                        netif_carrier_on(dev);
        }
-        buf[0] = mlx4_test_interrupts(mdev->dev);
+        buf[0] = mlx4_en_test_interrupts(priv);
        buf[1] = mlx4_en_test_link(priv);
        buf[2] = mlx4_en_test_speed(priv);
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index cf8f8a72a801..cd3638e6fe25 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1361,53 +1361,49 @@ void mlx4_cleanup_eq_table(struct mlx4_dev *dev)
        kfree(priv->eq_table.uar_map);
 }
-/* A test that verifies that we can accept interrupts on all
+/* A test that verifies that we can accept interrupts
- * the irq vectors of the device.
+ * on the vector allocated for asynchronous events
+ */
+int mlx4_test_async(struct mlx4_dev *dev)
+{
+        return mlx4_NOP(dev);
+}
+EXPORT_SYMBOL(mlx4_test_async);
+/* A test that verifies that we can accept interrupts
+ * on the given irq vector of the tested port.
 * Interrupts are checked using the NOP command.
 */
-int mlx4_test_interrupts(struct mlx4_dev *dev)
+int mlx4_test_interrupt(struct mlx4_dev *dev, int vector)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
-        int i;
        int err;
-        err = mlx4_NOP(dev);
+        /* Temporary use polling for command completions */
-        /* When not in MSI_X, there is only one irq to check */
+        mlx4_cmd_use_polling(dev);
-        if (!(dev->flags & MLX4_FLAG_MSI_X) || mlx4_is_slave(dev))
-                return err;
-        /* A loop over all completion vectors, for each vector we will check
-         * whether it works by mapping command completions to that vector
-         * and performing a NOP command
-         */
-        for(i = 0; !err && (i < dev->caps.num_comp_vectors); ++i) {
-                /* Make sure request_irq was called */
-                if (!priv->eq_table.eq[i].have_irq)
-                        continue;
-                /* Temporary use polling for command completions */
-                mlx4_cmd_use_polling(dev);
-                /* Map the new eq to handle all asynchronous events */
-                err = mlx4_MAP_EQ(dev, get_async_ev_mask(dev), 0,
-                                  priv->eq_table.eq[i].eqn);
-                if (err) {
-                        mlx4_warn(dev, "Failed mapping eq for interrupt test\n");
-                        mlx4_cmd_use_events(dev);
-                        break;
-                }
-                /* Go back to using events */
+        /* Map the new eq to handle all asynchronous events */
-                mlx4_cmd_use_events(dev);
+        err = mlx4_MAP_EQ(dev, get_async_ev_mask(dev), 0,
-                err = mlx4_NOP(dev);
+                          priv->eq_table.eq[MLX4_CQ_TO_EQ_VECTOR(vector)].eqn);
+        if (err) {
+                mlx4_warn(dev, "Failed mapping eq for interrupt test\n");
+                goto out;
        }
+        /* Go back to using events */
+        mlx4_cmd_use_events(dev);
+        err = mlx4_NOP(dev);
        /* Return to default */
+        mlx4_cmd_use_polling(dev);
+out:
        mlx4_MAP_EQ(dev, get_async_ev_mask(dev), 0,
                    priv->eq_table.eq[MLX4_EQ_ASYNC].eqn);
+        mlx4_cmd_use_events(dev);
        return err;
 }
-EXPORT_SYMBOL(mlx4_test_interrupts);
+EXPORT_SYMBOL(mlx4_test_interrupt);
 bool mlx4_is_eq_vector_valid(struct mlx4_dev *dev, u8 port, int vector)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index c41ab31a39f8..84bab9f0732e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -49,9 +49,9 @@ enum {
 extern void __buggy_use_of_MLX4_GET(void);
 extern void __buggy_use_of_MLX4_PUT(void);
-static bool enable_qos = true;
+static bool enable_qos;
 module_param(enable_qos, bool, 0444);
-MODULE_PARM_DESC(enable_qos, "Enable Enhanced QoS support (default: on)");
+MODULE_PARM_DESC(enable_qos, "Enable Enhanced QoS support (default: off)");
 #define MLX4_GET(dest, source, offset)                                \
        do {                                                          \
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 7183ac4135d2..75d07fa9d0b1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1102,6 +1102,14 @@ static int __set_port_type(struct mlx4_port_info *info,
        int i;
        int err = 0;
+        if ((port_type & mdev->caps.supported_type[info->port]) != port_type) {
+                mlx4_err(mdev,
+                         "Requested port type for port %d is not supported on this HCA\n",
+                         info->port);
+                err = -EINVAL;
+                goto err_sup;
+        }
        mlx4_stop_sense(mdev);
        mutex_lock(&priv->port_mutex);
        info->tmp_type = port_type;
@@ -1147,7 +1155,7 @@ static int __set_port_type(struct mlx4_port_info *info,
 out:
        mlx4_start_sense(mdev);
        mutex_unlock(&priv->port_mutex);
+err_sup:
        return err;
 }
@@ -4139,11 +4147,8 @@ static void mlx4_shutdown(struct pci_dev *pdev)
        mlx4_info(persist->dev, "mlx4_shutdown was called\n");
        mutex_lock(&persist->interface_state_mutex);
-        if (persist->interface_state & MLX4_INTERFACE_STATE_UP) {
+        if (persist->interface_state & MLX4_INTERFACE_STATE_UP)
-                /* Notify mlx4 clients that the kernel is being shut down */
-                persist->interface_state |= MLX4_INTERFACE_STATE_SHUTDOWN;
                mlx4_unload_one(pdev);
-        }
        mutex_unlock(&persist->interface_state_mutex);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index 94b891c118c1..1a670b681555 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -1457,7 +1457,12 @@ EXPORT_SYMBOL_GPL(mlx4_multicast_detach);
 int mlx4_flow_steer_promisc_add(struct mlx4_dev *dev, u8 port,
                                u32 qpn, enum mlx4_net_trans_promisc_mode mode)
 {
-        struct mlx4_net_trans_rule rule;
+        struct mlx4_net_trans_rule rule = {
+                .queue_mode = MLX4_NET_TRANS_Q_FIFO,
+                .exclusive = 0,
+                .allow_loopback = 1,
+        };
        u64 *regid_p;
        switch (mode) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index e4878f31e45d..88ee7d8a5923 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -145,9 +145,10 @@ enum mlx4_resource {
        RES_MTT,
        RES_MAC,
        RES_VLAN,
-        RES_EQ,
+        RES_NPORT_ID,
        RES_COUNTER,
        RES_FS_RULE,
+        RES_EQ,
        MLX4_NUM_OF_RESOURCE_TYPE
 };
@@ -1329,8 +1330,6 @@ int mlx4_SET_VLAN_FLTR_wrapper(struct mlx4_dev *dev, int slave,
                               struct mlx4_cmd_info *cmd);
 int mlx4_common_set_vlan_fltr(struct mlx4_dev *dev, int function,
                                     int port, void *buf);
-int mlx4_common_dump_eth_stats(struct mlx4_dev *dev, int slave, u32 in_mod,
-                                struct mlx4_cmd_mailbox *outbox);
 int mlx4_DUMP_ETH_STATS_wrapper(struct mlx4_dev *dev, int slave,
                                   struct mlx4_vhcr *vhcr,
                                   struct mlx4_cmd_mailbox *inbox,
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index c5b2064297a1..b656dd5772e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -1728,24 +1728,13 @@ int mlx4_SET_VLAN_FLTR_wrapper(struct mlx4_dev *dev, int slave,
        return err;
 }
-int mlx4_common_dump_eth_stats(struct mlx4_dev *dev, int slave,
-                               u32 in_mod, struct mlx4_cmd_mailbox *outbox)
-{
-        return mlx4_cmd_box(dev, 0, outbox->dma, in_mod, 0,
-                            MLX4_CMD_DUMP_ETH_STATS, MLX4_CMD_TIME_CLASS_B,
-                            MLX4_CMD_NATIVE);
-}
 int mlx4_DUMP_ETH_STATS_wrapper(struct mlx4_dev *dev, int slave,
                                struct mlx4_vhcr *vhcr,
                                struct mlx4_cmd_mailbox *inbox,
                                struct mlx4_cmd_mailbox *outbox,
                                struct mlx4_cmd_info *cmd)
 {
-        if (slave != dev->caps.function)
+        return 0;
-                return 0;
-        return mlx4_common_dump_eth_stats(dev, slave,
-                                          vhcr->in_modifier, outbox);
 }
 int mlx4_get_slave_from_roce_gid(struct mlx4_dev *dev, int port, u8 *gid,
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 84d7857ccc27..c548beaaf910 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -1605,13 +1605,14 @@ static int eq_res_start_move_to(struct mlx4_dev *dev, int slave, int index,
                        r->com.from_state = r->com.state;
                        r->com.to_state = state;
                        r->com.state = RES_EQ_BUSY;
-                        if (eq)
-                                *eq = r;
                }
        }
        spin_unlock_irq(mlx4_tlock(dev));
+        if (!err && eq)
+                *eq = r;
        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index aae46884bf93..521cfdb7d11e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -18,8 +18,6 @@ config MLX5_CORE_EN
        default n
        ---help---
          Ethernet support in Mellanox Technologies ConnectX-4 NIC.
-          Ethernet and Infiniband support in ConnectX-4 are currently mutually
-          exclusive.
 config MLX5_CORE_EN_DCB
        bool "Data Center Bridging (DCB) Support"
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/alloc.c b/drivers/net/ethernet/mellanox/mlx5/core/alloc.c
index 6cb38304669f..2c6e3c7b7417 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/alloc.c
@@ -41,6 +41,13 @@
 #include "mlx5_core.h"
+struct mlx5_db_pgdir {
+        struct list_head        list;
+        unsigned long          *bitmap;
+        __be32                 *db_page;
+        dma_addr_t              db_dma;
+};
 /* Handling for queue buffers -- we allocate a bunch of memory and
 * register it in a memory region at HCA virtual address 0.
 */
@@ -102,17 +109,28 @@ EXPORT_SYMBOL_GPL(mlx5_buf_free);
 static struct mlx5_db_pgdir *mlx5_alloc_db_pgdir(struct mlx5_core_dev *dev,
                                                 int node)
 {
+        u32 db_per_page = PAGE_SIZE / cache_line_size();
        struct mlx5_db_pgdir *pgdir;
        pgdir = kzalloc(sizeof(*pgdir), GFP_KERNEL);
        if (!pgdir)
                return NULL;
-        bitmap_fill(pgdir->bitmap, MLX5_DB_PER_PAGE);
+        pgdir->bitmap = kcalloc(BITS_TO_LONGS(db_per_page),
+                                sizeof(unsigned long),
+                                GFP_KERNEL);
+        if (!pgdir->bitmap) {
+                kfree(pgdir);
+                return NULL;
+        }
+        bitmap_fill(pgdir->bitmap, db_per_page);
        pgdir->db_page = mlx5_dma_zalloc_coherent_node(dev, PAGE_SIZE,
                                                       &pgdir->db_dma, node);
        if (!pgdir->db_page) {
+                kfree(pgdir->bitmap);
                kfree(pgdir);
                return NULL;
        }
@@ -123,18 +141,19 @@ static struct mlx5_db_pgdir *mlx5_alloc_db_pgdir(struct mlx5_core_dev *dev,
 static int mlx5_alloc_db_from_pgdir(struct mlx5_db_pgdir *pgdir,
                                    struct mlx5_db *db)
 {
+        u32 db_per_page = PAGE_SIZE / cache_line_size();
        int offset;
        int i;
-        i = find_first_bit(pgdir->bitmap, MLX5_DB_PER_PAGE);
+        i = find_first_bit(pgdir->bitmap, db_per_page);
-        if (i >= MLX5_DB_PER_PAGE)
+        if (i >= db_per_page)
                return -ENOMEM;
        __clear_bit(i, pgdir->bitmap);
        db->u.pgdir = pgdir;
        db->index   = i;
-        offset = db->index * L1_CACHE_BYTES;
+        offset = db->index * cache_line_size();
        db->db      = pgdir->db_page + offset / sizeof(*pgdir->db_page);
        db->dma     = pgdir->db_dma  + offset;
@@ -181,14 +200,16 @@ EXPORT_SYMBOL_GPL(mlx5_db_alloc);
 void mlx5_db_free(struct mlx5_core_dev *dev, struct mlx5_db *db)
 {
+        u32 db_per_page = PAGE_SIZE / cache_line_size();
        mutex_lock(&dev->priv.pgdir_mutex);
        __set_bit(db->index, db->u.pgdir->bitmap);
-        if (bitmap_full(db->u.pgdir->bitmap, MLX5_DB_PER_PAGE)) {
+        if (bitmap_full(db->u.pgdir->bitmap, db_per_page)) {
                dma_free_coherent(&(dev->pdev->dev), PAGE_SIZE,
                                  db->u.pgdir->db_page, db->u.pgdir->db_dma);
                list_del(&db->u.pgdir->list);
+                kfree(db->u.pgdir->bitmap);
                kfree(db->u.pgdir);
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 1e639f886021..bfe410e8a469 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -268,11 +268,6 @@ static void dump_buf(void *buf, int size, int data_only, int offset)
                pr_debug("\n");
 }
-enum {
-        MLX5_DRIVER_STATUS_ABORTED = 0xfe,
-        MLX5_DRIVER_SYND = 0xbadd00de,
-};
 static int mlx5_internal_err_ret_value(struct mlx5_core_dev *dev, u16 op,
                                       u32 *synd, u8 *status)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 460363b66cb1..71382df59fc0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -85,6 +85,9 @@
 #define MLX5_MPWRQ_SMALL_PACKET_THRESHOLD       (128)
 #define MLX5E_PARAMS_DEFAULT_LRO_WQE_SZ                 (64 * 1024)
+#define MLX5E_DEFAULT_LRO_TIMEOUT                       32
+#define MLX5E_LRO_TIMEOUT_ARR_SIZE                      4
 #define MLX5E_PARAMS_DEFAULT_RX_CQ_MODERATION_USEC      0x10
 #define MLX5E_PARAMS_DEFAULT_RX_CQ_MODERATION_USEC_FROM_CQE 0x3
 #define MLX5E_PARAMS_DEFAULT_RX_CQ_MODERATION_PKTS      0x20
@@ -221,6 +224,7 @@ struct mlx5e_params {
        struct ieee_ets ets;
 #endif
        bool rx_am_enabled;
+        u32 lro_timeout;
 };
 struct mlx5e_tstamp {
@@ -237,7 +241,7 @@ struct mlx5e_tstamp {
 };
 enum {
-        MLX5E_RQ_STATE_FLUSH,
+        MLX5E_RQ_STATE_ENABLED,
        MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS,
        MLX5E_RQ_STATE_AM,
 };
@@ -390,7 +394,7 @@ struct mlx5e_sq_dma {
 };
 enum {
-        MLX5E_SQ_STATE_FLUSH,
+        MLX5E_SQ_STATE_ENABLED,
        MLX5E_SQ_STATE_BF_ENABLE,
 };
@@ -888,5 +892,6 @@ int mlx5e_attach_netdev(struct mlx5_core_dev *mdev, struct net_device *netdev);
 void mlx5e_detach_netdev(struct mlx5_core_dev *mdev, struct net_device *netdev);
 struct rtnl_link_stats64 *
 mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats);
+u32 mlx5e_choose_lro_timeout(struct mlx5_core_dev *mdev, u32 wanted_timeout);
 #endif /* __MLX5_EN_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 7eaf38020a8f..246d98ebb588 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -759,6 +759,7 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
        if (err)
                goto err_destroy_rq;
+        set_bit(MLX5E_RQ_STATE_ENABLED, &rq->state);
        err = mlx5e_modify_rq_state(rq, MLX5_RQC_STATE_RST, MLX5_RQC_STATE_RDY);
        if (err)
                goto err_disable_rq;
@@ -773,6 +774,7 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
        return 0;
 err_disable_rq:
+        clear_bit(MLX5E_RQ_STATE_ENABLED, &rq->state);
        mlx5e_disable_rq(rq);
 err_destroy_rq:
        mlx5e_destroy_rq(rq);
@@ -782,7 +784,7 @@ err_destroy_rq:
 static void mlx5e_close_rq(struct mlx5e_rq *rq)
 {
-        set_bit(MLX5E_RQ_STATE_FLUSH, &rq->state);
+        clear_bit(MLX5E_RQ_STATE_ENABLED, &rq->state);
        napi_synchronize(&rq->channel->napi); /* prevent mlx5e_post_rx_wqes */
        cancel_work_sync(&rq->am.work);
@@ -1006,7 +1008,6 @@ static int mlx5e_enable_sq(struct mlx5e_sq *sq, struct mlx5e_sq_param *param)
        MLX5_SET(sqc,  sqc, min_wqe_inline_mode, sq->min_inline_mode);
        MLX5_SET(sqc,  sqc, state,              MLX5_SQC_STATE_RST);
        MLX5_SET(sqc,  sqc, tis_lst_sz, param->type == MLX5E_SQ_ICO ? 0 : 1);
-        MLX5_SET(sqc,  sqc, flush_in_error_en,  1);
        MLX5_SET(wq,   wq, wq_type,       MLX5_WQ_TYPE_CYCLIC);
        MLX5_SET(wq,   wq, uar_page,      sq->uar.index);
@@ -1083,6 +1084,7 @@ static int mlx5e_open_sq(struct mlx5e_channel *c,
        if (err)
                goto err_destroy_sq;
+        set_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
        err = mlx5e_modify_sq(sq, MLX5_SQC_STATE_RST, MLX5_SQC_STATE_RDY,
                              false, 0);
        if (err)
@@ -1096,6 +1098,7 @@ static int mlx5e_open_sq(struct mlx5e_channel *c,
        return 0;
 err_disable_sq:
+        clear_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
        mlx5e_disable_sq(sq);
 err_destroy_sq:
        mlx5e_destroy_sq(sq);
@@ -1112,7 +1115,7 @@ static inline void netif_tx_disable_queue(struct netdev_queue *txq)
 static void mlx5e_close_sq(struct mlx5e_sq *sq)
 {
-        set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
+        clear_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
        /* prevent netif_tx_wake_queue */
        napi_synchronize(&sq->channel->napi);
@@ -1445,6 +1448,7 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
        c->netdev   = priv->netdev;
        c->mkey_be  = cpu_to_be32(priv->mdev->mlx5e_res.mkey.key);
        c->num_tc   = priv->params.num_tc;
+        c->xdp      = !!priv->xdp_prog;
        if (priv->params.rx_am_enabled)
                rx_cq_profile = mlx5e_am_get_def_profile(priv->params.rx_cq_period_mode);
@@ -1468,6 +1472,12 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
        if (err)
                goto err_close_tx_cqs;
+        /* XDP SQ CQ params are same as normal TXQ sq CQ params */
+        err = c->xdp ? mlx5e_open_cq(c, &cparam->tx_cq, &c->xdp_sq.cq,
+                                     priv->params.tx_cq_moderation) : 0;
+        if (err)
+                goto err_close_rx_cq;
        napi_enable(&c->napi);
        err = mlx5e_open_sq(c, 0, &cparam->icosq, &c->icosq);
@@ -1488,21 +1498,10 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
                }
        }
-        if (priv->xdp_prog) {
+        err = c->xdp ? mlx5e_open_sq(c, 0, &cparam->xdp_sq, &c->xdp_sq) : 0;
-                /* XDP SQ CQ params are same as normal TXQ sq CQ params */
+        if (err)
-                err = mlx5e_open_cq(c, &cparam->tx_cq, &c->xdp_sq.cq,
+                goto err_close_sqs;
-                                    priv->params.tx_cq_moderation);
-                if (err)
-                        goto err_close_sqs;
-                err = mlx5e_open_sq(c, 0, &cparam->xdp_sq, &c->xdp_sq);
-                if (err) {
-                        mlx5e_close_cq(&c->xdp_sq.cq);
-                        goto err_close_sqs;
-                }
-        }
-        c->xdp = !!priv->xdp_prog;
        err = mlx5e_open_rq(c, &cparam->rq, &c->rq);
        if (err)
                goto err_close_xdp_sq;
@@ -1512,7 +1511,8 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
        return 0;
 err_close_xdp_sq:
-        mlx5e_close_sq(&c->xdp_sq);
+        if (c->xdp)
+                mlx5e_close_sq(&c->xdp_sq);
 err_close_sqs:
        mlx5e_close_sqs(c);
@@ -1522,6 +1522,10 @@ err_close_icosq:
 err_disable_napi:
        napi_disable(&c->napi);
+        if (c->xdp)
+                mlx5e_close_cq(&c->xdp_sq.cq);
+err_close_rx_cq:
        mlx5e_close_cq(&c->rq.cq);
 err_close_tx_cqs:
@@ -1971,9 +1975,7 @@ static void mlx5e_build_tir_ctx_lro(void *tirc, struct mlx5e_priv *priv)
        MLX5_SET(tirc, tirc, lro_max_ip_payload_size,
                 (priv->params.lro_wqe_sz -
                  ROUGH_MAX_L2_L3_HDR_SZ) >> 8);
-        MLX5_SET(tirc, tirc, lro_timeout_period_usecs,
+        MLX5_SET(tirc, tirc, lro_timeout_period_usecs, priv->params.lro_timeout);
-                 MLX5_CAP_ETH(priv->mdev,
-                              lro_timer_supported_periods[2]));
 }
 void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv)
@@ -3093,7 +3095,7 @@ static void mlx5e_tx_timeout(struct net_device *dev)
                if (!netif_xmit_stopped(netdev_get_tx_queue(dev, i)))
                        continue;
                sched_work = true;
-                set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
+                clear_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
                netdev_err(dev, "TX timeout on queue: %d, SQ: 0x%x, CQ: 0x%x, SQ Cons: 0x%x SQ Prod: 0x%x\n",
                           i, sq->sqn, sq->cq.mcq.cqn, sq->cc, sq->pc);
        }
@@ -3148,13 +3150,13 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog)
        for (i = 0; i < priv->params.num_channels; i++) {
                struct mlx5e_channel *c = priv->channel[i];
-                set_bit(MLX5E_RQ_STATE_FLUSH, &c->rq.state);
+                clear_bit(MLX5E_RQ_STATE_ENABLED, &c->rq.state);
                napi_synchronize(&c->napi);
                /* prevent mlx5e_poll_rx_cq from accessing rq->xdp_prog */
                old_prog = xchg(&c->rq.xdp_prog, prog);
-                clear_bit(MLX5E_RQ_STATE_FLUSH, &c->rq.state);
+                set_bit(MLX5E_RQ_STATE_ENABLED, &c->rq.state);
                /* napi_schedule in case we have missed anything */
                set_bit(MLX5E_CHANNEL_NAPI_SCHED, &c->flags);
                napi_schedule(&c->napi);
@@ -3401,6 +3403,18 @@ static void mlx5e_query_min_inline(struct mlx5_core_dev *mdev,
        }
 }
+u32 mlx5e_choose_lro_timeout(struct mlx5_core_dev *mdev, u32 wanted_timeout)
+{
+        int i;
+        /* The supported periods are organized in ascending order */
+        for (i = 0; i < MLX5E_LRO_TIMEOUT_ARR_SIZE - 1; i++)
+                if (MLX5_CAP_ETH(mdev, lro_timer_supported_periods[i]) >= wanted_timeout)
+                        break;
+        return MLX5_CAP_ETH(mdev, lro_timer_supported_periods[i]);
+}
 static void mlx5e_build_nic_netdev_priv(struct mlx5_core_dev *mdev,
                                        struct net_device *netdev,
                                        const struct mlx5e_profile *profile,
@@ -3419,6 +3433,9 @@ static void mlx5e_build_nic_netdev_priv(struct mlx5_core_dev *mdev,
        priv->profile                      = profile;
        priv->ppriv                        = ppriv;
+        priv->params.lro_timeout =
+                mlx5e_choose_lro_timeout(mdev, MLX5E_DEFAULT_LRO_TIMEOUT);
        priv->params.log_sq_size = MLX5E_PARAMS_DEFAULT_LOG_SQ_SIZE;
        /* set CQE compression */
@@ -4035,7 +4052,6 @@ void mlx5e_destroy_netdev(struct mlx5_core_dev *mdev, struct mlx5e_priv *priv)
        const struct mlx5e_profile *profile = priv->profile;
        struct net_device *netdev = priv->netdev;
-        unregister_netdev(netdev);
        destroy_workqueue(priv->wq);
        if (profile->cleanup)
                profile->cleanup(priv);
@@ -4052,6 +4068,7 @@ static void mlx5e_remove(struct mlx5_core_dev *mdev, void *vpriv)
        for (vport = 1; vport < total_vfs; vport++)
                mlx5_eswitch_unregister_vport_rep(esw, vport);
+        unregister_netdev(priv->netdev);
        mlx5e_detach(mdev, vpriv);
        mlx5e_destroy_netdev(mdev, priv);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 3c97da103d30..bf1c09ca73c0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -308,7 +308,7 @@ static void mlx5e_build_rep_netdev(struct net_device *netdev)
        netdev->switchdev_ops = &mlx5e_rep_switchdev_ops;
 #endif
-        netdev->features         |= NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_TC;
+        netdev->features         |= NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_TC | NETIF_F_NETNS_LOCAL;
        netdev->hw_features      |= NETIF_F_HW_TC;
        eth_hw_addr_random(netdev);
@@ -457,6 +457,7 @@ void mlx5e_vport_rep_unload(struct mlx5_eswitch *esw,
        struct mlx5e_priv *priv = rep->priv_data;
        struct net_device *netdev = priv->netdev;
+        unregister_netdev(netdev);
        mlx5e_detach_netdev(esw->dev, netdev);
        mlx5e_destroy_netdev(esw->dev, priv);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index c6de6fba5843..33495d88aeb2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -340,7 +340,7 @@ static inline void mlx5e_post_umr_wqe(struct mlx5e_rq *rq, u16 ix)
        while ((pi = (sq->pc & wq->sz_m1)) > sq->edge) {
                sq->db.ico_wqe[pi].opcode = MLX5_OPCODE_NOP;
                sq->db.ico_wqe[pi].num_wqebbs = 1;
-                mlx5e_send_nop(sq, true);
+                mlx5e_send_nop(sq, false);
        }
        wqe = mlx5_wq_cyc_get_wqe(wq, pi);
@@ -412,7 +412,7 @@ void mlx5e_post_rx_mpwqe(struct mlx5e_rq *rq)
        clear_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state);
-        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state))) {
+        if (unlikely(!test_bit(MLX5E_RQ_STATE_ENABLED, &rq->state))) {
                mlx5e_free_rx_mpwqe(rq, &rq->mpwqe.info[wq->head]);
                return;
        }
@@ -445,7 +445,7 @@ void mlx5e_dealloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)
 }
 #define RQ_CANNOT_POST(rq) \
-        (test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state) || \
+        (!test_bit(MLX5E_RQ_STATE_ENABLED, &rq->state) || \
         test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
 bool mlx5e_post_rx_wqes(struct mlx5e_rq *rq)
@@ -924,7 +924,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
        struct mlx5e_sq *xdp_sq = &rq->channel->xdp_sq;
        int work_done = 0;
-        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state)))
+        if (unlikely(!test_bit(MLX5E_RQ_STATE_ENABLED, &rq->state)))
                return 0;
        if (cq->decmprs_left)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index ce8c54d18906..6bb21b31cfeb 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -237,12 +237,15 @@ static int parse_cls_flower(struct mlx5e_priv *priv, struct mlx5_flow_spec *spec
                        skb_flow_dissector_target(f->dissector,
                                                  FLOW_DISSECTOR_KEY_VLAN,
                                                  f->mask);
-                if (mask->vlan_id) {
+                if (mask->vlan_id || mask->vlan_priority) {
                        MLX5_SET(fte_match_set_lyr_2_4, headers_c, vlan_tag, 1);
                        MLX5_SET(fte_match_set_lyr_2_4, headers_v, vlan_tag, 1);
                        MLX5_SET(fte_match_set_lyr_2_4, headers_c, first_vid, mask->vlan_id);
                        MLX5_SET(fte_match_set_lyr_2_4, headers_v, first_vid, key->vlan_id);
+                        MLX5_SET(fte_match_set_lyr_2_4, headers_c, first_prio, mask->vlan_priority);
+                        MLX5_SET(fte_match_set_lyr_2_4, headers_v, first_prio, key->vlan_priority);
                }
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 70a717382357..cfb68371c397 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -409,7 +409,7 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
        sq = container_of(cq, struct mlx5e_sq, cq);
-        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
+        if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state)))
                return false;
        npkts = 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
index 5703f19a6a24..e5c12a732aa1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
@@ -56,7 +56,7 @@ static void mlx5e_poll_ico_cq(struct mlx5e_cq *cq)
        struct mlx5_cqe64 *cqe;
        u16 sqcc;
-        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
+        if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state)))
                return;
        cqe = mlx5e_get_cqe(cq);
@@ -113,7 +113,7 @@ static inline bool mlx5e_poll_xdp_tx_cq(struct mlx5e_cq *cq)
        sq = container_of(cq, struct mlx5e_sq, cq);
-        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
+        if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state)))
                return false;
        /* sq->cc must be updated only after mlx5_cqwq_update_db_record(),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index abbf2c369923..be1f7333ab7f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -931,8 +931,8 @@ static void esw_vport_change_handler(struct work_struct *work)
        mutex_unlock(&esw->state_lock);
 }
-static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
+static int esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
-                                        struct mlx5_vport *vport)
+                                       struct mlx5_vport *vport)
 {
        int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
        struct mlx5_flow_group *vlan_grp = NULL;
@@ -949,9 +949,11 @@ static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
        int table_size = 2;
        int err = 0;
-        if (!MLX5_CAP_ESW_EGRESS_ACL(dev, ft_support) ||
+        if (!MLX5_CAP_ESW_EGRESS_ACL(dev, ft_support))
-            !IS_ERR_OR_NULL(vport->egress.acl))
+                return -EOPNOTSUPP;
-                return;
+        if (!IS_ERR_OR_NULL(vport->egress.acl))
+                return 0;
        esw_debug(dev, "Create vport[%d] egress ACL log_max_size(%d)\n",
                  vport->vport, MLX5_CAP_ESW_EGRESS_ACL(dev, log_max_ft_size));
@@ -959,12 +961,12 @@ static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
        root_ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_ESW_EGRESS);
        if (!root_ns) {
                esw_warn(dev, "Failed to get E-Switch egress flow namespace\n");
-                return;
+                return -EIO;
        }
        flow_group_in = mlx5_vzalloc(inlen);
        if (!flow_group_in)
-                return;
+                return -ENOMEM;
        acl = mlx5_create_vport_flow_table(root_ns, 0, table_size, 0, vport->vport);
        if (IS_ERR(acl)) {
@@ -1009,6 +1011,7 @@ out:
                mlx5_destroy_flow_group(vlan_grp);
        if (err && !IS_ERR_OR_NULL(acl))
                mlx5_destroy_flow_table(acl);
+        return err;
 }
 static void esw_vport_cleanup_egress_rules(struct mlx5_eswitch *esw,
@@ -1041,8 +1044,8 @@ static void esw_vport_disable_egress_acl(struct mlx5_eswitch *esw,
        vport->egress.acl = NULL;
 }
-static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
+static int esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
-                                         struct mlx5_vport *vport)
+                                        struct mlx5_vport *vport)
 {
        int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
        struct mlx5_core_dev *dev = esw->dev;
@@ -1063,9 +1066,11 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
        int table_size = 4;
        int err = 0;
-        if (!MLX5_CAP_ESW_INGRESS_ACL(dev, ft_support) ||
+        if (!MLX5_CAP_ESW_INGRESS_ACL(dev, ft_support))
-            !IS_ERR_OR_NULL(vport->ingress.acl))
+                return -EOPNOTSUPP;
-                return;
+        if (!IS_ERR_OR_NULL(vport->ingress.acl))
+                return 0;
        esw_debug(dev, "Create vport[%d] ingress ACL log_max_size(%d)\n",
                  vport->vport, MLX5_CAP_ESW_INGRESS_ACL(dev, log_max_ft_size));
@@ -1073,12 +1078,12 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
        root_ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_ESW_INGRESS);
        if (!root_ns) {
                esw_warn(dev, "Failed to get E-Switch ingress flow namespace\n");
-                return;
+                return -EIO;
        }
        flow_group_in = mlx5_vzalloc(inlen);
        if (!flow_group_in)
-                return;
+                return -ENOMEM;
        acl = mlx5_create_vport_flow_table(root_ns, 0, table_size, 0, vport->vport);
        if (IS_ERR(acl)) {
@@ -1167,6 +1172,7 @@ out:
        }
        kvfree(flow_group_in);
+        return err;
 }
 static void esw_vport_cleanup_ingress_rules(struct mlx5_eswitch *esw,
@@ -1225,7 +1231,13 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
                return 0;
        }
-        esw_vport_enable_ingress_acl(esw, vport);
+        err = esw_vport_enable_ingress_acl(esw, vport);
+        if (err) {
+                mlx5_core_warn(esw->dev,
+                               "failed to enable ingress acl (%d) on vport[%d]\n",
+                               err, vport->vport);
+                return err;
+        }
        esw_debug(esw->dev,
                  "vport[%d] configure ingress rules, vlan(%d) qos(%d)\n",
@@ -1299,7 +1311,13 @@ static int esw_vport_egress_config(struct mlx5_eswitch *esw,
                return 0;
        }
-        esw_vport_enable_egress_acl(esw, vport);
+        err = esw_vport_enable_egress_acl(esw, vport);
+        if (err) {
+                mlx5_core_warn(esw->dev,
+                               "failed to enable egress acl (%d) on vport[%d]\n",
+                               err, vport->vport);
+                return err;
+        }
        esw_debug(esw->dev,
                  "vport[%d] configure egress rules, vlan(%d) qos(%d)\n",
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index c55ad8d00c05..d239f5d0ea36 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -57,7 +57,8 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
        if (esw->mode != SRIOV_OFFLOADS)
                return ERR_PTR(-EOPNOTSUPP);
-        action = attr->action;
+        /* per flow vlan pop/push is emulated, don't set that into the firmware */
+        action = attr->action & ~(MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH | MLX5_FLOW_CONTEXT_ACTION_VLAN_POP);
        if (action & MLX5_FLOW_CONTEXT_ACTION_FWD_DEST) {
                dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 5da2cc878582..914e5466f729 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -436,6 +436,9 @@ static void del_flow_group(struct fs_node *node)
        fs_get_obj(ft, fg->node.parent);
        dev = get_dev(&ft->node);
+        if (ft->autogroup.active)
+                ft->autogroup.num_groups--;
        if (mlx5_cmd_destroy_flow_group(dev, ft, fg->id))
                mlx5_core_warn(dev, "flow steering can't destroy fg %d of ft %d\n",
                               fg->id, ft->id);
@@ -879,7 +882,7 @@ static struct mlx5_flow_group *create_flow_group_common(struct mlx5_flow_table *
        tree_init_node(&fg->node, !is_auto_fg, del_flow_group);
        tree_add_node(&fg->node, &ft->node);
        /* Add node to group list */
-        list_add(&fg->node.list, ft->node.children.prev);
+        list_add(&fg->node.list, prev_fg);
        return fg;
 }
@@ -893,7 +896,7 @@ struct mlx5_flow_group *mlx5_create_flow_group(struct mlx5_flow_table *ft,
                return ERR_PTR(-EPERM);
        lock_ref_node(&ft->node);
-        fg = create_flow_group_common(ft, fg_in, &ft->node.children, false);
+        fg = create_flow_group_common(ft, fg_in, ft->node.children.prev, false);
        unlock_ref_node(&ft->node);
        return fg;
@@ -1012,7 +1015,7 @@ static struct mlx5_flow_group *create_autogroup(struct mlx5_flow_table *ft,
                                                u32 *match_criteria)
 {
        int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
-        struct list_head *prev = &ft->node.children;
+        struct list_head *prev = ft->node.children.prev;
        unsigned int candidate_index = 0;
        struct mlx5_flow_group *fg;
        void *match_criteria_addr;
@@ -1687,7 +1690,7 @@ static int init_root_ns(struct mlx5_flow_steering *steering)
 {
        steering->root_ns = create_root_ns(steering, FS_FT_NIC_RX);
-        if (IS_ERR_OR_NULL(steering->root_ns))
+        if (!steering->root_ns)
                goto cleanup;
        if (init_root_tree(steering, &root_fs, &steering->root_ns->ns.node))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
index 3a9195b4169d..3b026c151cf2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
@@ -218,6 +218,7 @@ struct mlx5_fc *mlx5_fc_create(struct mlx5_core_dev *dev, bool aging)
                goto err_out;
        if (aging) {
+                counter->cache.lastuse = jiffies;
                counter->aging = true;
                spin_lock(&fc_stats->addlist_lock);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 1a05fb965c8d..5bcf93422ee0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -61,10 +61,15 @@ enum {
 enum {
        MLX5_NIC_IFC_FULL               = 0,
        MLX5_NIC_IFC_DISABLED           = 1,
-        MLX5_NIC_IFC_NO_DRAM_NIC        = 2
+        MLX5_NIC_IFC_NO_DRAM_NIC        = 2,
+        MLX5_NIC_IFC_INVALID            = 3
 };
-static u8 get_nic_interface(struct mlx5_core_dev *dev)
+enum {
+        MLX5_DROP_NEW_HEALTH_WORK,
+};
+static u8 get_nic_state(struct mlx5_core_dev *dev)
 {
        return (ioread32be(&dev->iseg->cmdq_addr_l_sz) >> 8) & 3;
 }
@@ -97,7 +102,7 @@ static int in_fatal(struct mlx5_core_dev *dev)
        struct mlx5_core_health *health = &dev->priv.health;
        struct health_buffer __iomem *h = health->health;
-        if (get_nic_interface(dev) == MLX5_NIC_IFC_DISABLED)
+        if (get_nic_state(dev) == MLX5_NIC_IFC_DISABLED)
                return 1;
        if (ioread32be(&h->fw_ver) == 0xffffffff)
@@ -127,7 +132,7 @@ unlock:
 static void mlx5_handle_bad_state(struct mlx5_core_dev *dev)
 {
-        u8 nic_interface = get_nic_interface(dev);
+        u8 nic_interface = get_nic_state(dev);
        switch (nic_interface) {
        case MLX5_NIC_IFC_FULL:
@@ -149,8 +154,34 @@ static void mlx5_handle_bad_state(struct mlx5_core_dev *dev)
        mlx5_disable_device(dev);
 }
+static void health_recover(struct work_struct *work)
+{
+        struct mlx5_core_health *health;
+        struct delayed_work *dwork;
+        struct mlx5_core_dev *dev;
+        struct mlx5_priv *priv;
+        u8 nic_state;
+        dwork = container_of(work, struct delayed_work, work);
+        health = container_of(dwork, struct mlx5_core_health, recover_work);
+        priv = container_of(health, struct mlx5_priv, health);
+        dev = container_of(priv, struct mlx5_core_dev, priv);
+        nic_state = get_nic_state(dev);
+        if (nic_state == MLX5_NIC_IFC_INVALID) {
+                dev_err(&dev->pdev->dev, "health recovery flow aborted since the nic state is invalid\n");
+                return;
+        }
+        dev_err(&dev->pdev->dev, "starting health recovery flow\n");
+        mlx5_recover_device(dev);
+}
+/* How much time to wait until health resetting the driver (in msecs) */
+#define MLX5_RECOVERY_DELAY_MSECS 60000
 static void health_care(struct work_struct *work)
 {
+        unsigned long recover_delay = msecs_to_jiffies(MLX5_RECOVERY_DELAY_MSECS);
        struct mlx5_core_health *health;
        struct mlx5_core_dev *dev;
        struct mlx5_priv *priv;
@@ -160,6 +191,14 @@ static void health_care(struct work_struct *work)
        dev = container_of(priv, struct mlx5_core_dev, priv);
        mlx5_core_warn(dev, "handling bad device here\n");
        mlx5_handle_bad_state(dev);
+        spin_lock(&health->wq_lock);
+        if (!test_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags))
+                schedule_delayed_work(&health->recover_work, recover_delay);
+        else
+                dev_err(&dev->pdev->dev,
+                        "new health works are not permitted at this stage\n");
+        spin_unlock(&health->wq_lock);
 }
 static const char *hsynd_str(u8 synd)
@@ -272,7 +311,13 @@ static void poll_health(unsigned long data)
        if (in_fatal(dev) && !health->sick) {
                health->sick = true;
                print_health_info(dev);
-                schedule_work(&health->work);
+                spin_lock(&health->wq_lock);
+                if (!test_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags))
+                        queue_work(health->wq, &health->work);
+                else
+                        dev_err(&dev->pdev->dev,
+                                "new health works are not permitted at this stage\n");
+                spin_unlock(&health->wq_lock);
        }
 }
@@ -281,6 +326,8 @@ void mlx5_start_health_poll(struct mlx5_core_dev *dev)
        struct mlx5_core_health *health = &dev->priv.health;
        init_timer(&health->timer);
+        health->sick = 0;
+        clear_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags);
        health->health = &dev->iseg->health;
        health->health_counter = &dev->iseg->health_counter;
@@ -297,11 +344,22 @@ void mlx5_stop_health_poll(struct mlx5_core_dev *dev)
        del_timer_sync(&health->timer);
 }
+void mlx5_drain_health_wq(struct mlx5_core_dev *dev)
+{
+        struct mlx5_core_health *health = &dev->priv.health;
+        spin_lock(&health->wq_lock);
+        set_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags);
+        spin_unlock(&health->wq_lock);
+        cancel_delayed_work_sync(&health->recover_work);
+        cancel_work_sync(&health->work);
+}
 void mlx5_health_cleanup(struct mlx5_core_dev *dev)
 {
        struct mlx5_core_health *health = &dev->priv.health;
-        flush_work(&health->work);
+        destroy_workqueue(health->wq);
 }
 int mlx5_health_init(struct mlx5_core_dev *dev)
@@ -316,9 +374,13 @@ int mlx5_health_init(struct mlx5_core_dev *dev)
        strcpy(name, "mlx5_health");
        strcat(name, dev_name(&dev->pdev->dev));
+        health->wq = create_singlethread_workqueue(name);
        kfree(name);
+        if (!health->wq)
+                return -ENOMEM;
+        spin_lock_init(&health->wq_lock);
        INIT_WORK(&health->work, health_care);
+        INIT_DELAYED_WORK(&health->recover_work, health_recover);
        return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index d9c3c70b29e4..ada24e103b02 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -46,7 +46,6 @@
 #include <linux/mlx5/srq.h>
 #include <linux/debugfs.h>
 #include <linux/kmod.h>
-#include <linux/delay.h>
 #include <linux/mlx5/mlx5_ifc.h>
 #ifdef CONFIG_RFS_ACCEL
 #include <linux/cpu_rmap.h>
@@ -63,13 +62,13 @@ MODULE_DESCRIPTION("Mellanox Connect-IB, ConnectX-4 core driver");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(DRIVER_VERSION);
-int mlx5_core_debug_mask;
+unsigned int mlx5_core_debug_mask;
-module_param_named(debug_mask, mlx5_core_debug_mask, int, 0644);
+module_param_named(debug_mask, mlx5_core_debug_mask, uint, 0644);
 MODULE_PARM_DESC(debug_mask, "debug mask: 1 = dump cmd data, 2 = dump cmd exec time, 3 = both. Default=0");
 #define MLX5_DEFAULT_PROF       2
-static int prof_sel = MLX5_DEFAULT_PROF;
+static unsigned int prof_sel = MLX5_DEFAULT_PROF;
-module_param_named(prof_sel, prof_sel, int, 0444);
+module_param_named(prof_sel, prof_sel, uint, 0444);
 MODULE_PARM_DESC(prof_sel, "profile selector. Valid range 0 - 2");
 enum {
@@ -733,13 +732,15 @@ static int mlx5_core_set_issi(struct mlx5_core_dev *dev)
                u8 status;
                mlx5_cmd_mbox_status(query_out, &status, &syndrome);
-                if (status == MLX5_CMD_STAT_BAD_OP_ERR) {
+                if (!status || syndrome == MLX5_DRIVER_SYND) {
-                        pr_debug("Only ISSI 0 is supported\n");
+                        mlx5_core_err(dev, "Failed to query ISSI err(%d) status(%d) synd(%d)\n",
-                        return 0;
+                                      err, status, syndrome);
+                        return err;
                }
-                pr_err("failed to query ISSI err(%d)\n", err);
+                mlx5_core_warn(dev, "Query ISSI is not supported by FW, ISSI is 0\n");
-                return err;
+                dev->issi = 0;
+                return 0;
        }
        sup_issi = MLX5_GET(query_issi_out, query_out, supported_issi_dw0);
@@ -753,7 +754,8 @@ static int mlx5_core_set_issi(struct mlx5_core_dev *dev)
                err = mlx5_cmd_exec(dev, set_in, sizeof(set_in),
                                    set_out, sizeof(set_out));
                if (err) {
-                        pr_err("failed to set ISSI=1 err(%d)\n", err);
+                        mlx5_core_err(dev, "Failed to set ISSI to 1 err(%d)\n",
+                                      err);
                        return err;
                }
@@ -844,12 +846,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
        struct pci_dev *pdev = dev->pdev;
        int err;
-        err = mlx5_query_hca_caps(dev);
-        if (err) {
-                dev_err(&pdev->dev, "query hca failed\n");
-                goto out;
-        }
        err = mlx5_query_board_id(dev);
        if (err) {
                dev_err(&pdev->dev, "query board id failed\n");
@@ -1023,6 +1019,12 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
        mlx5_start_health_poll(dev);
+        err = mlx5_query_hca_caps(dev);
+        if (err) {
+                dev_err(&pdev->dev, "query hca failed\n");
+                goto err_stop_poll;
+        }
        if (boot && mlx5_init_once(dev, priv)) {
                dev_err(&pdev->dev, "sw objs init failed\n");
                goto err_stop_poll;
@@ -1226,15 +1228,9 @@ static int init_one(struct pci_dev *pdev,
        pci_set_drvdata(pdev, dev);
-        if (prof_sel < 0 || prof_sel >= ARRAY_SIZE(profile)) {
-                mlx5_core_warn(dev,
-                               "selected profile out of range, selecting default (%d)\n",
-                               MLX5_DEFAULT_PROF);
-                prof_sel = MLX5_DEFAULT_PROF;
-        }
-        dev->profile = &profile[prof_sel];
        dev->pdev = pdev;
        dev->event = mlx5_core_event;
+        dev->profile = &profile[prof_sel];
        INIT_LIST_HEAD(&priv->ctx_list);
        spin_lock_init(&priv->ctx_lock);
@@ -1313,10 +1309,16 @@ static pci_ers_result_t mlx5_pci_err_detected(struct pci_dev *pdev,
        struct mlx5_priv *priv = &dev->priv;
        dev_info(&pdev->dev, "%s was called\n", __func__);
        mlx5_enter_error_state(dev);
        mlx5_unload_one(dev, priv, false);
-        pci_save_state(pdev);
+        /* In case of kernel call save the pci state and drain health wq */
-        mlx5_pci_disable_device(dev);
+        if (state) {
+                pci_save_state(pdev);
+                mlx5_drain_health_wq(dev);
+                mlx5_pci_disable_device(dev);
+        }
        return state == pci_channel_io_perm_failure ?
                PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET;
 }
@@ -1373,11 +1375,6 @@ static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
        return PCI_ERS_RESULT_RECOVERED;
 }
-void mlx5_disable_device(struct mlx5_core_dev *dev)
-{
-        mlx5_pci_err_detected(dev->pdev, 0);
-}
 static void mlx5_pci_resume(struct pci_dev *pdev)
 {
        struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
@@ -1427,6 +1424,18 @@ static const struct pci_device_id mlx5_core_pci_table[] = {
 MODULE_DEVICE_TABLE(pci, mlx5_core_pci_table);
+void mlx5_disable_device(struct mlx5_core_dev *dev)
+{
+        mlx5_pci_err_detected(dev->pdev, 0);
+}
+void mlx5_recover_device(struct mlx5_core_dev *dev)
+{
+        mlx5_pci_disable_device(dev);
+        if (mlx5_pci_slot_reset(dev->pdev) == PCI_ERS_RESULT_RECOVERED)
+                mlx5_pci_resume(dev->pdev);
+}
 static struct pci_driver mlx5_core_driver = {
        .name           = DRIVER_NAME,
        .id_table       = mlx5_core_pci_table,
@@ -1437,10 +1446,22 @@ static struct pci_driver mlx5_core_driver = {
        .sriov_configure   = mlx5_core_sriov_configure,
 };
+static void mlx5_core_verify_params(void)
+{
+        if (prof_sel >= ARRAY_SIZE(profile)) {
+                pr_warn("mlx5_core: WARNING: Invalid module parameter prof_sel %d, valid range 0-%zu, changing back to default(%d)\n",
+                        prof_sel,
+                        ARRAY_SIZE(profile) - 1,
+                        MLX5_DEFAULT_PROF);
+                prof_sel = MLX5_DEFAULT_PROF;
+        }
+}
 static int __init init(void)
 {
        int err;
+        mlx5_core_verify_params();
        mlx5_register_debugfs();
        err = pci_register_driver(&mlx5_core_driver);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index 3d0cfb9f18f9..63b9a0dba885 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -44,11 +44,11 @@
 #define MLX5_TOTAL_VPORTS(mdev) (1 + pci_sriov_get_totalvfs(mdev->pdev))
-extern int mlx5_core_debug_mask;
+extern uint mlx5_core_debug_mask;
 #define mlx5_core_dbg(__dev, format, ...)                               \
-        dev_dbg(&(__dev)->pdev->dev, "%s:%s:%d:(pid %d): " format,      \
+        dev_dbg(&(__dev)->pdev->dev, "%s:%d:(pid %d): " format,         \
-                 (__dev)->priv.name, __func__, __LINE__, current->pid,  \
+                 __func__, __LINE__, current->pid,                      \
                 ##__VA_ARGS__)
 #define mlx5_core_dbg_mask(__dev, mask, format, ...)                    \
@@ -63,8 +63,8 @@ do {									\
               ##__VA_ARGS__)
 #define mlx5_core_warn(__dev, format, ...)                              \
-        dev_warn(&(__dev)->pdev->dev, "%s:%s:%d:(pid %d): " format,     \
+        dev_warn(&(__dev)->pdev->dev, "%s:%d:(pid %d): " format,        \
-                (__dev)->priv.name, __func__, __LINE__, current->pid,   \
+                 __func__, __LINE__, current->pid,                      \
                ##__VA_ARGS__)
 #define mlx5_core_info(__dev, format, ...)                              \
@@ -75,6 +75,11 @@ enum {
        MLX5_CMD_TIME, /* print command execution time */
 };
+enum {
+        MLX5_DRIVER_STATUS_ABORTED = 0xfe,
+        MLX5_DRIVER_SYND = 0xbadd00de,
+};
 int mlx5_query_hca_caps(struct mlx5_core_dev *dev);
 int mlx5_query_board_id(struct mlx5_core_dev *dev);
 int mlx5_cmd_init_hca(struct mlx5_core_dev *dev);
@@ -83,6 +88,7 @@ void mlx5_core_event(struct mlx5_core_dev *dev, enum mlx5_dev_event event,
                     unsigned long param);
 void mlx5_enter_error_state(struct mlx5_core_dev *dev);
 void mlx5_disable_device(struct mlx5_core_dev *dev);
+void mlx5_recover_device(struct mlx5_core_dev *dev);
 int mlx5_sriov_init(struct mlx5_core_dev *dev);
 void mlx5_sriov_cleanup(struct mlx5_core_dev *dev);
 int mlx5_sriov_attach(struct mlx5_core_dev *dev);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index cc4fd61914d3..a57d5a81eb05 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -209,6 +209,7 @@ static void free_4k(struct mlx5_core_dev *dev, u64 addr)
 static int alloc_system_page(struct mlx5_core_dev *dev, u16 func_id)
 {
        struct page *page;
+        u64 zero_addr = 1;
        u64 addr;
        int err;
        int nid = dev_to_node(&dev->pdev->dev);
@@ -218,26 +219,35 @@ static int alloc_system_page(struct mlx5_core_dev *dev, u16 func_id)
                mlx5_core_warn(dev, "failed to allocate page\n");
                return -ENOMEM;
        }
+map:
        addr = dma_map_page(&dev->pdev->dev, page, 0,
                            PAGE_SIZE, DMA_BIDIRECTIONAL);
        if (dma_mapping_error(&dev->pdev->dev, addr)) {
                mlx5_core_warn(dev, "failed dma mapping page\n");
                err = -ENOMEM;
-                goto out_alloc;
+                goto err_mapping;
        }
+        /* Firmware doesn't support page with physical address 0 */
+        if (addr == 0) {
+                zero_addr = addr;
+                goto map;
+        }
        err = insert_page(dev, addr, page, func_id);
        if (err) {
                mlx5_core_err(dev, "failed to track allocated page\n");
-                goto out_mapping;
+                dma_unmap_page(&dev->pdev->dev, addr, PAGE_SIZE,
+                               DMA_BIDIRECTIONAL);
        }
-        return 0;
+err_mapping:
+        if (err)
-out_mapping:
+                __free_page(page);
-        dma_unmap_page(&dev->pdev->dev, addr, PAGE_SIZE, DMA_BIDIRECTIONAL);
-out_alloc:
+        if (zero_addr == 0)
-        __free_page(page);
+                dma_unmap_page(&dev->pdev->dev, zero_addr, PAGE_SIZE,
+                               DMA_BIDIRECTIONAL);
        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
index e742bd4e8894..912f71f84209 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
@@ -1838,11 +1838,17 @@ static const struct mlxsw_bus mlxsw_pci_bus = {
        .cmd_exec               = mlxsw_pci_cmd_exec,
 };
-static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci)
+static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci,
+                              const struct pci_device_id *id)
 {
        unsigned long end;
        mlxsw_pci_write32(mlxsw_pci, SW_RESET, MLXSW_PCI_SW_RESET_RST_BIT);
+        if (id->device == PCI_DEVICE_ID_MELLANOX_SWITCHX2) {
+                msleep(MLXSW_PCI_SW_RESET_TIMEOUT_MSECS);
+                return 0;
+        }
        wmb(); /* reset needs to be written before we read control register */
        end = jiffies + msecs_to_jiffies(MLXSW_PCI_SW_RESET_TIMEOUT_MSECS);
        do {
@@ -1909,7 +1915,7 @@ static int mlxsw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        mlxsw_pci->pdev = pdev;
        pci_set_drvdata(pdev, mlxsw_pci);
-        err = mlxsw_pci_sw_reset(mlxsw_pci);
+        err = mlxsw_pci_sw_reset(mlxsw_pci, id);
        if (err) {
                dev_err(&pdev->dev, "Software reset failed\n");
                goto err_sw_reset;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 1ec0a4ce3c46..dda5761e91bc 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -231,7 +231,7 @@ mlxsw_sp_span_entry_create(struct mlxsw_sp_port *port)
        span_entry->used = true;
        span_entry->id = index;
-        span_entry->ref_count = 0;
+        span_entry->ref_count = 1;
        span_entry->local_port = local_port;
        return span_entry;
 }
@@ -270,6 +270,7 @@ static struct mlxsw_sp_span_entry
        span_entry = mlxsw_sp_span_entry_find(port);
        if (span_entry) {
+                /* Already exists, just take a reference */
                span_entry->ref_count++;
                return span_entry;
        }
@@ -280,6 +281,7 @@ static struct mlxsw_sp_span_entry
 static int mlxsw_sp_span_entry_put(struct mlxsw_sp *mlxsw_sp,
                                   struct mlxsw_sp_span_entry *span_entry)
 {
+        WARN_ON(!span_entry->ref_count);
        if (--span_entry->ref_count == 0)
                mlxsw_sp_span_entry_destroy(mlxsw_sp, span_entry);
        return 0;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 9b22863a924b..97bbc1d21df8 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -115,7 +115,7 @@ struct mlxsw_sp_rif {
 struct mlxsw_sp_mid {
        struct list_head list;
        unsigned char addr[ETH_ALEN];
-        u16 vid;
+        u16 fid;
        u16 mid;
        unsigned int ref_count;
 };
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 78fc557d6dd7..e83072da6272 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -320,6 +320,8 @@ mlxsw_sp_lpm_tree_create(struct mlxsw_sp *mlxsw_sp,
                                                lpm_tree);
        if (err)
                goto err_left_struct_set;
+        memcpy(&lpm_tree->prefix_usage, prefix_usage,
+               sizeof(lpm_tree->prefix_usage));
        return lpm_tree;
 err_left_struct_set:
@@ -343,7 +345,8 @@ mlxsw_sp_lpm_tree_get(struct mlxsw_sp *mlxsw_sp,
        for (i = 0; i < MLXSW_SP_LPM_TREE_COUNT; i++) {
                lpm_tree = &mlxsw_sp->router.lpm_trees[i];
-                if (lpm_tree->proto == proto &&
+                if (lpm_tree->ref_count != 0 &&
+                    lpm_tree->proto == proto &&
                    mlxsw_sp_prefix_usage_eq(&lpm_tree->prefix_usage,
                                             prefix_usage))
                        goto inc_ref_count;
@@ -591,21 +594,22 @@ static int mlxsw_sp_vrs_init(struct mlxsw_sp *mlxsw_sp)
        return 0;
 }
+static void mlxsw_sp_router_fib_flush(struct mlxsw_sp *mlxsw_sp);
 static void mlxsw_sp_vrs_fini(struct mlxsw_sp *mlxsw_sp)
 {
+        mlxsw_sp_router_fib_flush(mlxsw_sp);
        kfree(mlxsw_sp->router.vrs);
 }
 struct mlxsw_sp_neigh_key {
-        unsigned char addr[sizeof(struct in6_addr)];
+        struct neighbour *n;
-        struct net_device *dev;
 };
 struct mlxsw_sp_neigh_entry {
        struct rhash_head ht_node;
        struct mlxsw_sp_neigh_key key;
        u16 rif;
-        struct neighbour *n;
        bool offloaded;
        struct delayed_work dw;
        struct mlxsw_sp_port *mlxsw_sp_port;
@@ -643,19 +647,15 @@ mlxsw_sp_neigh_entry_remove(struct mlxsw_sp *mlxsw_sp,
 static void mlxsw_sp_router_neigh_update_hw(struct work_struct *work);
 static struct mlxsw_sp_neigh_entry *
-mlxsw_sp_neigh_entry_create(const void *addr, size_t addr_len,
+mlxsw_sp_neigh_entry_create(struct neighbour *n, u16 rif)
-                            struct net_device *dev, u16 rif,
-                            struct neighbour *n)
 {
        struct mlxsw_sp_neigh_entry *neigh_entry;
        neigh_entry = kzalloc(sizeof(*neigh_entry), GFP_ATOMIC);
        if (!neigh_entry)
                return NULL;
-        memcpy(neigh_entry->key.addr, addr, addr_len);
+        neigh_entry->key.n = n;
-        neigh_entry->key.dev = dev;
        neigh_entry->rif = rif;
-        neigh_entry->n = n;
        INIT_DELAYED_WORK(&neigh_entry->dw, mlxsw_sp_router_neigh_update_hw);
        INIT_LIST_HEAD(&neigh_entry->nexthop_list);
        return neigh_entry;
@@ -668,13 +668,11 @@ mlxsw_sp_neigh_entry_destroy(struct mlxsw_sp_neigh_entry *neigh_entry)
 }
 static struct mlxsw_sp_neigh_entry *
-mlxsw_sp_neigh_entry_lookup(struct mlxsw_sp *mlxsw_sp, const void *addr,
+mlxsw_sp_neigh_entry_lookup(struct mlxsw_sp *mlxsw_sp, struct neighbour *n)
-                            size_t addr_len, struct net_device *dev)
 {
-        struct mlxsw_sp_neigh_key key = {{ 0 } };
+        struct mlxsw_sp_neigh_key key;
-        memcpy(key.addr, addr, addr_len);
+        key.n = n;
-        key.dev = dev;
        return rhashtable_lookup_fast(&mlxsw_sp->router.neigh_ht,
                                      &key, mlxsw_sp_neigh_ht_params);
 }
@@ -686,26 +684,20 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
        struct mlxsw_sp_neigh_entry *neigh_entry;
        struct mlxsw_sp_rif *r;
-        u32 dip;
        int err;
        if (n->tbl != &arp_tbl)
                return 0;
-        dip = ntohl(*((__be32 *) n->primary_key));
+        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
-        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &dip, sizeof(dip),
+        if (neigh_entry)
-                                                  n->dev);
-        if (neigh_entry) {
-                WARN_ON(neigh_entry->n != n);
                return 0;
-        }
        r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, n->dev);
        if (WARN_ON(!r))
                return -EINVAL;
-        neigh_entry = mlxsw_sp_neigh_entry_create(&dip, sizeof(dip), n->dev,
+        neigh_entry = mlxsw_sp_neigh_entry_create(n, r->rif);
-                                                  r->rif, n);
        if (!neigh_entry)
                return -ENOMEM;
        err = mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry);
@@ -724,14 +716,11 @@ void mlxsw_sp_router_neigh_destroy(struct net_device *dev,
        struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
        struct mlxsw_sp_neigh_entry *neigh_entry;
-        u32 dip;
        if (n->tbl != &arp_tbl)
                return;
-        dip = ntohl(*((__be32 *) n->primary_key));
+        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
-        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &dip, sizeof(dip),
-                                                  n->dev);
        if (!neigh_entry)
                return;
        mlxsw_sp_neigh_entry_remove(mlxsw_sp, neigh_entry);
@@ -814,6 +803,26 @@ static void mlxsw_sp_router_neigh_rec_process(struct mlxsw_sp *mlxsw_sp,
        }
 }
+static bool mlxsw_sp_router_rauhtd_is_full(char *rauhtd_pl)
+{
+        u8 num_rec, last_rec_index, num_entries;
+        num_rec = mlxsw_reg_rauhtd_num_rec_get(rauhtd_pl);
+        last_rec_index = num_rec - 1;
+        if (num_rec < MLXSW_REG_RAUHTD_REC_MAX_NUM)
+                return false;
+        if (mlxsw_reg_rauhtd_rec_type_get(rauhtd_pl, last_rec_index) ==
+            MLXSW_REG_RAUHTD_TYPE_IPV6)
+                return true;
+        num_entries = mlxsw_reg_rauhtd_ipv4_rec_num_entries_get(rauhtd_pl,
+                                                                last_rec_index);
+        if (++num_entries == MLXSW_REG_RAUHTD_IPV4_ENT_PER_REC)
+                return true;
+        return false;
+}
 static int mlxsw_sp_router_neighs_update_rauhtd(struct mlxsw_sp *mlxsw_sp)
 {
        char *rauhtd_pl;
@@ -840,7 +849,7 @@ static int mlxsw_sp_router_neighs_update_rauhtd(struct mlxsw_sp *mlxsw_sp)
                for (i = 0; i < num_rec; i++)
                        mlxsw_sp_router_neigh_rec_process(mlxsw_sp, rauhtd_pl,
                                                          i);
-        } while (num_rec);
+        } while (mlxsw_sp_router_rauhtd_is_full(rauhtd_pl));
        rtnl_unlock();
        kfree(rauhtd_pl);
@@ -859,7 +868,7 @@ static void mlxsw_sp_router_neighs_update_nh(struct mlxsw_sp *mlxsw_sp)
                 * is active regardless of the traffic.
                 */
                if (!list_empty(&neigh_entry->nexthop_list))
-                        neigh_event_send(neigh_entry->n, NULL);
+                        neigh_event_send(neigh_entry->key.n, NULL);
        }
        rtnl_unlock();
 }
@@ -905,9 +914,9 @@ static void mlxsw_sp_router_probe_unresolved_nexthops(struct work_struct *work)
        rtnl_lock();
        list_for_each_entry(neigh_entry, &mlxsw_sp->router.nexthop_neighs_list,
                            nexthop_neighs_list_node) {
-                if (!(neigh_entry->n->nud_state & NUD_VALID) &&
+                if (!(neigh_entry->key.n->nud_state & NUD_VALID) &&
                    !list_empty(&neigh_entry->nexthop_list))
-                        neigh_event_send(neigh_entry->n, NULL);
+                        neigh_event_send(neigh_entry->key.n, NULL);
        }
        rtnl_unlock();
@@ -924,7 +933,7 @@ static void mlxsw_sp_router_neigh_update_hw(struct work_struct *work)
 {
        struct mlxsw_sp_neigh_entry *neigh_entry =
                container_of(work, struct mlxsw_sp_neigh_entry, dw.work);
-        struct neighbour *n = neigh_entry->n;
+        struct neighbour *n = neigh_entry->key.n;
        struct mlxsw_sp_port *mlxsw_sp_port = neigh_entry->mlxsw_sp_port;
        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
        char rauht_pl[MLXSW_REG_RAUHT_LEN];
@@ -1027,11 +1036,8 @@ int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
                mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
                dip = ntohl(*((__be32 *) n->primary_key));
-                neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp,
+                neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
-                                                          &dip,
+                if (WARN_ON(!neigh_entry)) {
-                                                          sizeof(__be32),
-                                                          dev);
-                if (WARN_ON(!neigh_entry) || WARN_ON(neigh_entry->n != n)) {
                        mlxsw_sp_port_dev_put(mlxsw_sp_port);
                        return NOTIFY_DONE;
                }
@@ -1340,33 +1346,26 @@ static int mlxsw_sp_nexthop_init(struct mlxsw_sp *mlxsw_sp,
                                 struct fib_nh *fib_nh)
 {
        struct mlxsw_sp_neigh_entry *neigh_entry;
-        u32 gwip = ntohl(fib_nh->nh_gw);
        struct net_device *dev = fib_nh->nh_dev;
        struct neighbour *n;
        u8 nud_state;
-        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &gwip,
+        /* Take a reference of neigh here ensuring that neigh would
-                                                  sizeof(gwip), dev);
+         * not be detructed before the nexthop entry is finished.
-        if (!neigh_entry) {
+         * The reference is taken either in neigh_lookup() or
-                __be32 gwipn = htonl(gwip);
+         * in neith_create() in case n is not found.
+         */
-                n = neigh_create(&arp_tbl, &gwipn, dev);
+        n = neigh_lookup(&arp_tbl, &fib_nh->nh_gw, dev);
+        if (!n) {
+                n = neigh_create(&arp_tbl, &fib_nh->nh_gw, dev);
                if (IS_ERR(n))
                        return PTR_ERR(n);
                neigh_event_send(n, NULL);
-                neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &gwip,
+        }
-                                                          sizeof(gwip), dev);
+        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
-                if (!neigh_entry) {
+        if (!neigh_entry) {
-                        neigh_release(n);
+                neigh_release(n);
-                        return -EINVAL;
+                return -EINVAL;
-                }
-        } else {
-                /* Take a reference of neigh here ensuring that neigh would
-                 * not be detructed before the nexthop entry is finished.
-                 * The second branch takes the reference in neith_create()
-                 */
-                n = neigh_entry->n;
-                neigh_clone(n);
        }
        /* If that is the first nexthop connected to that neigh, add to
@@ -1400,7 +1399,7 @@ static void mlxsw_sp_nexthop_fini(struct mlxsw_sp *mlxsw_sp,
        if (list_empty(&nh->neigh_entry->nexthop_list))
                list_del(&nh->neigh_entry->nexthop_neighs_list_node);
-        neigh_release(neigh_entry->n);
+        neigh_release(neigh_entry->key.n);
 }
 static struct mlxsw_sp_nexthop_group *
@@ -1460,11 +1459,11 @@ static bool mlxsw_sp_nexthop_match(struct mlxsw_sp_nexthop *nh,
        for (i = 0; i < fi->fib_nhs; i++) {
                struct fib_nh *fib_nh = &fi->fib_nh[i];
-                u32 gwip = ntohl(fib_nh->nh_gw);
+                struct neighbour *n = nh->neigh_entry->key.n;
-                if (memcmp(nh->neigh_entry->key.addr,
+                if (memcmp(n->primary_key, &fib_nh->nh_gw,
-                           &gwip, sizeof(u32)) == 0 &&
+                           sizeof(fib_nh->nh_gw)) == 0 &&
-                    nh->neigh_entry->key.dev == fib_nh->nh_dev)
+                    n->dev == fib_nh->nh_dev)
                        return true;
        }
        return false;
@@ -1820,19 +1819,17 @@ err_fib_entry_insert:
        return err;
 }
-static int mlxsw_sp_router_fib4_del(struct mlxsw_sp *mlxsw_sp,
+static void mlxsw_sp_router_fib4_del(struct mlxsw_sp *mlxsw_sp,
-                                    struct fib_entry_notifier_info *fen_info)
+                                     struct fib_entry_notifier_info *fen_info)
 {
        struct mlxsw_sp_fib_entry *fib_entry;
        if (mlxsw_sp->router.aborted)
-                return 0;
+                return;
        fib_entry = mlxsw_sp_fib_entry_find(mlxsw_sp, fen_info);
-        if (!fib_entry) {
+        if (!fib_entry)
-                dev_warn(mlxsw_sp->bus_info->dev, "Failed to find FIB4 entry being removed.\n");
+                return;
-                return -ENOENT;
-        }
        if (fib_entry->ref_count == 1) {
                mlxsw_sp_fib_entry_del(mlxsw_sp, fib_entry);
@@ -1840,7 +1837,6 @@ static int mlxsw_sp_router_fib4_del(struct mlxsw_sp *mlxsw_sp,
        }
        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
-        return 0;
 }
 static int mlxsw_sp_router_set_abort_trap(struct mlxsw_sp *mlxsw_sp)
@@ -1862,7 +1858,8 @@ static int mlxsw_sp_router_set_abort_trap(struct mlxsw_sp *mlxsw_sp)
        if (err)
                return err;
-        mlxsw_reg_raltb_pack(raltb_pl, 0, MLXSW_REG_RALXX_PROTOCOL_IPV4, 0);
+        mlxsw_reg_raltb_pack(raltb_pl, 0, MLXSW_REG_RALXX_PROTOCOL_IPV4,
+                             MLXSW_SP_LPM_TREE_MIN);
        err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(raltb), raltb_pl);
        if (err)
                return err;
@@ -1873,18 +1870,18 @@ static int mlxsw_sp_router_set_abort_trap(struct mlxsw_sp *mlxsw_sp)
        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ralue), ralue_pl);
 }
-static void mlxsw_sp_router_fib4_abort(struct mlxsw_sp *mlxsw_sp)
+static void mlxsw_sp_router_fib_flush(struct mlxsw_sp *mlxsw_sp)
 {
        struct mlxsw_resources *resources;
        struct mlxsw_sp_fib_entry *fib_entry;
        struct mlxsw_sp_fib_entry *tmp;
        struct mlxsw_sp_vr *vr;
        int i;
-        int err;
        resources = mlxsw_core_resources_get(mlxsw_sp->core);
        for (i = 0; i < resources->max_virtual_routers; i++) {
                vr = &mlxsw_sp->router.vrs[i];
                if (!vr->used)
                        continue;
@@ -1900,6 +1897,13 @@ static void mlxsw_sp_router_fib4_abort(struct mlxsw_sp *mlxsw_sp)
                                break;
                }
        }
+}
+static void mlxsw_sp_router_fib4_abort(struct mlxsw_sp *mlxsw_sp)
+{
+        int err;
+        mlxsw_sp_router_fib_flush(mlxsw_sp);
        mlxsw_sp->router.aborted = true;
        err = mlxsw_sp_router_set_abort_trap(mlxsw_sp);
        if (err)
@@ -1957,6 +1961,9 @@ static int mlxsw_sp_router_fib_event(struct notifier_block *nb,
        struct fib_entry_notifier_info *fen_info = ptr;
        int err;
+        if (!net_eq(fen_info->info.net, &init_net))
+                return NOTIFY_DONE;
        switch (event) {
        case FIB_EVENT_ENTRY_ADD:
                err = mlxsw_sp_router_fib4_add(mlxsw_sp, fen_info);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 5e00c79e8133..1e2c8eca3af1 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -929,12 +929,12 @@ static int mlxsw_sp_port_smid_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 mid,
 static struct mlxsw_sp_mid *__mlxsw_sp_mc_get(struct mlxsw_sp *mlxsw_sp,
                                              const unsigned char *addr,
-                                              u16 vid)
+                                              u16 fid)
 {
        struct mlxsw_sp_mid *mid;
        list_for_each_entry(mid, &mlxsw_sp->br_mids.list, list) {
-                if (ether_addr_equal(mid->addr, addr) && mid->vid == vid)
+                if (ether_addr_equal(mid->addr, addr) && mid->fid == fid)
                        return mid;
        }
        return NULL;
@@ -942,7 +942,7 @@ static struct mlxsw_sp_mid *__mlxsw_sp_mc_get(struct mlxsw_sp *mlxsw_sp,
 static struct mlxsw_sp_mid *__mlxsw_sp_mc_alloc(struct mlxsw_sp *mlxsw_sp,
                                                const unsigned char *addr,
-                                                u16 vid)
+                                                u16 fid)
 {
        struct mlxsw_sp_mid *mid;
        u16 mid_idx;
@@ -958,7 +958,7 @@ static struct mlxsw_sp_mid *__mlxsw_sp_mc_alloc(struct mlxsw_sp *mlxsw_sp,
        set_bit(mid_idx, mlxsw_sp->br_mids.mapped);
        ether_addr_copy(mid->addr, addr);
-        mid->vid = vid;
+        mid->fid = fid;
        mid->mid = mid_idx;
        mid->ref_count = 0;
        list_add_tail(&mid->list, &mlxsw_sp->br_mids.list);
@@ -991,9 +991,9 @@ static int mlxsw_sp_port_mdb_add(struct mlxsw_sp_port *mlxsw_sp_port,
        if (switchdev_trans_ph_prepare(trans))
                return 0;
-        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, mdb->vid);
+        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, fid);
        if (!mid) {
-                mid = __mlxsw_sp_mc_alloc(mlxsw_sp, mdb->addr, mdb->vid);
+                mid = __mlxsw_sp_mc_alloc(mlxsw_sp, mdb->addr, fid);
                if (!mid) {
                        netdev_err(dev, "Unable to allocate MC group\n");
                        return -ENOMEM;
@@ -1137,7 +1137,7 @@ static int mlxsw_sp_port_mdb_del(struct mlxsw_sp_port *mlxsw_sp_port,
        u16 mid_idx;
        int err = 0;
-        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, mdb->vid);
+        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, fid);
        if (!mid) {
                netdev_err(dev, "Unable to remove port from MC DB\n");
                return -EINVAL;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
index c0c23e2f3275..92bda8703f87 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
@@ -1088,6 +1088,7 @@ err_port_stp_state_set:
 err_port_admin_status_set:
 err_port_mtu_set:
 err_port_speed_set:
+        mlxsw_sx_port_swid_set(mlxsw_sx_port, MLXSW_PORT_SWID_DISABLED_PORT);
 err_port_swid_set:
 err_port_system_port_mapping_set:
 port_not_usable:
diff --git a/drivers/net/ethernet/qlogic/Kconfig b/drivers/net/ethernet/qlogic/Kconfig
index 1e8339a67f6e..32f2a45f4ab2 100644
--- a/drivers/net/ethernet/qlogic/Kconfig
+++ b/drivers/net/ethernet/qlogic/Kconfig
@@ -107,4 +107,7 @@ config QEDE
        ---help---
          This enables the support for ...
+config QED_RDMA
+        bool
 endif # NET_VENDOR_QLOGIC
diff --git a/drivers/net/ethernet/qlogic/qed/Makefile b/drivers/net/ethernet/qlogic/qed/Makefile
index cda0af7fbc20..967acf322c09 100644
--- a/drivers/net/ethernet/qlogic/qed/Makefile
+++ b/drivers/net/ethernet/qlogic/qed/Makefile
@@ -5,4 +5,4 @@ qed-y := qed_cxt.o qed_dev.o qed_hw.o qed_init_fw_funcs.o qed_init_ops.o \
         qed_selftest.o qed_dcbx.o qed_debug.o
 qed-$(CONFIG_QED_SRIOV) += qed_sriov.o qed_vf.o
 qed-$(CONFIG_QED_LL2) += qed_ll2.o
-qed-$(CONFIG_INFINIBAND_QEDR) += qed_roce.o
+qed-$(CONFIG_QED_RDMA) += qed_roce.o
diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
index 82370a1a59ad..0c42c240b5cf 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
@@ -47,13 +47,8 @@
 #define TM_ALIGN        BIT(TM_SHIFT)
 #define TM_ELEM_SIZE    4
-/* ILT constants */
-#if IS_ENABLED(CONFIG_INFINIBAND_QEDR)
 /* For RoCE we configure to 64K to cover for RoCE max tasks 256K purpose. */
-#define ILT_DEFAULT_HW_P_SIZE           4
+#define ILT_DEFAULT_HW_P_SIZE   (IS_ENABLED(CONFIG_QED_RDMA) ? 4 : 3)
-#else
-#define ILT_DEFAULT_HW_P_SIZE           3
-#endif
 #define ILT_PAGE_IN_BYTES(hw_p_size)    (1U << ((hw_p_size) + 12))
 #define ILT_CFG_REG(cli, reg)   PSWRQ2_REG_ ## cli ## _ ## reg ## _RT_OFFSET
@@ -349,14 +344,14 @@ static struct qed_tid_seg *qed_cxt_tid_seg_info(struct qed_hwfn *p_hwfn,
        return NULL;
 }
-void qed_cxt_set_srq_count(struct qed_hwfn *p_hwfn, u32 num_srqs)
+static void qed_cxt_set_srq_count(struct qed_hwfn *p_hwfn, u32 num_srqs)
 {
        struct qed_cxt_mngr *p_mgr = p_hwfn->p_cxt_mngr;
        p_mgr->srq_count = num_srqs;
 }
-u32 qed_cxt_get_srq_count(struct qed_hwfn *p_hwfn)
+static u32 qed_cxt_get_srq_count(struct qed_hwfn *p_hwfn)
 {
        struct qed_cxt_mngr *p_mgr = p_hwfn->p_cxt_mngr;
@@ -1804,8 +1799,8 @@ int qed_cxt_get_cid_info(struct qed_hwfn *p_hwfn, struct qed_cxt_info *p_info)
        return 0;
 }
-void qed_rdma_set_pf_params(struct qed_hwfn *p_hwfn,
+static void qed_rdma_set_pf_params(struct qed_hwfn *p_hwfn,
-                            struct qed_rdma_pf_params *p_params)
+                                   struct qed_rdma_pf_params *p_params)
 {
        u32 num_cons, num_tasks, num_qps, num_mrs, num_srqs;
        enum protocol_type proto;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 130da1c0490b..a4789a93b692 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -1190,6 +1190,7 @@ int qed_dcbx_get_config_params(struct qed_hwfn *p_hwfn,
        if (!dcbx_info)
                return -ENOMEM;
+        memset(dcbx_info, 0, sizeof(*dcbx_info));
        rc = qed_dcbx_query_params(p_hwfn, dcbx_info, QED_DCBX_OPERATIONAL_MIB);
        if (rc) {
                kfree(dcbx_info);
@@ -1225,6 +1226,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct qed_hwfn *hwfn,
        if (!dcbx_info)
                return NULL;
+        memset(dcbx_info, 0, sizeof(*dcbx_info));
        if (qed_dcbx_query_params(hwfn, dcbx_info, type)) {
                kfree(dcbx_info);
                return NULL;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index 88e7d5bef909..68f19ca57f96 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -405,7 +405,7 @@ struct phy_defs {
 /***************************** Constant Arrays *******************************/
 /* Debug arrays */
-static struct dbg_array s_dbg_arrays[MAX_BIN_DBG_BUFFER_TYPE] = { {0} };
+static struct dbg_array s_dbg_arrays[MAX_BIN_DBG_BUFFER_TYPE] = { {NULL} };
 /* Chip constant definitions array */
 static struct chip_defs s_chip_defs[MAX_CHIP_IDS] = {
@@ -4028,10 +4028,10 @@ static enum dbg_status qed_mcp_trace_read_meta(struct qed_hwfn *p_hwfn,
 }
 /* Dump MCP Trace */
-enum dbg_status qed_mcp_trace_dump(struct qed_hwfn *p_hwfn,
+static enum dbg_status qed_mcp_trace_dump(struct qed_hwfn *p_hwfn,
-                                   struct qed_ptt *p_ptt,
+                                          struct qed_ptt *p_ptt,
-                                   u32 *dump_buf,
+                                          u32 *dump_buf,
-                                   bool dump, u32 *num_dumped_dwords)
+                                          bool dump, u32 *num_dumped_dwords)
 {
        u32 trace_data_grc_addr, trace_data_size_bytes, trace_data_size_dwords;
        u32 trace_meta_size_dwords, running_bundle_id, offset = 0;
@@ -4130,10 +4130,10 @@ enum dbg_status qed_mcp_trace_dump(struct qed_hwfn *p_hwfn,
 }
 /* Dump GRC FIFO */
-enum dbg_status qed_reg_fifo_dump(struct qed_hwfn *p_hwfn,
+static enum dbg_status qed_reg_fifo_dump(struct qed_hwfn *p_hwfn,
-                                  struct qed_ptt *p_ptt,
+                                         struct qed_ptt *p_ptt,
-                                  u32 *dump_buf,
+                                         u32 *dump_buf,
-                                  bool dump, u32 *num_dumped_dwords)
+                                         bool dump, u32 *num_dumped_dwords)
 {
        u32 offset = 0, dwords_read, size_param_offset;
        bool fifo_has_data;
@@ -4192,10 +4192,10 @@ enum dbg_status qed_reg_fifo_dump(struct qed_hwfn *p_hwfn,
 }
 /* Dump IGU FIFO */
-enum dbg_status qed_igu_fifo_dump(struct qed_hwfn *p_hwfn,
+static enum dbg_status qed_igu_fifo_dump(struct qed_hwfn *p_hwfn,
-                                  struct qed_ptt *p_ptt,
+                                         struct qed_ptt *p_ptt,
-                                  u32 *dump_buf,
+                                         u32 *dump_buf,
-                                  bool dump, u32 *num_dumped_dwords)
+                                         bool dump, u32 *num_dumped_dwords)
 {
        u32 offset = 0, dwords_read, size_param_offset;
        bool fifo_has_data;
@@ -4255,10 +4255,11 @@ enum dbg_status qed_igu_fifo_dump(struct qed_hwfn *p_hwfn,
 }
 /* Protection Override dump */
-enum dbg_status qed_protection_override_dump(struct qed_hwfn *p_hwfn,
+static enum dbg_status qed_protection_override_dump(struct qed_hwfn *p_hwfn,
-                                             struct qed_ptt *p_ptt,
+                                                    struct qed_ptt *p_ptt,
-                                             u32 *dump_buf,
+                                                    u32 *dump_buf,
-                                             bool dump, u32 *num_dumped_dwords)
+                                                    bool dump,
+                                                    u32 *num_dumped_dwords)
 {
        u32 offset = 0, size_param_offset, override_window_dwords;
@@ -6339,10 +6340,11 @@ enum dbg_status qed_print_fw_asserts_results(struct qed_hwfn *p_hwfn,
 }
 /* Wrapper for unifying the idle_chk and mcp_trace api */
-enum dbg_status qed_print_idle_chk_results_wrapper(struct qed_hwfn *p_hwfn,
+static enum dbg_status
-                                                   u32 *dump_buf,
+qed_print_idle_chk_results_wrapper(struct qed_hwfn *p_hwfn,
-                                                   u32 num_dumped_dwords,
+                                   u32 *dump_buf,
-                                                   char *results_buf)
+                                   u32 num_dumped_dwords,
+                                   char *results_buf)
 {
        u32 num_errors, num_warnnings;
@@ -6413,8 +6415,8 @@ static void qed_dbg_print_feature(u8 *p_text_buf, u32 text_size)
 #define QED_RESULTS_BUF_MIN_SIZE 16
 /* Generic function for decoding debug feature info */
-enum dbg_status format_feature(struct qed_hwfn *p_hwfn,
+static enum dbg_status format_feature(struct qed_hwfn *p_hwfn,
-                               enum qed_dbg_features feature_idx)
+                                      enum qed_dbg_features feature_idx)
 {
        struct qed_dbg_feature *feature =
            &p_hwfn->cdev->dbg_params.features[feature_idx];
@@ -6480,8 +6482,9 @@ enum dbg_status format_feature(struct qed_hwfn *p_hwfn,
 }
 /* Generic function for performing the dump of a debug feature. */
-enum dbg_status qed_dbg_dump(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+static enum dbg_status qed_dbg_dump(struct qed_hwfn *p_hwfn,
-                             enum qed_dbg_features feature_idx)
+                                    struct qed_ptt *p_ptt,
+                                    enum qed_dbg_features feature_idx)
 {
        struct qed_dbg_feature *feature =
            &p_hwfn->cdev->dbg_params.features[feature_idx];
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 754f6a908858..edae5fc5fccd 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -497,12 +497,13 @@ int qed_resc_alloc(struct qed_dev *cdev)
                if (p_hwfn->hw_info.personality == QED_PCI_ETH_ROCE) {
                        num_cons = qed_cxt_get_proto_cid_count(p_hwfn,
                                                               PROTOCOLID_ROCE,
-                                                               0) * 2;
+                                                               NULL) * 2;
                        n_eqes += num_cons + 2 * MAX_NUM_VFS_BB;
                } else if (p_hwfn->hw_info.personality == QED_PCI_ISCSI) {
                        num_cons =
                            qed_cxt_get_proto_cid_count(p_hwfn,
-                                                        PROTOCOLID_ISCSI, 0);
+                                                        PROTOCOLID_ISCSI,
+                                                        NULL);
                        n_eqes += 2 * num_cons;
                }
@@ -1422,19 +1423,19 @@ static void qed_hw_set_feat(struct qed_hwfn *p_hwfn)
        u32 *feat_num = p_hwfn->hw_info.feat_num;
        int num_features = 1;
-#if IS_ENABLED(CONFIG_INFINIBAND_QEDR)
+        if (IS_ENABLED(CONFIG_QED_RDMA) &&
-        /* Roce CNQ each requires: 1 status block + 1 CNQ. We divide the
+            p_hwfn->hw_info.personality == QED_PCI_ETH_ROCE) {
-         * status blocks equally between L2 / RoCE but with consideration as
+                /* Roce CNQ each requires: 1 status block + 1 CNQ. We divide
-         * to how many l2 queues / cnqs we have
+                 * the status blocks equally between L2 / RoCE but with
-         */
+                 * consideration as to how many l2 queues / cnqs we have.
-        if (p_hwfn->hw_info.personality == QED_PCI_ETH_ROCE) {
+                 */
                num_features++;
                feat_num[QED_RDMA_CNQ] =
                        min_t(u32, RESC_NUM(p_hwfn, QED_SB) / num_features,
                              RESC_NUM(p_hwfn, QED_RDMA_CNQ_RAM));
        }
-#endif
        feat_num[QED_PF_L2_QUE] = min_t(u32, RESC_NUM(p_hwfn, QED_SB) /
                                                num_features,
                                        RESC_NUM(p_hwfn, QED_L2_QUEUE));
diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
index 72eee29c677f..2777d5bb4380 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
@@ -727,9 +727,6 @@ struct core_tx_bd_flags {
 #define CORE_TX_BD_FLAGS_L4_PROTOCOL_SHIFT      6
 #define CORE_TX_BD_FLAGS_L4_PSEUDO_CSUM_MODE_MASK       0x1
 #define CORE_TX_BD_FLAGS_L4_PSEUDO_CSUM_MODE_SHIFT 7
-#define CORE_TX_BD_FLAGS_ROCE_FLAV_MASK         0x1
-#define CORE_TX_BD_FLAGS_ROCE_FLAV_SHIFT        12
 };
 struct core_tx_bd {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 02a8be2faed7..62ae55bd81b8 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -38,6 +38,7 @@
 #include "qed_mcp.h"
 #include "qed_reg_addr.h"
 #include "qed_sp.h"
+#include "qed_roce.h"
 #define QED_LL2_RX_REGISTERED(ll2)      ((ll2)->rx_queue.b_cb_registred)
 #define QED_LL2_TX_REGISTERED(ll2)      ((ll2)->tx_queue.b_cb_registred)
@@ -140,11 +141,11 @@ static void qed_ll2_kill_buffers(struct qed_dev *cdev)
                qed_ll2_dealloc_buffer(cdev, buffer);
 }
-void qed_ll2b_complete_rx_packet(struct qed_hwfn *p_hwfn,
+static void qed_ll2b_complete_rx_packet(struct qed_hwfn *p_hwfn,
-                                 u8 connection_handle,
+                                        u8 connection_handle,
-                                 struct qed_ll2_rx_packet *p_pkt,
+                                        struct qed_ll2_rx_packet *p_pkt,
-                                 struct core_rx_fast_path_cqe *p_cqe,
+                                        struct core_rx_fast_path_cqe *p_cqe,
-                                 bool b_last_packet)
+                                        bool b_last_packet)
 {
        u16 packet_length = le16_to_cpu(p_cqe->packet_length);
        struct qed_ll2_buffer *buffer = p_pkt->cookie;
@@ -515,7 +516,7 @@ static int qed_ll2_rxq_completion(struct qed_hwfn *p_hwfn, void *cookie)
        return rc;
 }
-void qed_ll2_rxq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
+static void qed_ll2_rxq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
 {
        struct qed_ll2_info *p_ll2_conn = NULL;
        struct qed_ll2_rx_packet *p_pkt = NULL;
@@ -537,8 +538,7 @@ void qed_ll2_rxq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
                if (!p_pkt)
                        break;
-                list_del(&p_pkt->list_entry);
+                list_move_tail(&p_pkt->list_entry, &p_rx->free_descq);
-                list_add_tail(&p_pkt->list_entry, &p_rx->free_descq);
                rx_buf_addr = p_pkt->rx_buf_addr;
                cookie = p_pkt->cookie;
@@ -992,9 +992,8 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn,
                p_posting_packet = list_first_entry(&p_rx->posting_descq,
                                                    struct qed_ll2_rx_packet,
                                                    list_entry);
-                list_del(&p_posting_packet->list_entry);
+                list_move_tail(&p_posting_packet->list_entry,
-                list_add_tail(&p_posting_packet->list_entry,
+                               &p_rx->active_descq);
-                              &p_rx->active_descq);
                b_notify_fw = true;
        }
@@ -1120,12 +1119,10 @@ static void qed_ll2_prepare_tx_packet_set_bd(struct qed_hwfn *p_hwfn,
        start_bd->bd_flags.as_bitfield |= CORE_TX_BD_FLAGS_START_BD_MASK <<
            CORE_TX_BD_FLAGS_START_BD_SHIFT;
        SET_FIELD(start_bd->bitfield0, CORE_TX_BD_NBDS, num_of_bds);
+        SET_FIELD(start_bd->bitfield0, CORE_TX_BD_ROCE_FLAV, type);
        DMA_REGPAIR_LE(start_bd->addr, first_frag);
        start_bd->nbytes = cpu_to_le16(first_frag_len);
-        SET_FIELD(start_bd->bd_flags.as_bitfield, CORE_TX_BD_FLAGS_ROCE_FLAV,
-                  type);
        DP_VERBOSE(p_hwfn,
                   (NETIF_MSG_TX_QUEUED | QED_MSG_LL2),
                   "LL2 [q 0x%02x cid 0x%08x type 0x%08x] Tx Producer at [0x%04x] - set with a %04x bytes %02x BDs buffer at %08x:%08x\n",
@@ -1188,8 +1185,7 @@ static void qed_ll2_tx_packet_notify(struct qed_hwfn *p_hwfn,
                if (!p_pkt)
                        break;
-                list_del(&p_pkt->list_entry);
+                list_move_tail(&p_pkt->list_entry, &p_tx->active_descq);
-                list_add_tail(&p_pkt->list_entry, &p_tx->active_descq);
        }
        SET_FIELD(db_msg.params, CORE_DB_DATA_DEST, DB_DEST_XCM);
@@ -1734,6 +1730,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb)
                                                       mapping))) {
                                DP_NOTICE(cdev,
                                          "Unable to map frag - dropping packet\n");
+                                rc = -ENOMEM;
                                goto err;
                        }
                } else {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.h b/drivers/net/ethernet/qlogic/qed/qed_ll2.h
index 80a5dc2d652d..4e3d62a16cab 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.h
@@ -293,24 +293,4 @@ void qed_ll2_setup(struct qed_hwfn *p_hwfn,
 */
 void qed_ll2_free(struct qed_hwfn *p_hwfn,
                  struct qed_ll2_info *p_ll2_connections);
-void qed_ll2b_complete_rx_gsi_packet(struct qed_hwfn *p_hwfn,
-                                     u8 connection_handle,
-                                     void *cookie,
-                                     dma_addr_t rx_buf_addr,
-                                     u16 data_length,
-                                     u8 data_length_error,
-                                     u16 parse_flags,
-                                     u16 vlan,
-                                     u32 src_mac_addr_hi,
-                                     u16 src_mac_addr_lo, bool b_last_packet);
-void qed_ll2b_complete_tx_gsi_packet(struct qed_hwfn *p_hwfn,
-                                     u8 connection_handle,
-                                     void *cookie,
-                                     dma_addr_t first_frag_addr,
-                                     bool b_last_fragment, bool b_last_packet);
-void qed_ll2b_release_tx_gsi_packet(struct qed_hwfn *p_hwfn,
-                                    u8 connection_handle,
-                                    void *cookie,
-                                    dma_addr_t first_frag_addr,
-                                    bool b_last_fragment, bool b_last_packet);
 #endif
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 4ee3151e80c2..333c7442e48a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -33,10 +33,8 @@
 #include "qed_hw.h"
 #include "qed_selftest.h"
-#if IS_ENABLED(CONFIG_INFINIBAND_QEDR)
 #define QED_ROCE_QPS                    (8192)
 #define QED_ROCE_DPIS                   (8)
-#endif
 static char version[] =
        "QLogic FastLinQ 4xxxx Core Module qed " DRV_MODULE_VERSION "\n";
@@ -682,9 +680,7 @@ static int qed_slowpath_setup_int(struct qed_dev *cdev,
                                  enum qed_int_mode int_mode)
 {
        struct qed_sb_cnt_info sb_cnt_info;
-#if IS_ENABLED(CONFIG_INFINIBAND_QEDR)
+        int num_l2_queues = 0;
-        int num_l2_queues;
-#endif
        int rc;
        int i;
@@ -715,8 +711,9 @@ static int qed_slowpath_setup_int(struct qed_dev *cdev,
        cdev->int_params.fp_msix_cnt = cdev->int_params.out.num_vectors -
                                       cdev->num_hwfns;
-#if IS_ENABLED(CONFIG_INFINIBAND_QEDR)
+        if (!IS_ENABLED(CONFIG_QED_RDMA))
-        num_l2_queues = 0;
+                return 0;
        for_each_hwfn(cdev, i)
                num_l2_queues += FEAT_NUM(&cdev->hwfns[i], QED_PF_L2_QUE);
@@ -738,7 +735,6 @@ static int qed_slowpath_setup_int(struct qed_dev *cdev,
        DP_VERBOSE(cdev, QED_MSG_RDMA, "roce_msix_cnt=%d roce_msix_base=%d\n",
                   cdev->int_params.rdma_msix_cnt,
                   cdev->int_params.rdma_msix_base);
-#endif
        return 0;
 }
@@ -843,13 +839,14 @@ static void qed_update_pf_params(struct qed_dev *cdev,
 {
        int i;
-#if IS_ENABLED(CONFIG_INFINIBAND_QEDR)
+        if (IS_ENABLED(CONFIG_QED_RDMA)) {
-        params->rdma_pf_params.num_qps = QED_ROCE_QPS;
+                params->rdma_pf_params.num_qps = QED_ROCE_QPS;
-        params->rdma_pf_params.min_dpis = QED_ROCE_DPIS;
+                params->rdma_pf_params.min_dpis = QED_ROCE_DPIS;
-        /* divide by 3 the MRs to avoid MF ILT overflow */
+                /* divide by 3 the MRs to avoid MF ILT overflow */
-        params->rdma_pf_params.num_mrs = RDMA_MAX_TIDS;
+                params->rdma_pf_params.num_mrs = RDMA_MAX_TIDS;
-        params->rdma_pf_params.gl_pi = QED_ROCE_PROTOCOL_INDEX;
+                params->rdma_pf_params.gl_pi = QED_ROCE_PROTOCOL_INDEX;
-#endif
+        }
        for (i = 0; i < cdev->num_hwfns; i++) {
                struct qed_hwfn *p_hwfn = &cdev->hwfns[i];
@@ -880,6 +877,7 @@ static int qed_slowpath_start(struct qed_dev *cdev,
                }
        }
+        cdev->rx_coalesce_usecs = QED_DEFAULT_RX_USECS;
        rc = qed_nic_setup(cdev);
        if (rc)
                goto err;
@@ -1432,7 +1430,7 @@ static int qed_set_led(struct qed_dev *cdev, enum qed_led_mode mode)
        return status;
 }
-struct qed_selftest_ops qed_selftest_ops_pass = {
+static struct qed_selftest_ops qed_selftest_ops_pass = {
        .selftest_memory = &qed_selftest_memory,
        .selftest_interrupt = &qed_selftest_interrupt,
        .selftest_register = &qed_selftest_register,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
index 76831a398bed..f3a825a8f8d5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
@@ -129,17 +129,12 @@ static void qed_bmap_release_id(struct qed_hwfn *p_hwfn,
        }
 }
-u32 qed_rdma_get_sb_id(void *p_hwfn, u32 rel_sb_id)
+static u32 qed_rdma_get_sb_id(void *p_hwfn, u32 rel_sb_id)
 {
        /* First sb id for RoCE is after all the l2 sb */
        return FEAT_NUM((struct qed_hwfn *)p_hwfn, QED_PF_L2_QUE) + rel_sb_id;
 }
-u32 qed_rdma_query_cau_timer_res(void *rdma_cxt)
-{
-        return QED_CAU_DEF_RX_TIMER_RES;
-}
 static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
                          struct qed_ptt *p_ptt,
                          struct qed_rdma_start_in_params *params)
@@ -162,7 +157,8 @@ static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
        p_hwfn->p_rdma_info = p_rdma_info;
        p_rdma_info->proto = PROTOCOLID_ROCE;
-        num_cons = qed_cxt_get_proto_cid_count(p_hwfn, p_rdma_info->proto, 0);
+        num_cons = qed_cxt_get_proto_cid_count(p_hwfn, p_rdma_info->proto,
+                                               NULL);
        p_rdma_info->num_qps = num_cons / 2;
@@ -275,7 +271,7 @@ free_rdma_info:
        return rc;
 }
-void qed_rdma_resc_free(struct qed_hwfn *p_hwfn)
+static void qed_rdma_resc_free(struct qed_hwfn *p_hwfn)
 {
        struct qed_rdma_info *p_rdma_info = p_hwfn->p_rdma_info;
@@ -527,6 +523,26 @@ static int qed_rdma_start_fw(struct qed_hwfn *p_hwfn,
        return qed_spq_post(p_hwfn, p_ent, NULL);
 }
+static int qed_rdma_alloc_tid(void *rdma_cxt, u32 *itid)
+{
+        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
+        int rc;
+        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocate TID\n");
+        spin_lock_bh(&p_hwfn->p_rdma_info->lock);
+        rc = qed_rdma_bmap_alloc_id(p_hwfn,
+                                    &p_hwfn->p_rdma_info->tid_map, itid);
+        spin_unlock_bh(&p_hwfn->p_rdma_info->lock);
+        if (rc)
+                goto out;
+        rc = qed_cxt_dynamic_ilt_alloc(p_hwfn, QED_ELEM_TASK, *itid);
+out:
+        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocate TID - done, rc = %d\n", rc);
+        return rc;
+}
 static int qed_rdma_reserve_lkey(struct qed_hwfn *p_hwfn)
 {
        struct qed_rdma_device *dev = p_hwfn->p_rdma_info->dev;
@@ -573,7 +589,7 @@ static int qed_rdma_setup(struct qed_hwfn *p_hwfn,
        return qed_rdma_start_fw(p_hwfn, params, p_ptt);
 }
-int qed_rdma_stop(void *rdma_cxt)
+static int qed_rdma_stop(void *rdma_cxt)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        struct rdma_close_func_ramrod_data *p_ramrod;
@@ -629,8 +645,8 @@ out:
        return rc;
 }
-int qed_rdma_add_user(void *rdma_cxt,
+static int qed_rdma_add_user(void *rdma_cxt,
-                      struct qed_rdma_add_user_out_params *out_params)
+                             struct qed_rdma_add_user_out_params *out_params)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        u32 dpi_start_offset;
@@ -664,7 +680,7 @@ int qed_rdma_add_user(void *rdma_cxt,
        return rc;
 }
-struct qed_rdma_port *qed_rdma_query_port(void *rdma_cxt)
+static struct qed_rdma_port *qed_rdma_query_port(void *rdma_cxt)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        struct qed_rdma_port *p_port = p_hwfn->p_rdma_info->port;
@@ -680,7 +696,7 @@ struct qed_rdma_port *qed_rdma_query_port(void *rdma_cxt)
        return p_port;
 }
-struct qed_rdma_device *qed_rdma_query_device(void *rdma_cxt)
+static struct qed_rdma_device *qed_rdma_query_device(void *rdma_cxt)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
@@ -690,7 +706,7 @@ struct qed_rdma_device *qed_rdma_query_device(void *rdma_cxt)
        return p_hwfn->p_rdma_info->dev;
 }
-void qed_rdma_free_tid(void *rdma_cxt, u32 itid)
+static void qed_rdma_free_tid(void *rdma_cxt, u32 itid)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
@@ -701,27 +717,7 @@ void qed_rdma_free_tid(void *rdma_cxt, u32 itid)
        spin_unlock_bh(&p_hwfn->p_rdma_info->lock);
 }
-int qed_rdma_alloc_tid(void *rdma_cxt, u32 *itid)
+static void qed_rdma_cnq_prod_update(void *rdma_cxt, u8 qz_offset, u16 prod)
-{
-        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
-        int rc;
-        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocate TID\n");
-        spin_lock_bh(&p_hwfn->p_rdma_info->lock);
-        rc = qed_rdma_bmap_alloc_id(p_hwfn,
-                                    &p_hwfn->p_rdma_info->tid_map, itid);
-        spin_unlock_bh(&p_hwfn->p_rdma_info->lock);
-        if (rc)
-                goto out;
-        rc = qed_cxt_dynamic_ilt_alloc(p_hwfn, QED_ELEM_TASK, *itid);
-out:
-        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocate TID - done, rc = %d\n", rc);
-        return rc;
-}
-void qed_rdma_cnq_prod_update(void *rdma_cxt, u8 qz_offset, u16 prod)
 {
        struct qed_hwfn *p_hwfn;
        u16 qz_num;
@@ -816,7 +812,7 @@ static int qed_rdma_get_int(struct qed_dev *cdev, struct qed_int_info *info)
        return 0;
 }
-int qed_rdma_alloc_pd(void *rdma_cxt, u16 *pd)
+static int qed_rdma_alloc_pd(void *rdma_cxt, u16 *pd)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        u32 returned_id;
@@ -836,7 +832,7 @@ int qed_rdma_alloc_pd(void *rdma_cxt, u16 *pd)
        return rc;
 }
-void qed_rdma_free_pd(void *rdma_cxt, u16 pd)
+static void qed_rdma_free_pd(void *rdma_cxt, u16 pd)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
@@ -873,8 +869,9 @@ qed_rdma_toggle_bit_create_resize_cq(struct qed_hwfn *p_hwfn, u16 icid)
        return toggle_bit;
 }
-int qed_rdma_create_cq(void *rdma_cxt,
+static int qed_rdma_create_cq(void *rdma_cxt,
-                       struct qed_rdma_create_cq_in_params *params, u16 *icid)
+                              struct qed_rdma_create_cq_in_params *params,
+                              u16 *icid)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        struct qed_rdma_info *p_info = p_hwfn->p_rdma_info;
@@ -957,98 +954,10 @@ err:
        return rc;
 }
-int qed_rdma_resize_cq(void *rdma_cxt,
+static int
-                       struct qed_rdma_resize_cq_in_params *in_params,
+qed_rdma_destroy_cq(void *rdma_cxt,
-                       struct qed_rdma_resize_cq_out_params *out_params)
+                    struct qed_rdma_destroy_cq_in_params *in_params,
-{
+                    struct qed_rdma_destroy_cq_out_params *out_params)
-        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
-        struct rdma_resize_cq_output_params *p_ramrod_res;
-        struct rdma_resize_cq_ramrod_data *p_ramrod;
-        enum qed_rdma_toggle_bit toggle_bit;
-        struct qed_sp_init_data init_data;
-        struct qed_spq_entry *p_ent;
-        dma_addr_t ramrod_res_phys;
-        u8 fw_return_code;
-        int rc = -ENOMEM;
-        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "icid = %08x\n", in_params->icid);
-        p_ramrod_res =
-            (struct rdma_resize_cq_output_params *)
-            dma_alloc_coherent(&p_hwfn->cdev->pdev->dev,
-                               sizeof(struct rdma_resize_cq_output_params),
-                               &ramrod_res_phys, GFP_KERNEL);
-        if (!p_ramrod_res) {
-                DP_NOTICE(p_hwfn,
-                          "qed resize cq failed: cannot allocate memory (ramrod)\n");
-                return rc;
-        }
-        /* Get SPQ entry */
-        memset(&init_data, 0, sizeof(init_data));
-        init_data.cid = in_params->icid;
-        init_data.opaque_fid = p_hwfn->hw_info.opaque_fid;
-        init_data.comp_mode = QED_SPQ_MODE_EBLOCK;
-        rc = qed_sp_init_request(p_hwfn, &p_ent,
-                                 RDMA_RAMROD_RESIZE_CQ,
-                                 p_hwfn->p_rdma_info->proto, &init_data);
-        if (rc)
-                goto err;
-        p_ramrod = &p_ent->ramrod.rdma_resize_cq;
-        p_ramrod->flags = 0;
-        /* toggle the bit for every resize or create cq for a given icid */
-        toggle_bit = qed_rdma_toggle_bit_create_resize_cq(p_hwfn,
-                                                          in_params->icid);
-        SET_FIELD(p_ramrod->flags,
-                  RDMA_RESIZE_CQ_RAMROD_DATA_TOGGLE_BIT, toggle_bit);
-        SET_FIELD(p_ramrod->flags,
-                  RDMA_RESIZE_CQ_RAMROD_DATA_IS_TWO_LEVEL_PBL,
-                  in_params->pbl_two_level);
-        p_ramrod->pbl_log_page_size = in_params->pbl_page_size_log - 12;
-        p_ramrod->pbl_num_pages = cpu_to_le16(in_params->pbl_num_pages);
-        p_ramrod->max_cqes = cpu_to_le32(in_params->cq_size);
-        DMA_REGPAIR_LE(p_ramrod->pbl_addr, in_params->pbl_ptr);
-        DMA_REGPAIR_LE(p_ramrod->output_params_addr, ramrod_res_phys);
-        rc = qed_spq_post(p_hwfn, p_ent, &fw_return_code);
-        if (rc)
-                goto err;
-        if (fw_return_code != RDMA_RETURN_OK) {
-                DP_NOTICE(p_hwfn, "fw_return_code = %d\n", fw_return_code);
-                rc = -EINVAL;
-                goto err;
-        }
-        out_params->prod = le32_to_cpu(p_ramrod_res->old_cq_prod);
-        out_params->cons = le32_to_cpu(p_ramrod_res->old_cq_cons);
-        dma_free_coherent(&p_hwfn->cdev->pdev->dev,
-                          sizeof(struct rdma_resize_cq_output_params),
-                          p_ramrod_res, ramrod_res_phys);
-        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Resized CQ, rc = %d\n", rc);
-        return rc;
-err:    dma_free_coherent(&p_hwfn->cdev->pdev->dev,
-                          sizeof(struct rdma_resize_cq_output_params),
-                          p_ramrod_res, ramrod_res_phys);
-        DP_NOTICE(p_hwfn, "Resized CQ, Failed - rc = %d\n", rc);
-        return rc;
-}
-int qed_rdma_destroy_cq(void *rdma_cxt,
-                        struct qed_rdma_destroy_cq_in_params *in_params,
-                        struct qed_rdma_destroy_cq_out_params *out_params)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        struct rdma_destroy_cq_output_params *p_ramrod_res;
@@ -1169,7 +1078,7 @@ static enum roce_flavor qed_roce_mode_to_flavor(enum roce_mode roce_mode)
        return flavor;
 }
-int qed_roce_alloc_cid(struct qed_hwfn *p_hwfn, u16 *cid)
+static int qed_roce_alloc_cid(struct qed_hwfn *p_hwfn, u16 *cid)
 {
        struct qed_rdma_info *p_rdma_info = p_hwfn->p_rdma_info;
        u32 responder_icid;
@@ -1793,9 +1702,9 @@ err:
        return rc;
 }
-int qed_roce_query_qp(struct qed_hwfn *p_hwfn,
+static int qed_roce_query_qp(struct qed_hwfn *p_hwfn,
-                      struct qed_rdma_qp *qp,
+                             struct qed_rdma_qp *qp,
-                      struct qed_rdma_query_qp_out_params *out_params)
+                             struct qed_rdma_query_qp_out_params *out_params)
 {
        struct roce_query_qp_resp_output_params *p_resp_ramrod_res;
        struct roce_query_qp_req_output_params *p_req_ramrod_res;
@@ -1936,7 +1845,7 @@ err_resp:
        return rc;
 }
-int qed_roce_destroy_qp(struct qed_hwfn *p_hwfn, struct qed_rdma_qp *qp)
+static int qed_roce_destroy_qp(struct qed_hwfn *p_hwfn, struct qed_rdma_qp *qp)
 {
        u32 num_invalidated_mw = 0;
        u32 num_bound_mw = 0;
@@ -1985,9 +1894,9 @@ int qed_roce_destroy_qp(struct qed_hwfn *p_hwfn, struct qed_rdma_qp *qp)
        return 0;
 }
-int qed_rdma_query_qp(void *rdma_cxt,
+static int qed_rdma_query_qp(void *rdma_cxt,
-                      struct qed_rdma_qp *qp,
+                             struct qed_rdma_qp *qp,
-                      struct qed_rdma_query_qp_out_params *out_params)
+                             struct qed_rdma_query_qp_out_params *out_params)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        int rc;
@@ -2022,7 +1931,7 @@ int qed_rdma_query_qp(void *rdma_cxt,
        return rc;
 }
-int qed_rdma_destroy_qp(void *rdma_cxt, struct qed_rdma_qp *qp)
+static int qed_rdma_destroy_qp(void *rdma_cxt, struct qed_rdma_qp *qp)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        int rc = 0;
@@ -2038,7 +1947,7 @@ int qed_rdma_destroy_qp(void *rdma_cxt, struct qed_rdma_qp *qp)
        return rc;
 }
-struct qed_rdma_qp *
+static struct qed_rdma_qp *
 qed_rdma_create_qp(void *rdma_cxt,
                   struct qed_rdma_create_qp_in_params *in_params,
                   struct qed_rdma_create_qp_out_params *out_params)
@@ -2215,9 +2124,9 @@ static int qed_roce_modify_qp(struct qed_hwfn *p_hwfn,
        return rc;
 }
-int qed_rdma_modify_qp(void *rdma_cxt,
+static int qed_rdma_modify_qp(void *rdma_cxt,
-                       struct qed_rdma_qp *qp,
+                              struct qed_rdma_qp *qp,
-                       struct qed_rdma_modify_qp_in_params *params)
+                              struct qed_rdma_modify_qp_in_params *params)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        enum qed_roce_qp_state prev_state;
@@ -2312,8 +2221,9 @@ int qed_rdma_modify_qp(void *rdma_cxt,
        return rc;
 }
-int qed_rdma_register_tid(void *rdma_cxt,
+static int
-                          struct qed_rdma_register_tid_in_params *params)
+qed_rdma_register_tid(void *rdma_cxt,
+                      struct qed_rdma_register_tid_in_params *params)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        struct rdma_register_tid_ramrod_data *p_ramrod;
@@ -2450,7 +2360,7 @@ int qed_rdma_register_tid(void *rdma_cxt,
        return rc;
 }
-int qed_rdma_deregister_tid(void *rdma_cxt, u32 itid)
+static int qed_rdma_deregister_tid(void *rdma_cxt, u32 itid)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        struct rdma_deregister_tid_ramrod_data *p_ramrod;
@@ -2561,7 +2471,8 @@ void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
        qed_rdma_dpm_conf(p_hwfn, p_ptt);
 }
-int qed_rdma_start(void *rdma_cxt, struct qed_rdma_start_in_params *params)
+static int qed_rdma_start(void *rdma_cxt,
+                          struct qed_rdma_start_in_params *params)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
        struct qed_ptt *p_ptt;
@@ -2601,7 +2512,7 @@ static int qed_rdma_init(struct qed_dev *cdev,
        return qed_rdma_start(QED_LEADING_HWFN(cdev), params);
 }
-void qed_rdma_remove_user(void *rdma_cxt, u16 dpi)
+static void qed_rdma_remove_user(void *rdma_cxt, u16 dpi)
 {
        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
@@ -2809,11 +2720,6 @@ static int qed_roce_ll2_stop(struct qed_dev *cdev)
        struct qed_roce_ll2_info *roce_ll2 = hwfn->ll2;
        int rc;
-        if (!cdev) {
-                DP_ERR(cdev, "qed roce ll2 stop: invalid cdev\n");
-                return -EINVAL;
-        }
        if (roce_ll2->handle == QED_LL2_UNUSED_HANDLE) {
                DP_ERR(cdev, "qed roce ll2 stop: cannot stop an unused LL2\n");
                return -EINVAL;
@@ -2850,7 +2756,7 @@ static int qed_roce_ll2_tx(struct qed_dev *cdev,
        int rc;
        int i;
-        if (!cdev || !pkt || !params) {
+        if (!pkt || !params) {
                DP_ERR(cdev,
                       "roce ll2 tx: failed tx because one of the following is NULL - drv=%p, pkt=%p, params=%p\n",
                       cdev, pkt, params);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.h b/drivers/net/ethernet/qlogic/qed/qed_roce.h
index 2f091e8a0f40..279f342af8db 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_roce.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_roce.h
@@ -95,26 +95,6 @@ struct qed_rdma_info {
        enum protocol_type proto;
 };
-struct qed_rdma_resize_cq_in_params {
-        u16 icid;
-        u32 cq_size;
-        bool pbl_two_level;
-        u64 pbl_ptr;
-        u16 pbl_num_pages;
-        u8 pbl_page_size_log;
-};
-struct qed_rdma_resize_cq_out_params {
-        u32 prod;
-        u32 cons;
-};
-struct qed_rdma_resize_cnq_in_params {
-        u32 cnq_id;
-        u32 pbl_page_size_log;
-        u64 pbl_ptr;
-};
 struct qed_rdma_qp {
        struct regpair qp_handle;
        struct regpair qp_handle_async;
@@ -181,36 +161,55 @@ struct qed_rdma_qp {
        dma_addr_t shared_queue_phys_addr;
 };
-int
+#if IS_ENABLED(CONFIG_QED_RDMA)
-qed_rdma_add_user(void *rdma_cxt,
+void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
-                  struct qed_rdma_add_user_out_params *out_params);
-int qed_rdma_alloc_pd(void *rdma_cxt, u16 *pd);
-int qed_rdma_alloc_tid(void *rdma_cxt, u32 *tid);
-int qed_rdma_deregister_tid(void *rdma_cxt, u32 tid);
-void qed_rdma_free_tid(void *rdma_cxt, u32 tid);
-struct qed_rdma_device *qed_rdma_query_device(void *rdma_cxt);
-struct qed_rdma_port *qed_rdma_query_port(void *rdma_cxt);
-int
-qed_rdma_register_tid(void *rdma_cxt,
-                      struct qed_rdma_register_tid_in_params *params);
-void qed_rdma_remove_user(void *rdma_cxt, u16 dpi);
-int qed_rdma_start(void *p_hwfn, struct qed_rdma_start_in_params *params);
-int qed_rdma_stop(void *rdma_cxt);
-u32 qed_rdma_get_sb_id(void *p_hwfn, u32 rel_sb_id);
-u32 qed_rdma_query_cau_timer_res(void *p_hwfn);
-void qed_rdma_cnq_prod_update(void *rdma_cxt, u8 cnq_index, u16 prod);
-void qed_rdma_resc_free(struct qed_hwfn *p_hwfn);
 void qed_async_roce_event(struct qed_hwfn *p_hwfn,
                          struct event_ring_entry *p_eqe);
-int qed_rdma_destroy_qp(void *rdma_cxt, struct qed_rdma_qp *qp);
+void qed_ll2b_complete_tx_gsi_packet(struct qed_hwfn *p_hwfn,
-int qed_rdma_modify_qp(void *rdma_cxt, struct qed_rdma_qp *qp,
+                                     u8 connection_handle,
-                       struct qed_rdma_modify_qp_in_params *params);
+                                     void *cookie,
-int qed_rdma_query_qp(void *rdma_cxt, struct qed_rdma_qp *qp,
+                                     dma_addr_t first_frag_addr,
-                      struct qed_rdma_query_qp_out_params *out_params);
+                                     bool b_last_fragment, bool b_last_packet);
+void qed_ll2b_release_tx_gsi_packet(struct qed_hwfn *p_hwfn,
-#if IS_ENABLED(CONFIG_INFINIBAND_QEDR)
+                                    u8 connection_handle,
-void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
+                                    void *cookie,
+                                    dma_addr_t first_frag_addr,
+                                    bool b_last_fragment, bool b_last_packet);
+void qed_ll2b_complete_rx_gsi_packet(struct qed_hwfn *p_hwfn,
+                                     u8 connection_handle,
+                                     void *cookie,
+                                     dma_addr_t rx_buf_addr,
+                                     u16 data_length,
+                                     u8 data_length_error,
+                                     u16 parse_flags,
+                                     u16 vlan,
+                                     u32 src_mac_addr_hi,
+                                     u16 src_mac_addr_lo, bool b_last_packet);
 #else
-void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) {}
+static inline void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) {}
+static inline void qed_async_roce_event(struct qed_hwfn *p_hwfn, struct event_ring_entry *p_eqe) {}
+static inline void qed_ll2b_complete_tx_gsi_packet(struct qed_hwfn *p_hwfn,
+                                                   u8 connection_handle,
+                                                   void *cookie,
+                                                   dma_addr_t first_frag_addr,
+                                                   bool b_last_fragment,
+                                                   bool b_last_packet) {}
+static inline void qed_ll2b_release_tx_gsi_packet(struct qed_hwfn *p_hwfn,
+                                                  u8 connection_handle,
+                                                  void *cookie,
+                                                  dma_addr_t first_frag_addr,
+                                                  bool b_last_fragment,
+                                                  bool b_last_packet) {}
+static inline void qed_ll2b_complete_rx_gsi_packet(struct qed_hwfn *p_hwfn,
+                                                   u8 connection_handle,
+                                                   void *cookie,
+                                                   dma_addr_t rx_buf_addr,
+                                                   u16 data_length,
+                                                   u8 data_length_error,
+                                                   u16 parse_flags,
+                                                   u16 vlan,
+                                                   u32 src_mac_addr_hi,
+                                                   u16 src_mac_addr_lo,
+                                                   bool b_last_packet) {}
 #endif
 #endif
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
index 652c90819758..b2c08e4d2a9b 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
@@ -80,7 +80,6 @@ union ramrod_data {
        struct roce_destroy_qp_resp_ramrod_data roce_destroy_qp_resp;
        struct roce_destroy_qp_req_ramrod_data roce_destroy_qp_req;
        struct rdma_create_cq_ramrod_data rdma_create_cq;
-        struct rdma_resize_cq_ramrod_data rdma_resize_cq;
        struct rdma_destroy_cq_ramrod_data rdma_destroy_cq;
        struct rdma_srq_create_ramrod_data rdma_create_srq;
        struct rdma_srq_destroy_ramrod_data rdma_destroy_srq;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
index caff41544898..9fbaf9429fd0 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
@@ -28,9 +28,7 @@
 #include "qed_reg_addr.h"
 #include "qed_sp.h"
 #include "qed_sriov.h"
-#if IS_ENABLED(CONFIG_INFINIBAND_QEDR)
 #include "qed_roce.h"
-#endif
 /***************************************************************************
 * Structures & Definitions
@@ -240,11 +238,9 @@ qed_async_event_completion(struct qed_hwfn *p_hwfn,
                           struct event_ring_entry *p_eqe)
 {
        switch (p_eqe->protocol_id) {
-#if IS_ENABLED(CONFIG_INFINIBAND_QEDR)
        case PROTOCOLID_ROCE:
                qed_async_roce_event(p_hwfn, p_eqe);
                return 0;
-#endif
        case PROTOCOLID_COMMON:
                return qed_sriov_eqe_event(p_hwfn,
                                           p_eqe->opcode,
diff --git a/drivers/net/ethernet/qlogic/qede/Makefile b/drivers/net/ethernet/qlogic/qede/Makefile
index 28dc58919c85..048a230c3ce0 100644
--- a/drivers/net/ethernet/qlogic/qede/Makefile
+++ b/drivers/net/ethernet/qlogic/qede/Makefile
@@ -2,4 +2,4 @@ obj-$(CONFIG_QEDE) := qede.o
 qede-y := qede_main.o qede_ethtool.o
 qede-$(CONFIG_DCB) += qede_dcbnl.o
-qede-$(CONFIG_INFINIBAND_QEDR) += qede_roce.o
+qede-$(CONFIG_QED_RDMA) += qede_roce.o
diff --git a/drivers/net/ethernet/qlogic/qede/qede.h b/drivers/net/ethernet/qlogic/qede/qede.h
index 28c0e9f42c9e..974689a13337 100644
--- a/drivers/net/ethernet/qlogic/qede/qede.h
+++ b/drivers/net/ethernet/qlogic/qede/qede.h
@@ -348,12 +348,13 @@ bool qede_has_rx_work(struct qede_rx_queue *rxq);
 int qede_txq_has_work(struct qede_tx_queue *txq);
 void qede_recycle_rx_bd_ring(struct qede_rx_queue *rxq, struct qede_dev *edev,
                             u8 count);
+void qede_update_rx_prod(struct qede_dev *edev, struct qede_rx_queue *rxq);
 #define RX_RING_SIZE_POW        13
 #define RX_RING_SIZE            ((u16)BIT(RX_RING_SIZE_POW))
 #define NUM_RX_BDS_MAX          (RX_RING_SIZE - 1)
 #define NUM_RX_BDS_MIN          128
-#define NUM_RX_BDS_DEF          NUM_RX_BDS_MAX
+#define NUM_RX_BDS_DEF          ((u16)BIT(10) - 1)
 #define TX_RING_SIZE_POW        13
 #define TX_RING_SIZE            ((u16)BIT(TX_RING_SIZE_POW))
diff --git a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
index 25a9b293ee8f..7567cc464b88 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
@@ -175,16 +175,23 @@ static void qede_get_strings_stats(struct qede_dev *edev, u8 *buf)
        for (i = 0, k = 0; i < QEDE_QUEUE_CNT(edev); i++) {
                int tc;
-                for (j = 0; j < QEDE_NUM_RQSTATS; j++)
+                if (edev->fp_array[i].type & QEDE_FASTPATH_RX) {
-                        sprintf(buf + (k + j) * ETH_GSTRING_LEN,
+                        for (j = 0; j < QEDE_NUM_RQSTATS; j++)
-                                "%d:   %s", i, qede_rqstats_arr[j].string);
-                k += QEDE_NUM_RQSTATS;
-                for (tc = 0; tc < edev->num_tc; tc++) {
-                        for (j = 0; j < QEDE_NUM_TQSTATS; j++)
                                sprintf(buf + (k + j) * ETH_GSTRING_LEN,
-                                        "%d.%d: %s", i, tc,
+                                        "%d:   %s", i,
-                                        qede_tqstats_arr[j].string);
+                                        qede_rqstats_arr[j].string);
-                        k += QEDE_NUM_TQSTATS;
+                        k += QEDE_NUM_RQSTATS;
+                }
+                if (edev->fp_array[i].type & QEDE_FASTPATH_TX) {
+                        for (tc = 0; tc < edev->num_tc; tc++) {
+                                for (j = 0; j < QEDE_NUM_TQSTATS; j++)
+                                        sprintf(buf + (k + j) *
+                                                ETH_GSTRING_LEN,
+                                                "%d.%d: %s", i, tc,
+                                                qede_tqstats_arr[j].string);
+                                k += QEDE_NUM_TQSTATS;
+                        }
                }
        }
@@ -756,6 +763,8 @@ static void qede_get_channels(struct net_device *dev,
        struct qede_dev *edev = netdev_priv(dev);
        channels->max_combined = QEDE_MAX_RSS_CNT(edev);
+        channels->max_rx = QEDE_MAX_RSS_CNT(edev);
+        channels->max_tx = QEDE_MAX_RSS_CNT(edev);
        channels->combined_count = QEDE_QUEUE_CNT(edev) - edev->fp_num_tx -
                                        edev->fp_num_rx;
        channels->tx_count = edev->fp_num_tx;
@@ -820,6 +829,13 @@ static int qede_set_channels(struct net_device *dev,
        edev->req_queues = count;
        edev->req_num_tx = channels->tx_count;
        edev->req_num_rx = channels->rx_count;
+        /* Reset the indirection table if rx queue count is updated */
+        if ((edev->req_queues - edev->req_num_tx) != QEDE_RSS_COUNT(edev)) {
+                edev->rss_params_inited &= ~QEDE_RSS_INDIR_INITED;
+                memset(&edev->rss_params.rss_ind_table, 0,
+                       sizeof(edev->rss_params.rss_ind_table));
+        }
        if (netif_running(dev))
                qede_reload(edev, NULL, NULL);
@@ -1053,6 +1069,12 @@ static int qede_set_rxfh(struct net_device *dev, const u32 *indir,
        struct qede_dev *edev = netdev_priv(dev);
        int i;
+        if (edev->dev_info.common.num_hwfns > 1) {
+                DP_INFO(edev,
+                        "RSS configuration is not supported for 100G devices\n");
+                return -EOPNOTSUPP;
+        }
        if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP)
                return -EOPNOTSUPP;
@@ -1184,8 +1206,8 @@ static int qede_selftest_transmit_traffic(struct qede_dev *edev,
        }
        first_bd = (struct eth_tx_1st_bd *)qed_chain_consume(&txq->tx_pbl);
-        dma_unmap_page(&edev->pdev->dev, BD_UNMAP_ADDR(first_bd),
+        dma_unmap_single(&edev->pdev->dev, BD_UNMAP_ADDR(first_bd),
-                       BD_UNMAP_LEN(first_bd), DMA_TO_DEVICE);
+                         BD_UNMAP_LEN(first_bd), DMA_TO_DEVICE);
        txq->sw_tx_cons++;
        txq->sw_tx_ring[idx].skb = NULL;
@@ -1199,8 +1221,8 @@ static int qede_selftest_receive_traffic(struct qede_dev *edev)
        struct qede_rx_queue *rxq = NULL;
        struct sw_rx_data *sw_rx_data;
        union eth_rx_cqe *cqe;
+        int i, rc = 0;
        u8 *data_ptr;
-        int i;
        for_each_queue(i) {
                if (edev->fp_array[i].type & QEDE_FASTPATH_RX) {
@@ -1219,46 +1241,60 @@ static int qede_selftest_receive_traffic(struct qede_dev *edev)
         * queue and that the loopback traffic is not IP.
         */
        for (i = 0; i < QEDE_SELFTEST_POLL_COUNT; i++) {
-                if (qede_has_rx_work(rxq))
+                if (!qede_has_rx_work(rxq)) {
+                        usleep_range(100, 200);
+                        continue;
+                }
+                hw_comp_cons = le16_to_cpu(*rxq->hw_cons_ptr);
+                sw_comp_cons = qed_chain_get_cons_idx(&rxq->rx_comp_ring);
+                /* Memory barrier to prevent the CPU from doing speculative
+                 * reads of CQE/BD before reading hw_comp_cons. If the CQE is
+                 * read before it is written by FW, then FW writes CQE and SB,
+                 * and then the CPU reads the hw_comp_cons, it will use an old
+                 * CQE.
+                 */
+                rmb();
+                /* Get the CQE from the completion ring */
+                cqe = (union eth_rx_cqe *)qed_chain_consume(&rxq->rx_comp_ring);
+                /* Get the data from the SW ring */
+                sw_rx_index = rxq->sw_rx_cons & NUM_RX_BDS_MAX;
+                sw_rx_data = &rxq->sw_rx_ring[sw_rx_index];
+                fp_cqe = &cqe->fast_path_regular;
+                len =  le16_to_cpu(fp_cqe->len_on_first_bd);
+                data_ptr = (u8 *)(page_address(sw_rx_data->data) +
+                                  fp_cqe->placement_offset +
+                                  sw_rx_data->page_offset);
+                if (ether_addr_equal(data_ptr,  edev->ndev->dev_addr) &&
+                    ether_addr_equal(data_ptr + ETH_ALEN,
+                                     edev->ndev->dev_addr)) {
+                        for (i = ETH_HLEN; i < len; i++)
+                                if (data_ptr[i] != (unsigned char)(i & 0xff)) {
+                                        rc = -1;
+                                        break;
+                                }
+                        qede_recycle_rx_bd_ring(rxq, edev, 1);
+                        qed_chain_recycle_consumed(&rxq->rx_comp_ring);
                        break;
-                usleep_range(100, 200);
+                }
+                DP_INFO(edev, "Not the transmitted packet\n");
+                qede_recycle_rx_bd_ring(rxq, edev, 1);
+                qed_chain_recycle_consumed(&rxq->rx_comp_ring);
        }
-        if (!qede_has_rx_work(rxq)) {
+        if (i == QEDE_SELFTEST_POLL_COUNT) {
                DP_NOTICE(edev, "Failed to receive the traffic\n");
                return -1;
        }
-        hw_comp_cons = le16_to_cpu(*rxq->hw_cons_ptr);
+        qede_update_rx_prod(edev, rxq);
-        sw_comp_cons = qed_chain_get_cons_idx(&rxq->rx_comp_ring);
-        /* Memory barrier to prevent the CPU from doing speculative reads of CQE
+        return rc;
-         * / BD before reading hw_comp_cons. If the CQE is read before it is
-         * written by FW, then FW writes CQE and SB, and then the CPU reads the
-         * hw_comp_cons, it will use an old CQE.
-         */
-        rmb();
-        /* Get the CQE from the completion ring */
-        cqe = (union eth_rx_cqe *)qed_chain_consume(&rxq->rx_comp_ring);
-        /* Get the data from the SW ring */
-        sw_rx_index = rxq->sw_rx_cons & NUM_RX_BDS_MAX;
-        sw_rx_data = &rxq->sw_rx_ring[sw_rx_index];
-        fp_cqe = &cqe->fast_path_regular;
-        len =  le16_to_cpu(fp_cqe->len_on_first_bd);
-        data_ptr = (u8 *)(page_address(sw_rx_data->data) +
-                     fp_cqe->placement_offset + sw_rx_data->page_offset);
-        for (i = ETH_HLEN; i < len; i++)
-                if (data_ptr[i] != (unsigned char)(i & 0xff)) {
-                        DP_NOTICE(edev, "Loopback test failed\n");
-                        qede_recycle_rx_bd_ring(rxq, edev, 1);
-                        return -1;
-                }
-        qede_recycle_rx_bd_ring(rxq, edev, 1);
-        return 0;
 }
 static int qede_selftest_run_loopback(struct qede_dev *edev, u32 loopback_mode)
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 343038ca047d..85f46dbecd5b 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -313,8 +313,8 @@ static int qede_free_tx_pkt(struct qede_dev *edev,
                split_bd_len = BD_UNMAP_LEN(split);
                bds_consumed++;
        }
-        dma_unmap_page(&edev->pdev->dev, BD_UNMAP_ADDR(first_bd),
+        dma_unmap_single(&edev->pdev->dev, BD_UNMAP_ADDR(first_bd),
-                       BD_UNMAP_LEN(first_bd) + split_bd_len, DMA_TO_DEVICE);
+                         BD_UNMAP_LEN(first_bd) + split_bd_len, DMA_TO_DEVICE);
        /* Unmap the data of the skb frags */
        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++, bds_consumed++) {
@@ -359,8 +359,8 @@ static void qede_free_failed_tx_pkt(struct qede_dev *edev,
                nbd--;
        }
-        dma_unmap_page(&edev->pdev->dev, BD_UNMAP_ADDR(first_bd),
+        dma_unmap_single(&edev->pdev->dev, BD_UNMAP_ADDR(first_bd),
-                       BD_UNMAP_LEN(first_bd) + split_bd_len, DMA_TO_DEVICE);
+                         BD_UNMAP_LEN(first_bd) + split_bd_len, DMA_TO_DEVICE);
        /* Unmap the data of the skb frags */
        for (i = 0; i < nbd; i++) {
@@ -943,8 +943,7 @@ static inline int qede_realloc_rx_buffer(struct qede_dev *edev,
        return 0;
 }
-static inline void qede_update_rx_prod(struct qede_dev *edev,
+void qede_update_rx_prod(struct qede_dev *edev, struct qede_rx_queue *rxq)
-                                       struct qede_rx_queue *rxq)
 {
        u16 bd_prod = qed_chain_get_prod_idx(&rxq->rx_bd_ring);
        u16 cqe_prod = qed_chain_get_prod_idx(&rxq->rx_comp_ring);
@@ -2840,7 +2839,7 @@ static int qede_alloc_sge_mem(struct qede_dev *edev, struct qede_rx_queue *rxq)
                }
                mapping = dma_map_page(&edev->pdev->dev, replace_buf->data, 0,
-                                       rxq->rx_buf_size, DMA_FROM_DEVICE);
+                                       PAGE_SIZE, DMA_FROM_DEVICE);
                if (unlikely(dma_mapping_error(&edev->pdev->dev, mapping))) {
                        DP_NOTICE(edev,
                                  "Failed to map TPA replacement buffer\n");
@@ -2941,7 +2940,7 @@ static int qede_alloc_mem_txq(struct qede_dev *edev, struct qede_tx_queue *txq)
        txq->num_tx_buffers = edev->q_num_tx_buffers;
        /* Allocate the parallel driver ring for Tx buffers */
-        size = sizeof(*txq->sw_tx_ring) * NUM_TX_BDS_MAX;
+        size = sizeof(*txq->sw_tx_ring) * TX_RING_SIZE;
        txq->sw_tx_ring = kzalloc(size, GFP_KERNEL);
        if (!txq->sw_tx_ring) {
                DP_NOTICE(edev, "Tx buffers ring allocation failed\n");
@@ -2952,7 +2951,7 @@ static int qede_alloc_mem_txq(struct qede_dev *edev, struct qede_tx_queue *txq)
                                            QED_CHAIN_USE_TO_CONSUME_PRODUCE,
                                            QED_CHAIN_MODE_PBL,
                                            QED_CHAIN_CNT_TYPE_U16,
-                                            NUM_TX_BDS_MAX,
+                                            TX_RING_SIZE,
                                            sizeof(*p_virt), &txq->tx_pbl);
        if (rc)
                goto err;
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index e97968ed4b8f..0b4deb31e742 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -575,10 +575,11 @@ void emac_mac_start(struct emac_adapter *adpt)
        mac |= TXEN | RXEN;     /* enable RX/TX */
-        /* We don't have ethtool support yet, so force flow-control mode
+        /* Configure MAC flow control to match the PHY's settings. */
-         * to 'full' always.
+        if (phydev->pause)
-         */
+                mac |= RXFC;
-        mac |= TXFC | RXFC;
+        if (phydev->pause != phydev->asym_pause)
+                mac |= TXFC;
        /* setup link speed */
        mac &= ~SPEED_MASK;
@@ -1003,6 +1004,12 @@ int emac_mac_up(struct emac_adapter *adpt)
        writel((u32)~DIS_INT, adpt->base + EMAC_INT_STATUS);
        writel(adpt->irq.mask, adpt->base + EMAC_INT_MASK);
+        /* Enable pause frames.  Without this feature, the EMAC has been shown
+         * to receive (and drop) frames with FCS errors at gigabit connections.
+         */
+        adpt->phydev->supported |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+        adpt->phydev->advertising |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
        adpt->phydev->irq = PHY_IGNORE_INTERRUPT;
        phy_start(adpt->phydev);
@@ -1021,14 +1028,18 @@ void emac_mac_down(struct emac_adapter *adpt)
        napi_disable(&adpt->rx_q.napi);
        phy_stop(adpt->phydev);
-        phy_disconnect(adpt->phydev);
-        /* disable mac irq */
+        /* Interrupts must be disabled before the PHY is disconnected, to
+         * avoid a race condition where adjust_link is null when we get
+         * an interrupt.
+         */
        writel(DIS_INT, adpt->base + EMAC_INT_STATUS);
        writel(0, adpt->base + EMAC_INT_MASK);
        synchronize_irq(adpt->irq.irq);
        free_irq(adpt->irq.irq, &adpt->irq);
+        phy_disconnect(adpt->phydev);
        emac_mac_reset(adpt);
        emac_tx_q_descs_free(adpt);
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index da4e90db4d98..99a14df28b96 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -212,6 +212,7 @@ int emac_phy_config(struct platform_device *pdev, struct emac_adapter *adpt)
                phy_np = of_parse_phandle(np, "phy-handle", 0);
                adpt->phydev = of_phy_find_device(phy_np);
+                of_node_put(phy_np);
        }
        if (!adpt->phydev) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c b/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c
index 75c1b530e39e..72fe343c7a36 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c
@@ -421,7 +421,7 @@ static const struct emac_reg_write sgmii_v2_laned[] = {
        /* CDR Settings */
        {EMAC_SGMII_LN_UCDR_FO_GAIN_MODE0,
                UCDR_STEP_BY_TWO_MODE0 | UCDR_xO_GAIN_MODE(10)},
-        {EMAC_SGMII_LN_UCDR_SO_GAIN_MODE0, UCDR_xO_GAIN_MODE(6)},
+        {EMAC_SGMII_LN_UCDR_SO_GAIN_MODE0, UCDR_xO_GAIN_MODE(0)},
        {EMAC_SGMII_LN_UCDR_SO_CONFIG, UCDR_ENABLE | UCDR_SO_SATURATION(12)},
        /* TX/RX Settings */
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 9bf3b2b82e95..57b35aeac51a 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -575,6 +575,7 @@ static const struct of_device_id emac_dt_match[] = {
        },
        {}
 };
+MODULE_DEVICE_TABLE(of, emac_dt_match);
 #if IS_ENABLED(CONFIG_ACPI)
 static const struct acpi_device_id emac_acpi_match[] = {
@@ -710,6 +711,8 @@ static int emac_probe(struct platform_device *pdev)
 err_undo_napi:
        netif_napi_del(&adpt->rx_q.napi);
 err_undo_mdiobus:
+        if (!has_acpi_companion(&pdev->dev))
+                put_device(&adpt->phydev->mdio.dev);
        mdiobus_unregister(adpt->mii_bus);
 err_undo_clocks:
        emac_clks_teardown(adpt);
@@ -729,6 +732,8 @@ static int emac_remove(struct platform_device *pdev)
        emac_clks_teardown(adpt);
+        if (!has_acpi_companion(&pdev->dev))
+                put_device(&adpt->phydev->mdio.dev);
        mdiobus_unregister(adpt->mii_bus);
        free_netdev(netdev);
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index e55638c7505a..bf000d819a21 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -8273,7 +8273,8 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if ((sizeof(dma_addr_t) > 4) &&
            (use_dac == 1 || (use_dac == -1 && pci_is_pcie(pdev) &&
                              tp->mac_version >= RTL_GIGA_MAC_VER_18)) &&
-            !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+            !pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
+            !pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
                /* CPlusCmd Dual Access Cycle is only needed for non-PCIe */
                if (!pci_is_pcie(pdev))
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 630536bc72f9..d6a217874a8b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1008,20 +1008,18 @@ static int ravb_phy_init(struct net_device *ndev)
        of_node_put(pn);
        if (!phydev) {
                netdev_err(ndev, "failed to connect PHY\n");
-                return -ENOENT;
+                err = -ENOENT;
+                goto err_deregister_fixed_link;
        }
        /* This driver only support 10/100Mbit speeds on Gen3
         * at this time.
         */
        if (priv->chip_id == RCAR_GEN3) {
-                int err;
                err = phy_set_max_speed(phydev, SPEED_100);
                if (err) {
                        netdev_err(ndev, "failed to limit PHY to 100Mbit/s\n");
-                        phy_disconnect(phydev);
+                        goto err_phy_disconnect;
-                        return err;
                }
                netdev_info(ndev, "limited PHY to 100Mbit/s\n");
@@ -1033,6 +1031,14 @@ static int ravb_phy_init(struct net_device *ndev)
        phy_attached_info(phydev);
        return 0;
+err_phy_disconnect:
+        phy_disconnect(phydev);
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+        return err;
 }
 /* PHY control start function */
@@ -1634,6 +1640,7 @@ static void ravb_set_rx_mode(struct net_device *ndev)
 /* Device close function for Ethernet AVB */
 static int ravb_close(struct net_device *ndev)
 {
+        struct device_node *np = ndev->dev.parent->of_node;
        struct ravb_private *priv = netdev_priv(ndev);
        struct ravb_tstamp_skb *ts_skb, *ts_skb2;
@@ -1663,6 +1670,8 @@ static int ravb_close(struct net_device *ndev)
        if (ndev->phydev) {
                phy_stop(ndev->phydev);
                phy_disconnect(ndev->phydev);
+                if (of_phy_is_fixed_link(np))
+                        of_phy_deregister_fixed_link(np);
        }
        if (priv->chip_id != RCAR_GEN2) {
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 05b0dc55de77..1a92de705199 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -518,7 +518,7 @@ static struct sh_eth_cpu_data r7s72100_data = {
        .ecsr_value     = ECSR_ICD,
        .ecsipr_value   = ECSIPR_ICDIP,
-        .eesipr_value   = 0xff7f009f,
+        .eesipr_value   = 0xe77f009f,
        .tx_check       = EESR_TC1 | EESR_FTC,
        .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c
index 5424fb341613..24b746406bc7 100644
--- a/drivers/net/ethernet/rocker/rocker_main.c
+++ b/drivers/net/ethernet/rocker/rocker_main.c
@@ -1471,7 +1471,7 @@ static int rocker_world_check_init(struct rocker_port *rocker_port)
        if (rocker->wops) {
                if (rocker->wops->mode != mode) {
                        dev_err(&rocker->pdev->dev, "hardware has ports in different worlds, which is not supported\n");
-                        return err;
+                        return -EINVAL;
                }
                return 0;
        }
diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c
index 431a60804272..4ca461322d60 100644
--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c
+++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c
@@ -1493,8 +1493,6 @@ static int ofdpa_port_ipv4_nh(struct ofdpa_port *ofdpa_port,
        spin_lock_irqsave(&ofdpa->neigh_tbl_lock, lock_flags);
        found = ofdpa_neigh_tbl_find(ofdpa, ip_addr);
-        if (found)
-                *index = found->index;
        updating = found && adding;
        removing = found && !adding;
@@ -1508,9 +1506,11 @@ static int ofdpa_port_ipv4_nh(struct ofdpa_port *ofdpa_port,
                resolved = false;
        } else if (removing) {
                ofdpa_neigh_del(trans, found);
+                *index = found->index;
        } else if (updating) {
                ofdpa_neigh_update(found, trans, NULL, false);
                resolved = !is_zero_ether_addr(found->eth_dst);
+                *index = found->index;
        } else {
                err = -ENOENT;
        }
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 3cf3557106c2..6b89e4a7b164 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -485,6 +485,9 @@ efx_copy_channel(const struct efx_channel *old_channel)
        *channel = *old_channel;
        channel->napi_dev = NULL;
+        INIT_HLIST_NODE(&channel->napi_str.napi_hash_node);
+        channel->napi_str.napi_id = 0;
+        channel->napi_str.state = 0;
        memset(&channel->eventq, 0, sizeof(channel->eventq));
        for (j = 0; j < EFX_TXQ_TYPES; j++) {
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index e9b8579e6241..8b0016a785c0 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -438,9 +438,16 @@ static int smsc911x_request_resources(struct platform_device *pdev)
        ret = regulator_bulk_get(&pdev->dev,
                        ARRAY_SIZE(pdata->supplies),
                        pdata->supplies);
-        if (ret)
+        if (ret) {
+                /*
+                 * Retry on deferrals, else just report the error
+                 * and try to continue.
+                 */
+                if (ret == -EPROBE_DEFER)
+                        return ret;
                netdev_err(ndev, "couldn't get regulators %d\n",
                                ret);
+        }
        /* Request optional RESET GPIO */
        pdata->reset_gpiod = devm_gpiod_get_optional(&pdev->dev,
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index 3818c5e06eba..4b78168a5f3c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -107,7 +107,7 @@ config DWMAC_STI
 config DWMAC_STM32
        tristate "STM32 DWMAC support"
        default ARCH_STM32
-        depends on OF && HAS_IOMEM
+        depends on OF && HAS_IOMEM && (ARCH_STM32 || COMPILE_TEST)
        select MFD_SYSCON
        ---help---
          Support for ethernet controller on STM32 SOCs.
diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
index 2920e2ee3864..489ef146201e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
@@ -63,8 +63,8 @@
 #define TSE_PCS_SGMII_LINK_TIMER_0                      0x0D40
 #define TSE_PCS_SGMII_LINK_TIMER_1                      0x0003
 #define TSE_PCS_SW_RESET_TIMEOUT                        100
-#define TSE_PCS_USE_SGMII_AN_MASK                       BIT(2)
+#define TSE_PCS_USE_SGMII_AN_MASK                       BIT(1)
-#define TSE_PCS_USE_SGMII_ENA                           BIT(1)
+#define TSE_PCS_USE_SGMII_ENA                           BIT(0)
 #define SGMII_ADAPTER_CTRL_REG                          0x00
 #define SGMII_ADAPTER_DISABLE                           0x0001
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index d3292c4a6eda..6d2de4e01f6d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -120,14 +120,17 @@ struct stmmac_extra_stats {
        unsigned long ip_csum_bypassed;
        unsigned long ipv4_pkt_rcvd;
        unsigned long ipv6_pkt_rcvd;
-        unsigned long rx_msg_type_ext_no_ptp;
+        unsigned long no_ptp_rx_msg_type_ext;
-        unsigned long rx_msg_type_sync;
+        unsigned long ptp_rx_msg_type_sync;
-        unsigned long rx_msg_type_follow_up;
+        unsigned long ptp_rx_msg_type_follow_up;
-        unsigned long rx_msg_type_delay_req;
+        unsigned long ptp_rx_msg_type_delay_req;
-        unsigned long rx_msg_type_delay_resp;
+        unsigned long ptp_rx_msg_type_delay_resp;
-        unsigned long rx_msg_type_pdelay_req;
+        unsigned long ptp_rx_msg_type_pdelay_req;
-        unsigned long rx_msg_type_pdelay_resp;
+        unsigned long ptp_rx_msg_type_pdelay_resp;
-        unsigned long rx_msg_type_pdelay_follow_up;
+        unsigned long ptp_rx_msg_type_pdelay_follow_up;
+        unsigned long ptp_rx_msg_type_announce;
+        unsigned long ptp_rx_msg_type_management;
+        unsigned long ptp_rx_msg_pkt_reserved_type;
        unsigned long ptp_frame_type;
        unsigned long ptp_ver;
        unsigned long timestamp_dropped;
@@ -482,11 +485,12 @@ struct stmmac_ops {
 /* PTP and HW Timer helpers */
 struct stmmac_hwtimestamp {
        void (*config_hw_tstamping) (void __iomem *ioaddr, u32 data);
-        u32 (*config_sub_second_increment) (void __iomem *ioaddr, u32 clk_rate);
+        u32 (*config_sub_second_increment)(void __iomem *ioaddr, u32 ptp_clock,
+                                           int gmac4);
        int (*init_systime) (void __iomem *ioaddr, u32 sec, u32 nsec);
        int (*config_addend) (void __iomem *ioaddr, u32 addend);
        int (*adjust_systime) (void __iomem *ioaddr, u32 sec, u32 nsec,
-                               int add_sub);
+                               int add_sub, int gmac4);
         u64(*get_systime) (void __iomem *ioaddr);
 };
diff --git a/drivers/net/ethernet/stmicro/stmmac/descs.h b/drivers/net/ethernet/stmicro/stmmac/descs.h
index 2e4c171a2b41..e3c86d422109 100644
--- a/drivers/net/ethernet/stmicro/stmmac/descs.h
+++ b/drivers/net/ethernet/stmicro/stmmac/descs.h
@@ -155,14 +155,18 @@
 #define ERDES4_L3_L4_FILT_NO_MATCH_MASK GENMASK(27, 26)
 /* Extended RDES4 message type definitions */
-#define RDES_EXT_NO_PTP                 0
+#define RDES_EXT_NO_PTP                 0x0
-#define RDES_EXT_SYNC                   1
+#define RDES_EXT_SYNC                   0x1
-#define RDES_EXT_FOLLOW_UP              2
+#define RDES_EXT_FOLLOW_UP              0x2
-#define RDES_EXT_DELAY_REQ              3
+#define RDES_EXT_DELAY_REQ              0x3
-#define RDES_EXT_DELAY_RESP             4
+#define RDES_EXT_DELAY_RESP             0x4
-#define RDES_EXT_PDELAY_REQ             5
+#define RDES_EXT_PDELAY_REQ             0x5
-#define RDES_EXT_PDELAY_RESP            6
+#define RDES_EXT_PDELAY_RESP            0x6
-#define RDES_EXT_PDELAY_FOLLOW_UP       7
+#define RDES_EXT_PDELAY_FOLLOW_UP       0x7
+#define RDES_PTP_ANNOUNCE               0x8
+#define RDES_PTP_MANAGEMENT             0x9
+#define RDES_PTP_SIGNALING              0xa
+#define RDES_PTP_PKT_RESERVED_TYPE      0xf
 /* Basic descriptor structure for normal and alternate descriptors */
 struct dma_desc {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
index b1e5f24708c9..e6e6c2fcc4b7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
@@ -50,10 +50,23 @@ static int dwmac_generic_probe(struct platform_device *pdev)
        if (plat_dat->init) {
                ret = plat_dat->init(pdev, plat_dat->bsp_priv);
                if (ret)
-                        return ret;
+                        goto err_remove_config_dt;
        }
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_exit;
+        return 0;
+err_exit:
+        if (plat_dat->exit)
+                plat_dat->exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        if (pdev->dev.of_node)
+                stmmac_remove_config_dt(pdev, plat_dat);
+        return ret;
 }
 static const struct of_device_id dwmac_generic_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index 36d3355f2fb0..866444b6c82f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -271,15 +271,17 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
                return PTR_ERR(plat_dat);
        gmac = devm_kzalloc(dev, sizeof(*gmac), GFP_KERNEL);
-        if (!gmac)
+        if (!gmac) {
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto err_remove_config_dt;
+        }
        gmac->pdev = pdev;
        err = ipq806x_gmac_of_parse(gmac);
        if (err) {
                dev_err(dev, "device tree parsing error\n");
-                return err;
+                goto err_remove_config_dt;
        }
        regmap_write(gmac->qsgmii_csr, QSGMII_PCS_CAL_LCKDT_CTL,
@@ -300,7 +302,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
        default:
                dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
                        phy_modes(gmac->phy_mode));
-                return -EINVAL;
+                err = -EINVAL;
+                goto err_remove_config_dt;
        }
        regmap_write(gmac->nss_common, NSS_COMMON_GMAC_CTL(gmac->id), val);
@@ -319,7 +322,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
        default:
                dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
                        phy_modes(gmac->phy_mode));
-                return -EINVAL;
+                err = -EINVAL;
+                goto err_remove_config_dt;
        }
        regmap_write(gmac->nss_common, NSS_COMMON_CLK_SRC_CTRL, val);
@@ -346,7 +350,16 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
        plat_dat->bsp_priv = gmac;
        plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed;
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (err)
+                goto err_remove_config_dt;
+        return 0;
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+        return err;
 }
 static const struct of_device_id ipq806x_gmac_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c
index 78e9d1861896..3d3f43d91b98 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c
@@ -46,7 +46,8 @@ static int lpc18xx_dwmac_probe(struct platform_device *pdev)
        reg = syscon_regmap_lookup_by_compatible("nxp,lpc1850-creg");
        if (IS_ERR(reg)) {
                dev_err(&pdev->dev, "syscon lookup failed\n");
-                return PTR_ERR(reg);
+                ret = PTR_ERR(reg);
+                goto err_remove_config_dt;
        }
        if (plat_dat->interface == PHY_INTERFACE_MODE_MII) {
@@ -55,13 +56,23 @@ static int lpc18xx_dwmac_probe(struct platform_device *pdev)
                ethmode = LPC18XX_CREG_CREG6_ETHMODE_RMII;
        } else {
                dev_err(&pdev->dev, "Only MII and RMII mode supported\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_remove_config_dt;
        }
        regmap_update_bits(reg, LPC18XX_CREG_CREG6,
                           LPC18XX_CREG_CREG6_ETHMODE_MASK, ethmode);
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_remove_config_dt;
+        return 0;
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+        return ret;
 }
 static const struct of_device_id lpc18xx_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c
index 309d99536a2c..7fdd1760a74c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c
@@ -64,18 +64,31 @@ static int meson6_dwmac_probe(struct platform_device *pdev)
                return PTR_ERR(plat_dat);
        dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
+        if (!dwmac) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
        dwmac->reg = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(dwmac->reg))
+        if (IS_ERR(dwmac->reg)) {
-                return PTR_ERR(dwmac->reg);
+                ret = PTR_ERR(dwmac->reg);
+                goto err_remove_config_dt;
+        }
        plat_dat->bsp_priv = dwmac;
        plat_dat->fix_mac_speed = meson6_dwmac_fix_mac_speed;
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_remove_config_dt;
+        return 0;
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+        return ret;
 }
 static const struct of_device_id meson6_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
index 250e4ceafc8d..ffaed1f35efe 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -264,32 +264,48 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
                return PTR_ERR(plat_dat);
        dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
+        if (!dwmac) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
        dwmac->regs = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(dwmac->regs))
+        if (IS_ERR(dwmac->regs)) {
-                return PTR_ERR(dwmac->regs);
+                ret = PTR_ERR(dwmac->regs);
+                goto err_remove_config_dt;
+        }
        dwmac->pdev = pdev;
        dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node);
        if (dwmac->phy_mode < 0) {
                dev_err(&pdev->dev, "missing phy-mode property\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_remove_config_dt;
        }
        ret = meson8b_init_clk(dwmac);
        if (ret)
-                return ret;
+                goto err_remove_config_dt;
        ret = meson8b_init_prg_eth(dwmac);
        if (ret)
-                return ret;
+                goto err_remove_config_dt;
        plat_dat->bsp_priv = dwmac;
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_clk_disable;
+        return 0;
+err_clk_disable:
+        clk_disable_unprepare(dwmac->m25_div_clk);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+        return ret;
 }
 static int meson8b_dwmac_remove(struct platform_device *pdev)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 3740a4417fa0..d80c88bd2bba 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -981,14 +981,27 @@ static int rk_gmac_probe(struct platform_device *pdev)
        plat_dat->resume = rk_gmac_resume;
        plat_dat->bsp_priv = rk_gmac_setup(pdev, data);
-        if (IS_ERR(plat_dat->bsp_priv))
+        if (IS_ERR(plat_dat->bsp_priv)) {
-                return PTR_ERR(plat_dat->bsp_priv);
+                ret = PTR_ERR(plat_dat->bsp_priv);
+                goto err_remove_config_dt;
+        }
        ret = rk_gmac_init(pdev, plat_dat->bsp_priv);
        if (ret)
-                return ret;
+                goto err_remove_config_dt;
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_gmac_exit;
+        return 0;
+err_gmac_exit:
+        rk_gmac_exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        return ret;
 }
 static const struct of_device_id rk_gmac_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
index bec6963ac71e..0c420e97de1e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
@@ -304,6 +304,8 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
        struct device           *dev = &pdev->dev;
        int                     ret;
        struct socfpga_dwmac    *dwmac;
+        struct net_device       *ndev;
+        struct stmmac_priv      *stpriv;
        ret = stmmac_get_platform_resources(pdev, &stmmac_res);
        if (ret)
@@ -314,32 +316,43 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
                return PTR_ERR(plat_dat);
        dwmac = devm_kzalloc(dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
+        if (!dwmac) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
        ret = socfpga_dwmac_parse_data(dwmac, dev);
        if (ret) {
                dev_err(dev, "Unable to parse OF data\n");
-                return ret;
+                goto err_remove_config_dt;
        }
        plat_dat->bsp_priv = dwmac;
        plat_dat->fix_mac_speed = socfpga_dwmac_fix_mac_speed;
        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_remove_config_dt;
-        if (!ret) {
+        ndev = platform_get_drvdata(pdev);
-                struct net_device *ndev = platform_get_drvdata(pdev);
+        stpriv = netdev_priv(ndev);
-                struct stmmac_priv *stpriv = netdev_priv(ndev);
-                /* The socfpga driver needs to control the stmmac reset to
+        /* The socfpga driver needs to control the stmmac reset to set the phy
-                 * set the phy mode. Create a copy of the core reset handel
+         * mode. Create a copy of the core reset handle so it can be used by
-                 * so it can be used by the driver later.
+         * the driver later.
-                 */
+         */
-                dwmac->stmmac_rst = stpriv->stmmac_rst;
+        dwmac->stmmac_rst = stpriv->stmmac_rst;
-                ret = socfpga_dwmac_set_phy_mode(dwmac);
+        ret = socfpga_dwmac_set_phy_mode(dwmac);
-        }
+        if (ret)
+                goto err_dvr_remove;
+        return 0;
+err_dvr_remove:
+        stmmac_dvr_remove(&pdev->dev);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
        return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
index 58c05acc2aab..060b98c37a85 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
@@ -345,13 +345,15 @@ static int sti_dwmac_probe(struct platform_device *pdev)
                return PTR_ERR(plat_dat);
        dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
+        if (!dwmac) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
        ret = sti_dwmac_parse_data(dwmac, pdev);
        if (ret) {
                dev_err(&pdev->dev, "Unable to parse OF data\n");
-                return ret;
+                goto err_remove_config_dt;
        }
        dwmac->fix_retime_src = data->fix_retime_src;
@@ -363,9 +365,20 @@ static int sti_dwmac_probe(struct platform_device *pdev)
        ret = sti_dwmac_init(pdev, plat_dat->bsp_priv);
        if (ret)
-                return ret;
+                goto err_remove_config_dt;
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_dwmac_exit;
+        return 0;
+err_dwmac_exit:
+        sti_dwmac_exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        return ret;
 }
 static const struct sti_dwmac_of_data stih4xx_dwmac_data = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
index e5a926b8bee7..61cb24810d10 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
@@ -107,24 +107,33 @@ static int stm32_dwmac_probe(struct platform_device *pdev)
                return PTR_ERR(plat_dat);
        dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
+        if (!dwmac) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
        ret = stm32_dwmac_parse_data(dwmac, &pdev->dev);
        if (ret) {
                dev_err(&pdev->dev, "Unable to parse OF data\n");
-                return ret;
+                goto err_remove_config_dt;
        }
        plat_dat->bsp_priv = dwmac;
        ret = stm32_dwmac_init(plat_dat);
        if (ret)
-                return ret;
+                goto err_remove_config_dt;
        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
        if (ret)
-                stm32_dwmac_clk_disable(dwmac);
+                goto err_clk_disable;
+        return 0;
+err_clk_disable:
+        stm32_dwmac_clk_disable(dwmac);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
        return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
index adff46375a32..d07520fb969e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
@@ -120,22 +120,27 @@ static int sun7i_gmac_probe(struct platform_device *pdev)
                return PTR_ERR(plat_dat);
        gmac = devm_kzalloc(dev, sizeof(*gmac), GFP_KERNEL);
-        if (!gmac)
+        if (!gmac) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
        gmac->interface = of_get_phy_mode(dev->of_node);
        gmac->tx_clk = devm_clk_get(dev, "allwinner_gmac_tx");
        if (IS_ERR(gmac->tx_clk)) {
                dev_err(dev, "could not get tx clock\n");
-                return PTR_ERR(gmac->tx_clk);
+                ret = PTR_ERR(gmac->tx_clk);
+                goto err_remove_config_dt;
        }
        /* Optional regulator for PHY */
        gmac->regulator = devm_regulator_get_optional(dev, "phy");
        if (IS_ERR(gmac->regulator)) {
-                if (PTR_ERR(gmac->regulator) == -EPROBE_DEFER)
+                if (PTR_ERR(gmac->regulator) == -EPROBE_DEFER) {
-                        return -EPROBE_DEFER;
+                        ret = -EPROBE_DEFER;
+                        goto err_remove_config_dt;
+                }
                dev_info(dev, "no regulator found\n");
                gmac->regulator = NULL;
        }
@@ -151,11 +156,18 @@ static int sun7i_gmac_probe(struct platform_device *pdev)
        ret = sun7i_gmac_init(pdev, plat_dat->bsp_priv);
        if (ret)
-                return ret;
+                goto err_remove_config_dt;
        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
        if (ret)
-                sun7i_gmac_exit(pdev, plat_dat->bsp_priv);
+                goto err_gmac_exit;
+        return 0;
+err_gmac_exit:
+        sun7i_gmac_exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
        return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
index 990746955216..f35385266fbf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
@@ -43,9 +43,11 @@ static void dwmac1000_dma_axi(void __iomem *ioaddr, struct stmmac_axi *axi)
        if (axi->axi_xit_frm)
                value |= DMA_AXI_LPI_XIT_FRM;
+        value &= ~DMA_AXI_WR_OSR_LMT;
        value |= (axi->axi_wr_osr_lmt & DMA_AXI_WR_OSR_LMT_MASK) <<
                 DMA_AXI_WR_OSR_LMT_SHIFT;
+        value &= ~DMA_AXI_RD_OSR_LMT;
        value |= (axi->axi_rd_osr_lmt & DMA_AXI_RD_OSR_LMT_MASK) <<
                 DMA_AXI_RD_OSR_LMT_SHIFT;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index 4ec7397e7fb3..a601f8d43b75 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -123,22 +123,29 @@ static int dwmac4_wrback_get_rx_status(void *data, struct stmmac_extra_stats *x,
                x->ipv4_pkt_rcvd++;
        if (rdes1 & RDES1_IPV6_HEADER)
                x->ipv6_pkt_rcvd++;
-        if (message_type == RDES_EXT_SYNC)
-                x->rx_msg_type_sync++;
+        if (message_type == RDES_EXT_NO_PTP)
+                x->no_ptp_rx_msg_type_ext++;
+        else if (message_type == RDES_EXT_SYNC)
+                x->ptp_rx_msg_type_sync++;
        else if (message_type == RDES_EXT_FOLLOW_UP)
-                x->rx_msg_type_follow_up++;
+                x->ptp_rx_msg_type_follow_up++;
        else if (message_type == RDES_EXT_DELAY_REQ)
-                x->rx_msg_type_delay_req++;
+                x->ptp_rx_msg_type_delay_req++;
        else if (message_type == RDES_EXT_DELAY_RESP)
-                x->rx_msg_type_delay_resp++;
+                x->ptp_rx_msg_type_delay_resp++;
        else if (message_type == RDES_EXT_PDELAY_REQ)
-                x->rx_msg_type_pdelay_req++;
+                x->ptp_rx_msg_type_pdelay_req++;
        else if (message_type == RDES_EXT_PDELAY_RESP)
-                x->rx_msg_type_pdelay_resp++;
+                x->ptp_rx_msg_type_pdelay_resp++;
        else if (message_type == RDES_EXT_PDELAY_FOLLOW_UP)
-                x->rx_msg_type_pdelay_follow_up++;
+                x->ptp_rx_msg_type_pdelay_follow_up++;
-        else
+        else if (message_type == RDES_PTP_ANNOUNCE)
-                x->rx_msg_type_ext_no_ptp++;
+                x->ptp_rx_msg_type_announce++;
+        else if (message_type == RDES_PTP_MANAGEMENT)
+                x->ptp_rx_msg_type_management++;
+        else if (message_type == RDES_PTP_PKT_RESERVED_TYPE)
+                x->ptp_rx_msg_pkt_reserved_type++;
        if (rdes1 & RDES1_PTP_PACKET_TYPE)
                x->ptp_frame_type++;
@@ -204,14 +211,18 @@ static void dwmac4_rd_enable_tx_timestamp(struct dma_desc *p)
 static int dwmac4_wrback_get_tx_timestamp_status(struct dma_desc *p)
 {
-        return (p->des3 & TDES3_TIMESTAMP_STATUS)
+        /* Context type from W/B descriptor must be zero */
-                >> TDES3_TIMESTAMP_STATUS_SHIFT;
+        if (p->des3 & TDES3_CONTEXT_TYPE)
+                return -EINVAL;
+        /* Tx Timestamp Status is 1 so des0 and des1'll have valid values */
+        if (p->des3 & TDES3_TIMESTAMP_STATUS)
+                return 0;
+        return 1;
 }
-/*  NOTE: For RX CTX bit has to be checked before
+static inline u64 dwmac4_get_timestamp(void *desc, u32 ats)
- *  HAVE a specific function for TX and another one for RX
- */
-static u64 dwmac4_wrback_get_timestamp(void *desc, u32 ats)
 {
        struct dma_desc *p = (struct dma_desc *)desc;
        u64 ns;
@@ -223,12 +234,54 @@ static u64 dwmac4_wrback_get_timestamp(void *desc, u32 ats)
        return ns;
 }
-static int dwmac4_context_get_rx_timestamp_status(void *desc, u32 ats)
+static int dwmac4_rx_check_timestamp(void *desc)
+{
+        struct dma_desc *p = (struct dma_desc *)desc;
+        u32 own, ctxt;
+        int ret = 1;
+        own = p->des3 & RDES3_OWN;
+        ctxt = ((p->des3 & RDES3_CONTEXT_DESCRIPTOR)
+                >> RDES3_CONTEXT_DESCRIPTOR_SHIFT);
+        if (likely(!own && ctxt)) {
+                if ((p->des0 == 0xffffffff) && (p->des1 == 0xffffffff))
+                        /* Corrupted value */
+                        ret = -EINVAL;
+                else
+                        /* A valid Timestamp is ready to be read */
+                        ret = 0;
+        }
+        /* Timestamp not ready */
+        return ret;
+}
+static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
 {
        struct dma_desc *p = (struct dma_desc *)desc;
+        int ret = -EINVAL;
+        /* Get the status from normal w/b descriptor */
+        if (likely(p->des3 & TDES3_RS1V)) {
+                if (likely(p->des1 & RDES1_TIMESTAMP_AVAILABLE)) {
+                        int i = 0;
+                        /* Check if timestamp is OK from context descriptor */
+                        do {
+                                ret = dwmac4_rx_check_timestamp(desc);
+                                if (ret < 0)
+                                        goto exit;
+                                i++;
-        return (p->des1 & RDES1_TIMESTAMP_AVAILABLE)
+                        } while ((ret == 1) || (i < 10));
-                >> RDES1_TIMESTAMP_AVAILABLE_SHIFT;
+                        if (i == 10)
+                                ret = -EBUSY;
+                }
+        }
+exit:
+        return ret;
 }
 static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
@@ -347,10 +400,9 @@ static void dwmac4_display_ring(void *head, unsigned int size, bool rx)
        pr_info("%s descriptor ring:\n", rx ? "RX" : "TX");
        for (i = 0; i < size; i++) {
-                if (p->des0)
+                pr_info("%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
-                        pr_info("%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+                        i, (unsigned int)virt_to_phys(p),
-                                i, (unsigned int)virt_to_phys(p),
+                        p->des0, p->des1, p->des2, p->des3);
-                                p->des0, p->des1, p->des2, p->des3);
                p++;
        }
 }
@@ -374,8 +426,8 @@ const struct stmmac_desc_ops dwmac4_desc_ops = {
        .get_rx_frame_len = dwmac4_wrback_get_rx_frame_len,
        .enable_tx_timestamp = dwmac4_rd_enable_tx_timestamp,
        .get_tx_timestamp_status = dwmac4_wrback_get_tx_timestamp_status,
-        .get_timestamp = dwmac4_wrback_get_timestamp,
+        .get_rx_timestamp_status = dwmac4_wrback_get_rx_timestamp_status,
-        .get_rx_timestamp_status = dwmac4_context_get_rx_timestamp_status,
+        .get_timestamp = dwmac4_get_timestamp,
        .set_tx_ic = dwmac4_rd_set_tx_ic,
        .prepare_tx_desc = dwmac4_rd_prepare_tx_desc,
        .prepare_tso_tx_desc = dwmac4_rd_prepare_tso_tx_desc,
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.h b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.h
index 0902a2edeaa9..9736c505211a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.h
@@ -59,10 +59,13 @@
 #define TDES3_CTXT_TCMSSV               BIT(26)
 /* TDES3 Common */
+#define TDES3_RS1V                      BIT(26)
+#define TDES3_RS1V_SHIFT                26
 #define TDES3_LAST_DESCRIPTOR           BIT(28)
 #define TDES3_LAST_DESCRIPTOR_SHIFT     28
 #define TDES3_FIRST_DESCRIPTOR          BIT(29)
 #define TDES3_CONTEXT_TYPE              BIT(30)
+#define TDES3_CONTEXT_TYPE_SHIFT        30
 /* TDS3 use for both format (read and write back) */
 #define TDES3_OWN                       BIT(31)
@@ -117,6 +120,7 @@
 #define RDES3_LAST_DESCRIPTOR           BIT(28)
 #define RDES3_FIRST_DESCRIPTOR          BIT(29)
 #define RDES3_CONTEXT_DESCRIPTOR        BIT(30)
+#define RDES3_CONTEXT_DESCRIPTOR_SHIFT  30
 /* RDES3 (read format) */
 #define RDES3_BUFFER1_VALID_ADDR        BIT(24)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
index 116151cd6a95..32bc2fc73cdc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
@@ -30,9 +30,11 @@ static void dwmac4_dma_axi(void __iomem *ioaddr, struct stmmac_axi *axi)
        if (axi->axi_xit_frm)
                value |= DMA_AXI_LPI_XIT_FRM;
+        value &= ~DMA_AXI_WR_OSR_LMT;
        value |= (axi->axi_wr_osr_lmt & DMA_AXI_OSR_MAX) <<
                 DMA_AXI_WR_OSR_LMT_SHIFT;
+        value &= ~DMA_AXI_RD_OSR_LMT;
        value |= (axi->axi_rd_osr_lmt & DMA_AXI_OSR_MAX) <<
                 DMA_AXI_RD_OSR_LMT_SHIFT;
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 38f19c99cf59..e75549327c34 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -150,22 +150,30 @@ static void enh_desc_get_ext_status(void *data, struct stmmac_extra_stats *x,
                        x->ipv4_pkt_rcvd++;
                if (rdes4 & ERDES4_IPV6_PKT_RCVD)
                        x->ipv6_pkt_rcvd++;
-                if (message_type == RDES_EXT_SYNC)
-                        x->rx_msg_type_sync++;
+                if (message_type == RDES_EXT_NO_PTP)
+                        x->no_ptp_rx_msg_type_ext++;
+                else if (message_type == RDES_EXT_SYNC)
+                        x->ptp_rx_msg_type_sync++;
                else if (message_type == RDES_EXT_FOLLOW_UP)
-                        x->rx_msg_type_follow_up++;
+                        x->ptp_rx_msg_type_follow_up++;
                else if (message_type == RDES_EXT_DELAY_REQ)
-                        x->rx_msg_type_delay_req++;
+                        x->ptp_rx_msg_type_delay_req++;
                else if (message_type == RDES_EXT_DELAY_RESP)
-                        x->rx_msg_type_delay_resp++;
+                        x->ptp_rx_msg_type_delay_resp++;
                else if (message_type == RDES_EXT_PDELAY_REQ)
-                        x->rx_msg_type_pdelay_req++;
+                        x->ptp_rx_msg_type_pdelay_req++;
                else if (message_type == RDES_EXT_PDELAY_RESP)
-                        x->rx_msg_type_pdelay_resp++;
+                        x->ptp_rx_msg_type_pdelay_resp++;
                else if (message_type == RDES_EXT_PDELAY_FOLLOW_UP)
-                        x->rx_msg_type_pdelay_follow_up++;
+                        x->ptp_rx_msg_type_pdelay_follow_up++;
-                else
+                else if (message_type == RDES_PTP_ANNOUNCE)
-                        x->rx_msg_type_ext_no_ptp++;
+                        x->ptp_rx_msg_type_announce++;
+                else if (message_type == RDES_PTP_MANAGEMENT)
+                        x->ptp_rx_msg_type_management++;
+                else if (message_type == RDES_PTP_PKT_RESERVED_TYPE)
+                        x->ptp_rx_msg_pkt_reserved_type++;
                if (rdes4 & ERDES4_PTP_FRAME_TYPE)
                        x->ptp_frame_type++;
                if (rdes4 & ERDES4_PTP_VER)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 8dc9056c1001..4d2a759b8465 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -129,6 +129,7 @@ struct stmmac_priv {
        int irq_wake;
        spinlock_t ptp_lock;
        void __iomem *mmcaddr;
+        void __iomem *ptpaddr;
        u32 rx_tail_addr;
        u32 tx_tail_addr;
        u32 mss;
@@ -145,7 +146,7 @@ int stmmac_mdio_register(struct net_device *ndev);
 int stmmac_mdio_reset(struct mii_bus *mii);
 void stmmac_set_ethtool_ops(struct net_device *netdev);
-int stmmac_ptp_register(struct stmmac_priv *priv);
+void stmmac_ptp_register(struct stmmac_priv *priv);
 void stmmac_ptp_unregister(struct stmmac_priv *priv);
 int stmmac_resume(struct device *dev);
 int stmmac_suspend(struct device *dev);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index 1e06173fc9d7..c5d0142adda2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -115,14 +115,17 @@ static const struct stmmac_stats stmmac_gstrings_stats[] = {
        STMMAC_STAT(ip_csum_bypassed),
        STMMAC_STAT(ipv4_pkt_rcvd),
        STMMAC_STAT(ipv6_pkt_rcvd),
-        STMMAC_STAT(rx_msg_type_ext_no_ptp),
+        STMMAC_STAT(no_ptp_rx_msg_type_ext),
-        STMMAC_STAT(rx_msg_type_sync),
+        STMMAC_STAT(ptp_rx_msg_type_sync),
-        STMMAC_STAT(rx_msg_type_follow_up),
+        STMMAC_STAT(ptp_rx_msg_type_follow_up),
-        STMMAC_STAT(rx_msg_type_delay_req),
+        STMMAC_STAT(ptp_rx_msg_type_delay_req),
-        STMMAC_STAT(rx_msg_type_delay_resp),
+        STMMAC_STAT(ptp_rx_msg_type_delay_resp),
-        STMMAC_STAT(rx_msg_type_pdelay_req),
+        STMMAC_STAT(ptp_rx_msg_type_pdelay_req),
-        STMMAC_STAT(rx_msg_type_pdelay_resp),
+        STMMAC_STAT(ptp_rx_msg_type_pdelay_resp),
-        STMMAC_STAT(rx_msg_type_pdelay_follow_up),
+        STMMAC_STAT(ptp_rx_msg_type_pdelay_follow_up),
+        STMMAC_STAT(ptp_rx_msg_type_announce),
+        STMMAC_STAT(ptp_rx_msg_type_management),
+        STMMAC_STAT(ptp_rx_msg_pkt_reserved_type),
        STMMAC_STAT(ptp_frame_type),
        STMMAC_STAT(ptp_ver),
        STMMAC_STAT(timestamp_dropped),
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
index a77f68918010..10d6059b2f26 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
@@ -34,21 +34,29 @@ static void stmmac_config_hw_tstamping(void __iomem *ioaddr, u32 data)
 }
 static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr,
-                                              u32 ptp_clock)
+                                              u32 ptp_clock, int gmac4)
 {
        u32 value = readl(ioaddr + PTP_TCR);
        unsigned long data;
-        /* Convert the ptp_clock to nano second
+        /* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
-         * formula = (2/ptp_clock) * 1000000000
+         *      formula = (1/ptp_clock) * 1000000000
-         * where, ptp_clock = 50MHz.
+         * where ptp_clock is 50MHz if fine method is used to update system
         */
-        data = (2000000000ULL / ptp_clock);
+        if (value & PTP_TCR_TSCFUPDT)
+                data = (1000000000ULL / 50000000);
+        else
+                data = (1000000000ULL / ptp_clock);
        /* 0.465ns accuracy */
        if (!(value & PTP_TCR_TSCTRLSSR))
                data = (data * 1000) / 465;
+        data &= PTP_SSIR_SSINC_MASK;
+        if (gmac4)
+                data = data << GMAC4_PTP_SSIR_SSINC_SHIFT;
        writel(data, ioaddr + PTP_SSIR);
        return data;
@@ -104,14 +112,30 @@ static int stmmac_config_addend(void __iomem *ioaddr, u32 addend)
 }
 static int stmmac_adjust_systime(void __iomem *ioaddr, u32 sec, u32 nsec,
-                                 int add_sub)
+                                 int add_sub, int gmac4)
 {
        u32 value;
        int limit;
+        if (add_sub) {
+                /* If the new sec value needs to be subtracted with
+                 * the system time, then MAC_STSUR reg should be
+                 * programmed with (2^32 – <new_sec_value>)
+                 */
+                if (gmac4)
+                        sec = (100000000ULL - sec);
+                value = readl(ioaddr + PTP_TCR);
+                if (value & PTP_TCR_TSCTRLSSR)
+                        nsec = (PTP_DIGITAL_ROLLOVER_MODE - nsec);
+                else
+                        nsec = (PTP_BINARY_ROLLOVER_MODE - nsec);
+        }
        writel(sec, ioaddr + PTP_STSUR);
-        writel(((add_sub << PTP_STNSUR_ADDSUB_SHIFT) | nsec),
+        value = (add_sub << PTP_STNSUR_ADDSUB_SHIFT) | nsec;
-                ioaddr + PTP_STNSUR);
+        writel(value, ioaddr + PTP_STNSUR);
        /* issue command to initialize the system time value */
        value = readl(ioaddr + PTP_TCR);
        value |= PTP_TCR_TSUPDT;
@@ -134,8 +158,9 @@ static u64 stmmac_get_systime(void __iomem *ioaddr)
 {
        u64 ns;
+        /* Get the TSSS value */
        ns = readl(ioaddr + PTP_STNSR);
-        /* convert sec time value to nanosecond */
+        /* Get the TSS and convert sec time value to nanosecond */
        ns += readl(ioaddr + PTP_STSR) * 1000000000ULL;
        return ns;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 6c85b61aaa0b..caf069a465f2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -340,18 +340,17 @@ out:
 /* stmmac_get_tx_hwtstamp - get HW TX timestamps
 * @priv: driver private structure
- * @entry : descriptor index to be used.
+ * @p : descriptor pointer
 * @skb : the socket buffer
 * Description :
 * This function will read timestamp from the descriptor & pass it to stack.
 * and also perform some sanity checks.
 */
 static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv,
-                                   unsigned int entry, struct sk_buff *skb)
+                                   struct dma_desc *p, struct sk_buff *skb)
 {
        struct skb_shared_hwtstamps shhwtstamp;
        u64 ns;
-        void *desc = NULL;
        if (!priv->hwts_tx_en)
                return;
@@ -360,58 +359,55 @@ static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv,
        if (likely(!skb || !(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)))
                return;
-        if (priv->adv_ts)
-                desc = (priv->dma_etx + entry);
-        else
-                desc = (priv->dma_tx + entry);
        /* check tx tstamp status */
-        if (!priv->hw->desc->get_tx_timestamp_status((struct dma_desc *)desc))
+        if (!priv->hw->desc->get_tx_timestamp_status(p)) {
-                return;
+                /* get the valid tstamp */
+                ns = priv->hw->desc->get_timestamp(p, priv->adv_ts);
-        /* get the valid tstamp */
+                memset(&shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
-        ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts);
+                shhwtstamp.hwtstamp = ns_to_ktime(ns);
-        memset(&shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
+                netdev_info(priv->dev, "get valid TX hw timestamp %llu\n", ns);
-        shhwtstamp.hwtstamp = ns_to_ktime(ns);
+                /* pass tstamp to stack */
-        /* pass tstamp to stack */
+                skb_tstamp_tx(skb, &shhwtstamp);
-        skb_tstamp_tx(skb, &shhwtstamp);
+        }
        return;
 }
 /* stmmac_get_rx_hwtstamp - get HW RX timestamps
 * @priv: driver private structure
- * @entry : descriptor index to be used.
+ * @p : descriptor pointer
+ * @np : next descriptor pointer
 * @skb : the socket buffer
 * Description :
 * This function will read received packet's timestamp from the descriptor
 * and pass it to stack. It also perform some sanity checks.
 */
-static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv,
+static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p,
-                                   unsigned int entry, struct sk_buff *skb)
+                                   struct dma_desc *np, struct sk_buff *skb)
 {
        struct skb_shared_hwtstamps *shhwtstamp = NULL;
        u64 ns;
-        void *desc = NULL;
        if (!priv->hwts_rx_en)
                return;
-        if (priv->adv_ts)
+        /* Check if timestamp is available */
-                desc = (priv->dma_erx + entry);
+        if (!priv->hw->desc->get_rx_timestamp_status(p, priv->adv_ts)) {
-        else
+                /* For GMAC4, the valid timestamp is from CTX next desc. */
-                desc = (priv->dma_rx + entry);
+                if (priv->plat->has_gmac4)
+                        ns = priv->hw->desc->get_timestamp(np, priv->adv_ts);
-        /* exit if rx tstamp is not valid */
+                else
-        if (!priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts))
+                        ns = priv->hw->desc->get_timestamp(p, priv->adv_ts);
-                return;
-        /* get valid tstamp */
+                netdev_info(priv->dev, "get valid RX hw timestamp %llu\n", ns);
-        ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts);
+                shhwtstamp = skb_hwtstamps(skb);
-        shhwtstamp = skb_hwtstamps(skb);
+                memset(shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
-        memset(shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
+                shhwtstamp->hwtstamp = ns_to_ktime(ns);
-        shhwtstamp->hwtstamp = ns_to_ktime(ns);
+        } else  {
+                netdev_err(priv->dev, "cannot get RX hw timestamp\n");
+        }
 }
 /**
@@ -598,17 +594,18 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
        priv->hwts_tx_en = config.tx_type == HWTSTAMP_TX_ON;
        if (!priv->hwts_tx_en && !priv->hwts_rx_en)
-                priv->hw->ptp->config_hw_tstamping(priv->ioaddr, 0);
+                priv->hw->ptp->config_hw_tstamping(priv->ptpaddr, 0);
        else {
                value = (PTP_TCR_TSENA | PTP_TCR_TSCFUPDT | PTP_TCR_TSCTRLSSR |
                         tstamp_all | ptp_v2 | ptp_over_ethernet |
                         ptp_over_ipv6_udp | ptp_over_ipv4_udp | ts_event_en |
                         ts_master_en | snap_type_sel);
-                priv->hw->ptp->config_hw_tstamping(priv->ioaddr, value);
+                priv->hw->ptp->config_hw_tstamping(priv->ptpaddr, value);
                /* program Sub Second Increment reg */
                sec_inc = priv->hw->ptp->config_sub_second_increment(
-                        priv->ioaddr, priv->clk_ptp_rate);
+                        priv->ptpaddr, priv->clk_ptp_rate,
+                        priv->plat->has_gmac4);
                temp = div_u64(1000000000ULL, sec_inc);
                /* calculate default added value:
@@ -618,14 +615,14 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                 */
                temp = (u64)(temp << 32);
                priv->default_addend = div_u64(temp, priv->clk_ptp_rate);
-                priv->hw->ptp->config_addend(priv->ioaddr,
+                priv->hw->ptp->config_addend(priv->ptpaddr,
                                             priv->default_addend);
                /* initialize system time */
                ktime_get_real_ts64(&now);
                /* lower 32 bits of tv_sec are safe until y2106 */
-                priv->hw->ptp->init_systime(priv->ioaddr, (u32)now.tv_sec,
+                priv->hw->ptp->init_systime(priv->ptpaddr, (u32)now.tv_sec,
                                            now.tv_nsec);
        }
@@ -676,7 +673,9 @@ static int stmmac_init_ptp(struct stmmac_priv *priv)
        priv->hwts_tx_en = 0;
        priv->hwts_rx_en = 0;
-        return stmmac_ptp_register(priv);
+        stmmac_ptp_register(priv);
+        return 0;
 }
 static void stmmac_release_ptp(struct stmmac_priv *priv)
@@ -878,6 +877,13 @@ static int stmmac_init_phy(struct net_device *dev)
                return -ENODEV;
        }
+        /* stmmac_adjust_link will change this to PHY_IGNORE_INTERRUPT to avoid
+         * subsequent PHY polling, make sure we force a link transition if
+         * we have a UP/DOWN/UP transition
+         */
+        if (phydev->is_pseudo_fixed_link)
+                phydev->irq = PHY_POLL;
        pr_debug("stmmac_init_phy:  %s: attached to PHY (UID 0x%x)"
                 " Link = %d\n", dev->name, phydev->phy_id, phydev->link);
@@ -1331,7 +1337,7 @@ static void stmmac_tx_clean(struct stmmac_priv *priv)
                                priv->dev->stats.tx_packets++;
                                priv->xstats.tx_pkt_n++;
                        }
-                        stmmac_get_tx_hwtstamp(priv, entry, skb);
+                        stmmac_get_tx_hwtstamp(priv, p, skb);
                }
                if (likely(priv->tx_skbuff_dma[entry].buf)) {
@@ -1477,10 +1483,13 @@ static void stmmac_mmc_setup(struct stmmac_priv *priv)
        unsigned int mode = MMC_CNTRL_RESET_ON_READ | MMC_CNTRL_COUNTER_RESET |
                            MMC_CNTRL_PRESET | MMC_CNTRL_FULL_HALF_PRESET;
-        if (priv->synopsys_id >= DWMAC_CORE_4_00)
+        if (priv->synopsys_id >= DWMAC_CORE_4_00) {
+                priv->ptpaddr = priv->ioaddr + PTP_GMAC4_OFFSET;
                priv->mmcaddr = priv->ioaddr + MMC_GMAC4_OFFSET;
-        else
+        } else {
+                priv->ptpaddr = priv->ioaddr + PTP_GMAC3_X_OFFSET;
                priv->mmcaddr = priv->ioaddr + MMC_GMAC3_X_OFFSET;
+        }
        dwmac_mmc_intr_all_mask(priv->mmcaddr);
@@ -1710,7 +1719,7 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp)
        if (init_ptp) {
                ret = stmmac_init_ptp(priv);
                if (ret)
-                        netdev_warn(priv->dev, "PTP support cannot init.\n");
+                        netdev_warn(priv->dev, "fail to init PTP.\n");
        }
 #ifdef CONFIG_DEBUG_FS
@@ -2475,7 +2484,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
        if (netif_msg_rx_status(priv)) {
                void *rx_head;
-                pr_debug("%s: descriptor ring:\n", __func__);
+                pr_info(">>>>>> %s: descriptor ring:\n", __func__);
                if (priv->extend_desc)
                        rx_head = (void *)priv->dma_erx;
                else
@@ -2486,6 +2495,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
        while (count < limit) {
                int status;
                struct dma_desc *p;
+                struct dma_desc *np;
                if (priv->extend_desc)
                        p = (struct dma_desc *)(priv->dma_erx + entry);
@@ -2505,9 +2515,11 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
                next_entry = priv->cur_rx;
                if (priv->extend_desc)
-                        prefetch(priv->dma_erx + next_entry);
+                        np = (struct dma_desc *)(priv->dma_erx + next_entry);
                else
-                        prefetch(priv->dma_rx + next_entry);
+                        np = priv->dma_rx + next_entry;
+                prefetch(np);
                if ((priv->extend_desc) && (priv->hw->desc->rx_extended_status))
                        priv->hw->desc->rx_extended_status(&priv->dev->stats,
@@ -2559,7 +2571,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
                                frame_len -= ETH_FCS_LEN;
                        if (netif_msg_rx_status(priv)) {
-                                pr_debug("\tdesc: %p [entry %d] buff=0x%x\n",
+                                pr_info("\tdesc: %p [entry %d] buff=0x%x\n",
                                        p, entry, des);
                                if (frame_len > ETH_FRAME_LEN)
                                        pr_debug("\tframe size %d, COE: %d\n",
@@ -2616,13 +2628,13 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
                                                 DMA_FROM_DEVICE);
                        }
-                        stmmac_get_rx_hwtstamp(priv, entry, skb);
                        if (netif_msg_pktdata(priv)) {
                                pr_debug("frame received (%dbytes)", frame_len);
                                print_pkt(skb->data, frame_len);
                        }
+                        stmmac_get_rx_hwtstamp(priv, p, np, skb);
                        stmmac_rx_vlan(priv->dev, skb);
                        skb->protocol = eth_type_trans(skb, priv->dev);
@@ -3404,7 +3416,6 @@ int stmmac_dvr_remove(struct device *dev)
        stmmac_set_mac(priv->ioaddr, false);
        netif_carrier_off(ndev);
        unregister_netdev(ndev);
-        of_node_put(priv->plat->phy_node);
        if (priv->stmmac_rst)
                reset_control_assert(priv->stmmac_rst);
        clk_disable_unprepare(priv->pclk);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 0a0d6a86f397..ac3d39c69509 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -126,8 +126,10 @@ static struct stmmac_axi *stmmac_axi_setup(struct platform_device *pdev)
        axi->axi_mb = of_property_read_bool(np, "snps,axi_mb");
        axi->axi_rb =  of_property_read_bool(np, "snps,axi_rb");
-        of_property_read_u32(np, "snps,wr_osr_lmt", &axi->axi_wr_osr_lmt);
+        if (of_property_read_u32(np, "snps,wr_osr_lmt", &axi->axi_wr_osr_lmt))
-        of_property_read_u32(np, "snps,rd_osr_lmt", &axi->axi_rd_osr_lmt);
+                axi->axi_wr_osr_lmt = 1;
+        if (of_property_read_u32(np, "snps,rd_osr_lmt", &axi->axi_rd_osr_lmt))
+                axi->axi_rd_osr_lmt = 1;
        of_property_read_u32_array(np, "snps,blen", axi->axi_blen, AXI_BLEN);
        of_node_put(np);
@@ -200,7 +202,6 @@ static int stmmac_dt_phy(struct plat_stmmacenet_data *plat,
 /**
 * stmmac_probe_config_dt - parse device-tree driver parameters
 * @pdev: platform_device structure
- * @plat: driver data platform structure
 * @mac: MAC address to use
 * Description:
 * this function is to read the driver parameters from device-tree and
@@ -306,7 +307,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
                dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg),
                                       GFP_KERNEL);
                if (!dma_cfg) {
-                        of_node_put(plat->phy_node);
+                        stmmac_remove_config_dt(pdev, plat);
                        return ERR_PTR(-ENOMEM);
                }
                plat->dma_cfg = dma_cfg;
@@ -329,14 +330,37 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
        return plat;
 }
+/**
+ * stmmac_remove_config_dt - undo the effects of stmmac_probe_config_dt()
+ * @pdev: platform_device structure
+ * @plat: driver data platform structure
+ *
+ * Release resources claimed by stmmac_probe_config_dt().
+ */
+void stmmac_remove_config_dt(struct platform_device *pdev,
+                             struct plat_stmmacenet_data *plat)
+{
+        struct device_node *np = pdev->dev.of_node;
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+        of_node_put(plat->phy_node);
+}
 #else
 struct plat_stmmacenet_data *
 stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
 {
        return ERR_PTR(-ENOSYS);
 }
+void stmmac_remove_config_dt(struct platform_device *pdev,
+                             struct plat_stmmacenet_data *plat)
+{
+}
 #endif /* CONFIG_OF */
 EXPORT_SYMBOL_GPL(stmmac_probe_config_dt);
+EXPORT_SYMBOL_GPL(stmmac_remove_config_dt);
 int stmmac_get_platform_resources(struct platform_device *pdev,
                                  struct stmmac_resources *stmmac_res)
@@ -392,10 +416,13 @@ int stmmac_pltfr_remove(struct platform_device *pdev)
 {
        struct net_device *ndev = platform_get_drvdata(pdev);
        struct stmmac_priv *priv = netdev_priv(ndev);
+        struct plat_stmmacenet_data *plat = priv->plat;
        int ret = stmmac_dvr_remove(&pdev->dev);
-        if (priv->plat->exit)
+        if (plat->exit)
-                priv->plat->exit(pdev, priv->plat->bsp_priv);
+                plat->exit(pdev, plat->bsp_priv);
+        stmmac_remove_config_dt(pdev, plat);
        return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h
index 64e147f53a9c..b72eb0de57b7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h
@@ -23,6 +23,8 @@
 struct plat_stmmacenet_data *
 stmmac_probe_config_dt(struct platform_device *pdev, const char **mac);
+void stmmac_remove_config_dt(struct platform_device *pdev,
+                             struct plat_stmmacenet_data *plat);
 int stmmac_get_platform_resources(struct platform_device *pdev,
                                  struct stmmac_resources *stmmac_res);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
index 289d52725a6c..3eb281d1db08 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -54,7 +54,7 @@ static int stmmac_adjust_freq(struct ptp_clock_info *ptp, s32 ppb)
        spin_lock_irqsave(&priv->ptp_lock, flags);
-        priv->hw->ptp->config_addend(priv->ioaddr, addend);
+        priv->hw->ptp->config_addend(priv->ptpaddr, addend);
        spin_unlock_irqrestore(&priv->ptp_lock, flags);
@@ -89,7 +89,8 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)
        spin_lock_irqsave(&priv->ptp_lock, flags);
-        priv->hw->ptp->adjust_systime(priv->ioaddr, sec, nsec, neg_adj);
+        priv->hw->ptp->adjust_systime(priv->ptpaddr, sec, nsec, neg_adj,
+                                      priv->plat->has_gmac4);
        spin_unlock_irqrestore(&priv->ptp_lock, flags);
@@ -114,7 +115,7 @@ static int stmmac_get_time(struct ptp_clock_info *ptp, struct timespec64 *ts)
        spin_lock_irqsave(&priv->ptp_lock, flags);
-        ns = priv->hw->ptp->get_systime(priv->ioaddr);
+        ns = priv->hw->ptp->get_systime(priv->ptpaddr);
        spin_unlock_irqrestore(&priv->ptp_lock, flags);
@@ -141,7 +142,7 @@ static int stmmac_set_time(struct ptp_clock_info *ptp,
        spin_lock_irqsave(&priv->ptp_lock, flags);
-        priv->hw->ptp->init_systime(priv->ioaddr, ts->tv_sec, ts->tv_nsec);
+        priv->hw->ptp->init_systime(priv->ptpaddr, ts->tv_sec, ts->tv_nsec);
        spin_unlock_irqrestore(&priv->ptp_lock, flags);
@@ -177,7 +178,7 @@ static struct ptp_clock_info stmmac_ptp_clock_ops = {
 * Description: this function will register the ptp clock driver
 * to kernel. It also does some house keeping work.
 */
-int stmmac_ptp_register(struct stmmac_priv *priv)
+void stmmac_ptp_register(struct stmmac_priv *priv)
 {
        spin_lock_init(&priv->ptp_lock);
        priv->ptp_clock_ops = stmmac_ptp_clock_ops;
@@ -185,15 +186,10 @@ int stmmac_ptp_register(struct stmmac_priv *priv)
        priv->ptp_clock = ptp_clock_register(&priv->ptp_clock_ops,
                                             priv->device);
        if (IS_ERR(priv->ptp_clock)) {
+                netdev_err(priv->dev, "ptp_clock_register failed\n");
                priv->ptp_clock = NULL;
-                return PTR_ERR(priv->ptp_clock);
+        } else if (priv->ptp_clock)
-        }
+                netdev_info(priv->dev, "registered PTP clock\n");
-        spin_lock_init(&priv->ptp_lock);
-        netdev_dbg(priv->dev, "Added PTP HW clock successfully\n");
-        return 0;
 }
 /**
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
index 4535df37c227..c06938c47af5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
@@ -22,51 +22,53 @@
  Author: Rayagond Kokatanur <rayagond@vayavyalabs.com>
 ******************************************************************************/
-#ifndef __STMMAC_PTP_H__
+#ifndef __STMMAC_PTP_H__
-#define __STMMAC_PTP_H__
+#define __STMMAC_PTP_H__
-/* IEEE 1588 PTP register offsets */
+#define PTP_GMAC4_OFFSET        0xb00
-#define PTP_TCR         0x0700  /* Timestamp Control Reg */
+#define PTP_GMAC3_X_OFFSET      0x700
-#define PTP_SSIR        0x0704  /* Sub-Second Increment Reg */
-#define PTP_STSR        0x0708  /* System Time – Seconds Regr */
-#define PTP_STNSR       0x070C  /* System Time – Nanoseconds Reg */
-#define PTP_STSUR       0x0710  /* System Time – Seconds Update Reg */
-#define PTP_STNSUR      0x0714  /* System Time – Nanoseconds Update Reg */
-#define PTP_TAR         0x0718  /* Timestamp Addend Reg */
-#define PTP_TTSR        0x071C  /* Target Time Seconds Reg */
-#define PTP_TTNSR       0x0720  /* Target Time Nanoseconds Reg */
-#define PTP_STHWSR      0x0724  /* System Time - Higher Word Seconds Reg */
-#define PTP_TSR         0x0728  /* Timestamp Status */
-#define PTP_STNSUR_ADDSUB_SHIFT 31
+/* IEEE 1588 PTP register offsets */
+#define PTP_TCR         0x00    /* Timestamp Control Reg */
+#define PTP_SSIR        0x04    /* Sub-Second Increment Reg */
+#define PTP_STSR        0x08    /* System Time – Seconds Regr */
+#define PTP_STNSR       0x0c    /* System Time – Nanoseconds Reg */
+#define PTP_STSUR       0x10    /* System Time – Seconds Update Reg */
+#define PTP_STNSUR      0x14    /* System Time – Nanoseconds Update Reg */
+#define PTP_TAR         0x18    /* Timestamp Addend Reg */
-/* PTP TCR defines */
+#define PTP_STNSUR_ADDSUB_SHIFT 31
-#define PTP_TCR_TSENA           0x00000001 /* Timestamp Enable */
+#define PTP_DIGITAL_ROLLOVER_MODE       0x3B9ACA00      /* 10e9-1 ns */
-#define PTP_TCR_TSCFUPDT        0x00000002 /* Timestamp Fine/Coarse Update */
+#define PTP_BINARY_ROLLOVER_MODE        0x80000000      /* ~0.466 ns */
-#define PTP_TCR_TSINIT          0x00000004 /* Timestamp Initialize */
-#define PTP_TCR_TSUPDT          0x00000008 /* Timestamp Update */
-/* Timestamp Interrupt Trigger Enable */
-#define PTP_TCR_TSTRIG          0x00000010
-#define PTP_TCR_TSADDREG        0x00000020 /* Addend Reg Update */
-#define PTP_TCR_TSENALL         0x00000100 /* Enable Timestamp for All Frames */
-/* Timestamp Digital or Binary Rollover Control */
-#define PTP_TCR_TSCTRLSSR       0x00000200
+/* PTP Timestamp control register defines */
+#define PTP_TCR_TSENA           BIT(0)  /* Timestamp Enable */
+#define PTP_TCR_TSCFUPDT        BIT(1)  /* Timestamp Fine/Coarse Update */
+#define PTP_TCR_TSINIT          BIT(2)  /* Timestamp Initialize */
+#define PTP_TCR_TSUPDT          BIT(3)  /* Timestamp Update */
+#define PTP_TCR_TSTRIG          BIT(4)  /* Timestamp Interrupt Trigger Enable */
+#define PTP_TCR_TSADDREG        BIT(5)  /* Addend Reg Update */
+#define PTP_TCR_TSENALL         BIT(8)  /* Enable Timestamp for All Frames */
+#define PTP_TCR_TSCTRLSSR       BIT(9)  /* Digital or Binary Rollover Control */
 /* Enable PTP packet Processing for Version 2 Format */
-#define PTP_TCR_TSVER2ENA       0x00000400
+#define PTP_TCR_TSVER2ENA       BIT(10)
 /* Enable Processing of PTP over Ethernet Frames */
-#define PTP_TCR_TSIPENA         0x00000800
+#define PTP_TCR_TSIPENA         BIT(11)
 /* Enable Processing of PTP Frames Sent over IPv6-UDP */
-#define PTP_TCR_TSIPV6ENA       0x00001000
+#define PTP_TCR_TSIPV6ENA       BIT(12)
 /* Enable Processing of PTP Frames Sent over IPv4-UDP */
-#define PTP_TCR_TSIPV4ENA       0x00002000
+#define PTP_TCR_TSIPV4ENA       BIT(13)
 /* Enable Timestamp Snapshot for Event Messages */
-#define PTP_TCR_TSEVNTENA       0x00004000
+#define PTP_TCR_TSEVNTENA       BIT(14)
 /* Enable Snapshot for Messages Relevant to Master */
-#define PTP_TCR_TSMSTRENA       0x00008000
+#define PTP_TCR_TSMSTRENA       BIT(15)
 /* Select PTP packets for Taking Snapshots */
-#define PTP_TCR_SNAPTYPSEL_1    0x00010000
+#define PTP_TCR_SNAPTYPSEL_1    GENMASK(17, 16)
 /* Enable MAC address for PTP Frame Filtering */
-#define PTP_TCR_TSENMACADDR     0x00040000
+#define PTP_TCR_TSENMACADDR     BIT(18)
+/* SSIR defines */
+#define PTP_SSIR_SSINC_MASK             0xff
+#define GMAC4_PTP_SSIR_SSINC_SHIFT      16
-#endif /* __STMMAC_PTP_H__ */
+#endif  /* __STMMAC_PTP_H__ */
diff --git a/drivers/net/ethernet/sun/sunbmac.c b/drivers/net/ethernet/sun/sunbmac.c
index aa4f9d2d8fa9..02f452730d52 100644
--- a/drivers/net/ethernet/sun/sunbmac.c
+++ b/drivers/net/ethernet/sun/sunbmac.c
@@ -623,6 +623,7 @@ static int bigmac_init_hw(struct bigmac *bp, int from_irq)
        void __iomem *gregs        = bp->gregs;
        void __iomem *cregs        = bp->creg;
        void __iomem *bregs        = bp->bregs;
+        __u32 bblk_dvma = (__u32)bp->bblock_dvma;
        unsigned char *e = &bp->dev->dev_addr[0];
        /* Latch current counters into statistics. */
@@ -671,9 +672,9 @@ static int bigmac_init_hw(struct bigmac *bp, int from_irq)
                    bregs + BMAC_XIFCFG);
        /* Tell the QEC where the ring descriptors are. */
-        sbus_writel(bp->bblock_dvma + bib_offset(be_rxd, 0),
+        sbus_writel(bblk_dvma + bib_offset(be_rxd, 0),
                    cregs + CREG_RXDS);
-        sbus_writel(bp->bblock_dvma + bib_offset(be_txd, 0),
+        sbus_writel(bblk_dvma + bib_offset(be_txd, 0),
                    cregs + CREG_TXDS);
        /* Setup the FIFO pointers into QEC local memory. */
diff --git a/drivers/net/ethernet/sun/sunbmac.h b/drivers/net/ethernet/sun/sunbmac.h
index 06dd21707353..532fc56830cf 100644
--- a/drivers/net/ethernet/sun/sunbmac.h
+++ b/drivers/net/ethernet/sun/sunbmac.h
@@ -291,7 +291,7 @@ struct bigmac {
        void __iomem    *bregs; /* BigMAC Registers                   */
        void __iomem    *tregs; /* BigMAC Transceiver                 */
        struct bmac_init_block  *bmac_block;    /* RX and TX descriptors */
-        __u32                    bblock_dvma;   /* RX and TX descriptors */
+        dma_addr_t              bblock_dvma;    /* RX and TX descriptors */
        spinlock_t              lock;
diff --git a/drivers/net/ethernet/sun/sunqe.c b/drivers/net/ethernet/sun/sunqe.c
index 9b825780b3be..9582948145c1 100644
--- a/drivers/net/ethernet/sun/sunqe.c
+++ b/drivers/net/ethernet/sun/sunqe.c
@@ -124,7 +124,7 @@ static void qe_init_rings(struct sunqe *qep)
 {
        struct qe_init_block *qb = qep->qe_block;
        struct sunqe_buffers *qbufs = qep->buffers;
-        __u32 qbufs_dvma = qep->buffers_dvma;
+        __u32 qbufs_dvma = (__u32)qep->buffers_dvma;
        int i;
        qep->rx_new = qep->rx_old = qep->tx_new = qep->tx_old = 0;
@@ -144,6 +144,7 @@ static int qe_init(struct sunqe *qep, int from_irq)
        void __iomem *mregs = qep->mregs;
        void __iomem *gregs = qecp->gregs;
        unsigned char *e = &qep->dev->dev_addr[0];
+        __u32 qblk_dvma = (__u32)qep->qblock_dvma;
        u32 tmp;
        int i;
@@ -152,8 +153,8 @@ static int qe_init(struct sunqe *qep, int from_irq)
                return -EAGAIN;
        /* Setup initial rx/tx init block pointers. */
-        sbus_writel(qep->qblock_dvma + qib_offset(qe_rxd, 0), cregs + CREG_RXDS);
+        sbus_writel(qblk_dvma + qib_offset(qe_rxd, 0), cregs + CREG_RXDS);
-        sbus_writel(qep->qblock_dvma + qib_offset(qe_txd, 0), cregs + CREG_TXDS);
+        sbus_writel(qblk_dvma + qib_offset(qe_txd, 0), cregs + CREG_TXDS);
        /* Enable/mask the various irq's. */
        sbus_writel(0, cregs + CREG_RIMASK);
@@ -413,7 +414,7 @@ static void qe_rx(struct sunqe *qep)
        struct net_device *dev = qep->dev;
        struct qe_rxd *this;
        struct sunqe_buffers *qbufs = qep->buffers;
-        __u32 qbufs_dvma = qep->buffers_dvma;
+        __u32 qbufs_dvma = (__u32)qep->buffers_dvma;
        int elem = qep->rx_new;
        u32 flags;
@@ -572,7 +573,7 @@ static int qe_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct sunqe *qep = netdev_priv(dev);
        struct sunqe_buffers *qbufs = qep->buffers;
-        __u32 txbuf_dvma, qbufs_dvma = qep->buffers_dvma;
+        __u32 txbuf_dvma, qbufs_dvma = (__u32)qep->buffers_dvma;
        unsigned char *txbuf;
        int len, entry;
diff --git a/drivers/net/ethernet/sun/sunqe.h b/drivers/net/ethernet/sun/sunqe.h
index 581781b6b2fa..ae190b77431b 100644
--- a/drivers/net/ethernet/sun/sunqe.h
+++ b/drivers/net/ethernet/sun/sunqe.h
@@ -334,12 +334,12 @@ struct sunqe {
        void __iomem                    *qcregs;                /* QEC per-channel Registers   */
        void __iomem                    *mregs;         /* Per-channel MACE Registers  */
        struct qe_init_block            *qe_block;      /* RX and TX descriptors       */
-        __u32                           qblock_dvma;    /* RX and TX descriptors       */
+        dma_addr_t                      qblock_dvma;    /* RX and TX descriptors       */
        spinlock_t                      lock;           /* Protects txfull state       */
        int                             rx_new, rx_old; /* RX ring extents             */
        int                             tx_new, tx_old; /* TX ring extents             */
        struct sunqe_buffers            *buffers;       /* CPU visible address.        */
-        __u32                           buffers_dvma;   /* DVMA visible address.       */
+        dma_addr_t                      buffers_dvma;   /* DVMA visible address.       */
        struct sunqec                   *parent;
        u8                              mconfig;        /* Base MACE mconfig value     */
        struct platform_device          *op;            /* QE's OF device struct       */
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 0d0053128542..97d64bfed465 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -33,7 +33,6 @@
 #include <linux/stat.h>
 #include <linux/types.h>
-#include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
@@ -43,7 +42,6 @@
 #include <linux/phy.h>
 #include <linux/mii.h>
-#include <linux/delay.h>
 #include <linux/dma-mapping.h>
 #include <linux/vmalloc.h>
@@ -982,11 +980,13 @@ static int dwceqos_mii_probe(struct net_device *ndev)
        if (netif_msg_probe(lp))
                phy_attached_info(phydev);
-        phydev->supported &= PHY_GBIT_FEATURES;
+        phydev->supported &= PHY_GBIT_FEATURES | SUPPORTED_Pause |
+                             SUPPORTED_Asym_Pause;
        lp->link    = 0;
        lp->speed   = 0;
        lp->duplex  = DUPLEX_UNKNOWN;
+        lp->flowcontrol.autoneg = AUTONEG_ENABLE;
        return 0;
 }
@@ -2881,7 +2881,7 @@ static int dwceqos_probe(struct platform_device *pdev)
        ret = of_get_phy_mode(lp->pdev->dev.of_node);
        if (ret < 0) {
                dev_err(&lp->pdev->dev, "error in getting phy i/f\n");
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
        }
        lp->phy_interface = ret;
@@ -2889,14 +2889,14 @@ static int dwceqos_probe(struct platform_device *pdev)
        ret = dwceqos_mii_init(lp);
        if (ret) {
                dev_err(&lp->pdev->dev, "error in dwceqos_mii_init\n");
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
        }
        ret = dwceqos_mii_probe(ndev);
        if (ret != 0) {
                netdev_err(ndev, "mii_probe fail.\n");
                ret = -ENXIO;
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
        }
        dwceqos_set_umac_addr(lp, lp->ndev->dev_addr, 0);
@@ -2914,7 +2914,7 @@ static int dwceqos_probe(struct platform_device *pdev)
        if (ret) {
                dev_err(&lp->pdev->dev, "Unable to retrieve DT, error %d\n",
                        ret);
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
        }
        dev_info(&lp->pdev->dev, "pdev->id %d, baseaddr 0x%08lx, irq %d\n",
                 pdev->id, ndev->base_addr, ndev->irq);
@@ -2924,7 +2924,7 @@ static int dwceqos_probe(struct platform_device *pdev)
        if (ret) {
                dev_err(&lp->pdev->dev, "Unable to request IRQ %d, error %d\n",
                        ndev->irq, ret);
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
        }
        if (netif_msg_probe(lp))
@@ -2935,11 +2935,14 @@ static int dwceqos_probe(struct platform_device *pdev)
        ret = register_netdev(ndev);
        if (ret) {
                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
-                        goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
        }
        return 0;
+err_out_deregister_fixed_link:
+        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                of_phy_deregister_fixed_link(pdev->dev.of_node);
 err_out_clk_dis_phy:
        clk_disable_unprepare(lp->phy_ref_clk);
 err_out_clk_dis_aper:
@@ -2959,8 +2962,11 @@ static int dwceqos_remove(struct platform_device *pdev)
        if (ndev) {
                lp = netdev_priv(ndev);
-                if (ndev->phydev)
+                if (ndev->phydev) {
                        phy_disconnect(ndev->phydev);
+                        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                                of_phy_deregister_fixed_link(pdev->dev.of_node);
+                }
                mdiobus_unregister(lp->mii_bus);
                mdiobus_free(lp->mii_bus);
diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
index fa0cfda24fd9..28097be2ff28 100644
--- a/drivers/net/ethernet/ti/cpmac.c
+++ b/drivers/net/ethernet/ti/cpmac.c
@@ -1113,6 +1113,7 @@ static int cpmac_probe(struct platform_device *pdev)
        if (!dev)
                return -ENOMEM;
+        SET_NETDEV_DEV(dev, &pdev->dev);
        platform_set_drvdata(pdev, dev);
        priv = netdev_priv(dev);
diff --git a/drivers/net/ethernet/ti/cpsw-phy-sel.c b/drivers/net/ethernet/ti/cpsw-phy-sel.c
index 054a8dd23dae..18013645e76c 100644
--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
+++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
@@ -81,6 +81,7 @@ static void cpsw_gmii_sel_am3352(struct cpsw_phy_sel_priv *priv,
        };
        mask = GMII_SEL_MODE_MASK << (slave * 2) | BIT(slave + 6);
+        mask |= BIT(slave + 4);
        mode <<= slave * 2;
        if (priv->rmii_clock_external) {
@@ -176,9 +177,12 @@ void cpsw_phy_sel(struct device *dev, phy_interface_t phy_mode, int slave)
        }
        dev = bus_find_device(&platform_bus_type, NULL, node, match);
+        of_node_put(node);
        priv = dev_get_drvdata(dev);
        priv->cpsw_phy_sel(priv, phy_mode, slave);
+        put_device(dev);
 }
 EXPORT_SYMBOL_GPL(cpsw_phy_sel);
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index c6cff3d2ff05..b9087b828eff 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2375,8 +2375,11 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                         * to the PHY is the Ethernet MAC DT node.
                         */
                        ret = of_phy_register_fixed_link(slave_node);
-                        if (ret)
+                        if (ret) {
+                                if (ret != -EPROBE_DEFER)
+                                        dev_err(&pdev->dev, "failed to register fixed-link phy: %d\n", ret);
                                return ret;
+                        }
                        slave_data->phy_node = of_node_get(slave_node);
                } else if (parp) {
                        u32 phyid;
@@ -2397,6 +2400,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                        }
                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
                                 PHY_ID_FMT, mdio->name, phyid);
+                        put_device(&mdio->dev);
                } else {
                        dev_err(&pdev->dev,
                                "No slave[%d] phy_id, phy-handle, or fixed-link property\n",
@@ -2440,6 +2444,34 @@ no_phy_slave:
        return 0;
 }
+static void cpsw_remove_dt(struct platform_device *pdev)
+{
+        struct net_device *ndev = platform_get_drvdata(pdev);
+        struct cpsw_common *cpsw = ndev_to_cpsw(ndev);
+        struct cpsw_platform_data *data = &cpsw->data;
+        struct device_node *node = pdev->dev.of_node;
+        struct device_node *slave_node;
+        int i = 0;
+        for_each_available_child_of_node(node, slave_node) {
+                struct cpsw_slave_data *slave_data = &data->slave_data[i];
+                if (strcmp(slave_node->name, "slave"))
+                        continue;
+                if (of_phy_is_fixed_link(slave_node))
+                        of_phy_deregister_fixed_link(slave_node);
+                of_node_put(slave_data->phy_node);
+                i++;
+                if (i == data->slaves)
+                        break;
+        }
+        of_platform_depopulate(&pdev->dev);
+}
 static int cpsw_probe_dual_emac(struct cpsw_priv *priv)
 {
        struct cpsw_common              *cpsw = priv->cpsw;
@@ -2547,6 +2579,9 @@ static int cpsw_probe(struct platform_device *pdev)
        int irq;
        cpsw = devm_kzalloc(&pdev->dev, sizeof(struct cpsw_common), GFP_KERNEL);
+        if (!cpsw)
+                return -ENOMEM;
        cpsw->dev = &pdev->dev;
        ndev = alloc_etherdev_mq(sizeof(struct cpsw_priv), CPSW_MAX_QUEUES);
@@ -2584,11 +2619,19 @@ static int cpsw_probe(struct platform_device *pdev)
        /* Select default pin state */
        pinctrl_pm_select_default_state(&pdev->dev);
-        if (cpsw_probe_dt(&cpsw->data, pdev)) {
+        /* Need to enable clocks with runtime PM api to access module
-                dev_err(&pdev->dev, "cpsw: platform data missing\n");
+         * registers
-                ret = -ENODEV;
+         */
+        ret = pm_runtime_get_sync(&pdev->dev);
+        if (ret < 0) {
+                pm_runtime_put_noidle(&pdev->dev);
                goto clean_runtime_disable_ret;
        }
+        ret = cpsw_probe_dt(&cpsw->data, pdev);
+        if (ret)
+                goto clean_dt_ret;
        data = &cpsw->data;
        cpsw->rx_ch_num = 1;
        cpsw->tx_ch_num = 1;
@@ -2608,7 +2651,7 @@ static int cpsw_probe(struct platform_device *pdev)
                                    GFP_KERNEL);
        if (!cpsw->slaves) {
                ret = -ENOMEM;
-                goto clean_runtime_disable_ret;
+                goto clean_dt_ret;
        }
        for (i = 0; i < data->slaves; i++)
                cpsw->slaves[i].slave_num = i;
@@ -2620,7 +2663,7 @@ static int cpsw_probe(struct platform_device *pdev)
        if (IS_ERR(clk)) {
                dev_err(priv->dev, "fck is not found\n");
                ret = -ENODEV;
-                goto clean_runtime_disable_ret;
+                goto clean_dt_ret;
        }
        cpsw->bus_freq_mhz = clk_get_rate(clk) / 1000000;
@@ -2628,26 +2671,17 @@ static int cpsw_probe(struct platform_device *pdev)
        ss_regs = devm_ioremap_resource(&pdev->dev, ss_res);
        if (IS_ERR(ss_regs)) {
                ret = PTR_ERR(ss_regs);
-                goto clean_runtime_disable_ret;
+                goto clean_dt_ret;
        }
        cpsw->regs = ss_regs;
-        /* Need to enable clocks with runtime PM api to access module
-         * registers
-         */
-        ret = pm_runtime_get_sync(&pdev->dev);
-        if (ret < 0) {
-                pm_runtime_put_noidle(&pdev->dev);
-                goto clean_runtime_disable_ret;
-        }
        cpsw->version = readl(&cpsw->regs->id_ver);
-        pm_runtime_put_sync(&pdev->dev);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
        cpsw->wr_regs = devm_ioremap_resource(&pdev->dev, res);
        if (IS_ERR(cpsw->wr_regs)) {
                ret = PTR_ERR(cpsw->wr_regs);
-                goto clean_runtime_disable_ret;
+                goto clean_dt_ret;
        }
        memset(&dma_params, 0, sizeof(dma_params));
@@ -2684,7 +2718,7 @@ static int cpsw_probe(struct platform_device *pdev)
        default:
                dev_err(priv->dev, "unknown version 0x%08x\n", cpsw->version);
                ret = -ENODEV;
-                goto clean_runtime_disable_ret;
+                goto clean_dt_ret;
        }
        for (i = 0; i < cpsw->data.slaves; i++) {
                struct cpsw_slave *slave = &cpsw->slaves[i];
@@ -2713,7 +2747,7 @@ static int cpsw_probe(struct platform_device *pdev)
        if (!cpsw->dma) {
                dev_err(priv->dev, "error initializing dma\n");
                ret = -ENOMEM;
-                goto clean_runtime_disable_ret;
+                goto clean_dt_ret;
        }
        cpsw->txch[0] = cpdma_chan_create(cpsw->dma, 0, cpsw_tx_handler, 0);
@@ -2811,16 +2845,23 @@ static int cpsw_probe(struct platform_device *pdev)
                ret = cpsw_probe_dual_emac(priv);
                if (ret) {
                        cpsw_err(priv, probe, "error probe slave 2 emac interface\n");
-                        goto clean_ale_ret;
+                        goto clean_unregister_netdev_ret;
                }
        }
+        pm_runtime_put(&pdev->dev);
        return 0;
+clean_unregister_netdev_ret:
+        unregister_netdev(ndev);
 clean_ale_ret:
        cpsw_ale_destroy(cpsw->ale);
 clean_dma_ret:
        cpdma_ctlr_destroy(cpsw->dma);
+clean_dt_ret:
+        cpsw_remove_dt(pdev);
+        pm_runtime_put_sync(&pdev->dev);
 clean_runtime_disable_ret:
        pm_runtime_disable(&pdev->dev);
 clean_ndev_ret:
@@ -2846,7 +2887,7 @@ static int cpsw_remove(struct platform_device *pdev)
        cpsw_ale_destroy(cpsw->ale);
        cpdma_ctlr_destroy(cpsw->dma);
-        of_platform_depopulate(&pdev->dev);
+        cpsw_remove_dt(pdev);
        pm_runtime_put_sync(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
        if (cpsw->data.dual_emac)
@@ -2889,6 +2930,8 @@ static int cpsw_resume(struct device *dev)
        /* Select default pin state */
        pinctrl_pm_select_default_state(dev);
+        /* shut up ASSERT_RTNL() warning in netif_set_real_num_tx/rx_queues */
+        rtnl_lock();
        if (cpsw->data.dual_emac) {
                int i;
@@ -2900,6 +2943,8 @@ static int cpsw_resume(struct device *dev)
                if (netif_running(ndev))
                        cpsw_ndo_open(ndev);
        }
+        rtnl_unlock();
        return 0;
 }
 #endif
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 2fd94a5bc1f3..481c7bf0395b 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1410,6 +1410,7 @@ static int emac_dev_open(struct net_device *ndev)
        int i = 0;
        struct emac_priv *priv = netdev_priv(ndev);
        struct phy_device *phydev = NULL;
+        struct device *phy = NULL;
        ret = pm_runtime_get_sync(&priv->pdev->dev);
        if (ret < 0) {
@@ -1488,19 +1489,20 @@ static int emac_dev_open(struct net_device *ndev)
        /* use the first phy on the bus if pdata did not give us a phy id */
        if (!phydev && !priv->phy_id) {
-                struct device *phy;
                phy = bus_find_device(&mdio_bus_type, NULL, NULL,
                                      match_first_device);
-                if (phy)
+                if (phy) {
                        priv->phy_id = dev_name(phy);
+                        if (!priv->phy_id || !*priv->phy_id)
+                                put_device(phy);
+                }
        }
        if (!phydev && priv->phy_id && *priv->phy_id) {
                phydev = phy_connect(ndev, priv->phy_id,
                                     &emac_adjust_link,
                                     PHY_INTERFACE_MODE_MII);
+                put_device(phy);        /* reference taken by bus_find_device */
                if (IS_ERR(phydev)) {
                        dev_err(emac_dev, "could not connect to phy %s\n",
                                priv->phy_id);
@@ -1765,6 +1767,7 @@ static int davinci_emac_try_get_mac(struct platform_device *pdev,
 */
 static int davinci_emac_probe(struct platform_device *pdev)
 {
+        struct device_node *np = pdev->dev.of_node;
        int rc = 0;
        struct resource *res, *res_ctrl;
        struct net_device *ndev;
@@ -1803,7 +1806,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
        if (!pdata) {
                dev_err(&pdev->dev, "no platform data\n");
                rc = -ENODEV;
-                goto no_pdata;
+                goto err_free_netdev;
        }
        /* MAC addr and PHY mask , RMII enable info from platform_data */
@@ -1939,6 +1942,10 @@ no_cpdma_chan:
                cpdma_chan_destroy(priv->rxchan);
        cpdma_ctlr_destroy(priv->dma);
 no_pdata:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+        of_node_put(priv->phy_node);
+err_free_netdev:
        free_netdev(ndev);
        return rc;
 }
@@ -1954,6 +1961,7 @@ static int davinci_emac_remove(struct platform_device *pdev)
 {
        struct net_device *ndev = platform_get_drvdata(pdev);
        struct emac_priv *priv = netdev_priv(ndev);
+        struct device_node *np = pdev->dev.of_node;
        dev_notice(&ndev->dev, "DaVinci EMAC: davinci_emac_remove()\n");
@@ -1966,6 +1974,8 @@ static int davinci_emac_remove(struct platform_device *pdev)
        unregister_netdev(ndev);
        of_node_put(priv->phy_node);
        pm_runtime_disable(&pdev->dev);
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
        free_netdev(ndev);
        return 0;
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
index 446ea580ad42..928c1dca2673 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
@@ -1694,7 +1694,7 @@ struct gelic_wl_scan_info *gelic_wl_find_best_bss(struct gelic_wl_info *wl)
                                pr_debug("%s: bssid matched\n", __func__);
                                break;
                        } else {
-                                pr_debug("%s: bssid unmached\n", __func__);
+                                pr_debug("%s: bssid unmatched\n", __func__);
                                continue;
                        }
                }
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index 7f127dc1b7ba..fa32391720fe 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -708,8 +708,7 @@ static int eth_poll(struct napi_struct *napi, int budget)
                        if (!qmgr_stat_below_low_watermark(rxq) &&
                            napi_reschedule(napi)) { /* not empty again */
 #if DEBUG_RX
-                                printk(KERN_DEBUG "%s: eth_poll"
+                                printk(KERN_DEBUG "%s: eth_poll napi_reschedule succeeded\n",
-                                       " napi_reschedule successed\n",
                                       dev->name);
 #endif
                                qmgr_disable_irq(rxq);
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 3c20e87bb761..8b4822ad27cb 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -58,9 +58,9 @@ struct geneve_dev {
        struct hlist_node  hlist;       /* vni hash table */
        struct net         *net;        /* netns for packet i/o */
        struct net_device  *dev;        /* netdev for geneve tunnel */
-        struct geneve_sock *sock4;      /* IPv4 socket used for geneve tunnel */
+        struct geneve_sock __rcu *sock4;        /* IPv4 socket used for geneve tunnel */
 #if IS_ENABLED(CONFIG_IPV6)
-        struct geneve_sock *sock6;      /* IPv6 socket used for geneve tunnel */
+        struct geneve_sock __rcu *sock6;        /* IPv6 socket used for geneve tunnel */
 #endif
        u8                 vni[3];      /* virtual network ID for tunnel */
        u8                 ttl;         /* TTL override */
@@ -453,7 +453,7 @@ static struct sk_buff **geneve_gro_receive(struct sock *sk,
        skb_gro_pull(skb, gh_len);
        skb_gro_postpull_rcsum(skb, gh, gh_len);
-        pp = ptype->callbacks.gro_receive(head, skb);
+        pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb);
        flush = 0;
 out_unlock:
@@ -543,9 +543,19 @@ static void __geneve_sock_release(struct geneve_sock *gs)
 static void geneve_sock_release(struct geneve_dev *geneve)
 {
-        __geneve_sock_release(geneve->sock4);
+        struct geneve_sock *gs4 = rtnl_dereference(geneve->sock4);
 #if IS_ENABLED(CONFIG_IPV6)
-        __geneve_sock_release(geneve->sock6);
+        struct geneve_sock *gs6 = rtnl_dereference(geneve->sock6);
+        rcu_assign_pointer(geneve->sock6, NULL);
+#endif
+        rcu_assign_pointer(geneve->sock4, NULL);
+        synchronize_net();
+        __geneve_sock_release(gs4);
+#if IS_ENABLED(CONFIG_IPV6)
+        __geneve_sock_release(gs6);
 #endif
 }
@@ -586,10 +596,10 @@ out:
        gs->flags = geneve->flags;
 #if IS_ENABLED(CONFIG_IPV6)
        if (ipv6)
-                geneve->sock6 = gs;
+                rcu_assign_pointer(geneve->sock6, gs);
        else
 #endif
-                geneve->sock4 = gs;
+                rcu_assign_pointer(geneve->sock4, gs);
        hash = geneve_net_vni_hash(geneve->vni);
        hlist_add_head_rcu(&geneve->hlist, &gs->vni_list[hash]);
@@ -603,9 +613,7 @@ static int geneve_open(struct net_device *dev)
        bool metadata = geneve->collect_md;
        int ret = 0;
-        geneve->sock4 = NULL;
 #if IS_ENABLED(CONFIG_IPV6)
-        geneve->sock6 = NULL;
        if (ipv6 || metadata)
                ret = geneve_sock_add(geneve, true);
 #endif
@@ -720,6 +728,9 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb,
        struct rtable *rt = NULL;
        __u8 tos;
+        if (!rcu_dereference(geneve->sock4))
+                return ERR_PTR(-EIO);
        memset(fl4, 0, sizeof(*fl4));
        fl4->flowi4_mark = skb->mark;
        fl4->flowi4_proto = IPPROTO_UDP;
@@ -772,11 +783,15 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,
 {
        bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
        struct geneve_dev *geneve = netdev_priv(dev);
-        struct geneve_sock *gs6 = geneve->sock6;
        struct dst_entry *dst = NULL;
        struct dst_cache *dst_cache;
+        struct geneve_sock *gs6;
        __u8 prio;
+        gs6 = rcu_dereference(geneve->sock6);
+        if (!gs6)
+                return ERR_PTR(-EIO);
        memset(fl6, 0, sizeof(*fl6));
        fl6->flowi6_mark = skb->mark;
        fl6->flowi6_proto = IPPROTO_UDP;
@@ -842,9 +857,8 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                                   struct ip_tunnel_info *info)
 {
        struct geneve_dev *geneve = netdev_priv(dev);
-        struct geneve_sock *gs4 = geneve->sock4;
+        struct geneve_sock *gs4;
        struct rtable *rt = NULL;
-        const struct iphdr *iip; /* interior IP header */
        int err = -EINVAL;
        struct flowi4 fl4;
        __u8 tos, ttl;
@@ -853,6 +867,10 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
        bool xnet = !net_eq(geneve->net, dev_net(geneve->dev));
        u32 flags = geneve->flags;
+        gs4 = rcu_dereference(geneve->sock4);
+        if (!gs4)
+                goto tx_error;
        if (geneve->collect_md) {
                if (unlikely(!info || !(info->mode & IP_TUNNEL_INFO_TX))) {
                        netdev_dbg(dev, "no tunnel metadata\n");
@@ -871,8 +889,6 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
        sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
        skb_reset_mac_header(skb);
-        iip = ip_hdr(skb);
        if (info) {
                const struct ip_tunnel_key *key = &info->key;
                u8 *opts = NULL;
@@ -892,7 +908,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                if (unlikely(err))
                        goto tx_error;
-                tos = ip_tunnel_ecn_encap(key->tos, iip, skb);
+                tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
                ttl = key->ttl;
                df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
        } else {
@@ -901,7 +917,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                if (unlikely(err))
                        goto tx_error;
-                tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, iip, skb);
+                tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, ip_hdr(skb), skb);
                ttl = geneve->ttl;
                if (!ttl && IN_MULTICAST(ntohl(fl4.daddr)))
                        ttl = 1;
@@ -932,9 +948,8 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                                    struct ip_tunnel_info *info)
 {
        struct geneve_dev *geneve = netdev_priv(dev);
-        struct geneve_sock *gs6 = geneve->sock6;
        struct dst_entry *dst = NULL;
-        const struct iphdr *iip; /* interior IP header */
+        struct geneve_sock *gs6;
        int err = -EINVAL;
        struct flowi6 fl6;
        __u8 prio, ttl;
@@ -943,6 +958,10 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
        bool xnet = !net_eq(geneve->net, dev_net(geneve->dev));
        u32 flags = geneve->flags;
+        gs6 = rcu_dereference(geneve->sock6);
+        if (!gs6)
+                goto tx_error;
        if (geneve->collect_md) {
                if (unlikely(!info || !(info->mode & IP_TUNNEL_INFO_TX))) {
                        netdev_dbg(dev, "no tunnel metadata\n");
@@ -959,8 +978,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
        sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
        skb_reset_mac_header(skb);
-        iip = ip_hdr(skb);
        if (info) {
                const struct ip_tunnel_key *key = &info->key;
                u8 *opts = NULL;
@@ -981,7 +998,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                if (unlikely(err))
                        goto tx_error;
-                prio = ip_tunnel_ecn_encap(key->tos, iip, skb);
+                prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
                ttl = key->ttl;
                label = info->key.label;
        } else {
@@ -991,7 +1008,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                        goto tx_error;
                prio = ip_tunnel_ecn_encap(ip6_tclass(fl6.flowlabel),
-                                           iip, skb);
+                                           ip_hdr(skb), skb);
                ttl = geneve->ttl;
                if (!ttl && ipv6_addr_is_multicast(&fl6.daddr))
                        ttl = 1;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index f0919bd3a563..c9140c3aeb67 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -47,6 +47,10 @@
                                 NETIF_F_TSO | \
                                 NETIF_F_TSO6 | \
                                 NETIF_F_HW_CSUM)
+/* Restrict GSO size to account for NVGRE */
+#define NETVSC_GSO_MAX_SIZE     62768
 static int ring_size = 128;
 module_param(ring_size, int, S_IRUGO);
 MODULE_PARM_DESC(ring_size, "Ring buffer size (# of pages)");
@@ -447,7 +451,7 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net)
         * Setup the sendside checksum offload only if this is not a
         * GSO packet.
         */
-        if (skb_is_gso(skb)) {
+        if ((net_trans_info & (INFO_TCP | INFO_UDP)) && skb_is_gso(skb)) {
                struct ndis_tcp_lso_info *lso_info;
                rndis_msg_size += NDIS_LSO_PPI_SIZE;
@@ -607,15 +611,18 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net,
               packet->total_data_buflen);
        skb->protocol = eth_type_trans(skb, net);
-        if (csum_info) {
-                /* We only look at the IP checksum here.
+        /* skb is already created with CHECKSUM_NONE */
-                 * Should we be dropping the packet if checksum
+        skb_checksum_none_assert(skb);
-                 * failed? How do we deal with other checksums - TCP/UDP?
-                 */
+        /*
-                if (csum_info->receive.ip_checksum_succeeded)
+         * In Linux, the IP checksum is always checked.
+         * Do L4 checksum offload if enabled and present.
+         */
+        if (csum_info && (net->features & NETIF_F_RXCSUM)) {
+                if (csum_info->receive.tcp_checksum_succeeded ||
+                    csum_info->receive.udp_checksum_succeeded)
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                else
-                        skb->ip_summed = CHECKSUM_NONE;
        }
        if (vlan_tci & VLAN_TAG_PRESENT)
@@ -696,12 +703,8 @@ int netvsc_recv_callback(struct hv_device *device_obj,
 static void netvsc_get_drvinfo(struct net_device *net,
                               struct ethtool_drvinfo *info)
 {
-        struct net_device_context *net_device_ctx = netdev_priv(net);
-        struct hv_device *dev = net_device_ctx->device_ctx;
        strlcpy(info->driver, KBUILD_MODNAME, sizeof(info->driver));
        strlcpy(info->fw_version, "N/A", sizeof(info->fw_version));
-        strlcpy(info->bus_info, vmbus_dev_name(dev), sizeof(info->bus_info));
 }
 static void netvsc_get_channels(struct net_device *net,
@@ -1401,6 +1404,7 @@ static int netvsc_probe(struct hv_device *dev,
        nvdev = net_device_ctx->nvdev;
        netif_set_real_num_tx_queues(net, nvdev->num_chn);
        netif_set_real_num_rx_queues(net, nvdev->num_chn);
+        netif_set_gso_max_size(net, NETVSC_GSO_MAX_SIZE);
        ret = register_netdev(net);
        if (ret != 0) {
diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
index 9fa7ac9f8e68..f355df7cf84a 100644
--- a/drivers/net/ieee802154/adf7242.c
+++ b/drivers/net/ieee802154/adf7242.c
@@ -20,7 +20,6 @@
 #include <linux/skbuff.h>
 #include <linux/of.h>
 #include <linux/irq.h>
-#include <linux/delay.h>
 #include <linux/debugfs.h>
 #include <linux/bitops.h>
 #include <linux/ieee802154.h>
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index f442eb366863..dfbc4ef6d507 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -497,6 +497,7 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
        struct net_device *phy_dev;
        int err;
        u16 mode = IPVLAN_MODE_L3;
+        bool create = false;
        if (!tb[IFLA_LINK])
                return -EINVAL;
@@ -513,6 +514,7 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
                err = ipvlan_port_create(phy_dev);
                if (err < 0)
                        return err;
+                create = true;
        }
        if (data && data[IFLA_IPVLAN_MODE])
@@ -536,22 +538,29 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
        err = register_netdevice(dev);
        if (err < 0)
-                return err;
+                goto destroy_ipvlan_port;
        err = netdev_upper_dev_link(phy_dev, dev);
        if (err) {
-                unregister_netdevice(dev);
+                goto unregister_netdev;
-                return err;
        }
        err = ipvlan_set_port_mode(port, mode);
        if (err) {
-                unregister_netdevice(dev);
+                goto unlink_netdev;
-                return err;
        }
        list_add_tail_rcu(&ipvlan->pnode, &port->ipvlans);
        netif_stacked_transfer_operstate(phy_dev, dev);
        return 0;
+unlink_netdev:
+        netdev_upper_dev_unlink(phy_dev, dev);
+unregister_netdev:
+        unregister_netdevice(dev);
+destroy_ipvlan_port:
+        if (create)
+                ipvlan_port_destroy(phy_dev);
+        return err;
 }
 static void ipvlan_link_delete(struct net_device *dev, struct list_head *head)
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index a198946bc54f..8716b8c07feb 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1723,6 +1723,7 @@ static int irda_usb_probe(struct usb_interface *intf,
        /* Don't change this buffer size and allocation without doing
         * some heavy and complete testing. Don't ask why :-(
         * Jean II */
+        ret = -ENOMEM;
        self->speed_buff = kzalloc(IRDA_USB_SPEED_MTU, GFP_KERNEL);
        if (!self->speed_buff)
                goto err_out_3;
diff --git a/drivers/net/irda/w83977af_ir.c b/drivers/net/irda/w83977af_ir.c
index 4e3d2e7c697c..e8c3a8c32534 100644
--- a/drivers/net/irda/w83977af_ir.c
+++ b/drivers/net/irda/w83977af_ir.c
@@ -518,7 +518,9 @@ static netdev_tx_t w83977af_hard_xmit(struct sk_buff *skb,
                
                mtt = irda_get_mtt(skb);
                pr_debug("%s(%ld), mtt=%d\n", __func__ , jiffies, mtt);
-                        if (mtt)
+                        if (mtt > 1000)
+                                mdelay(mtt/1000);
+                        else if (mtt)
                                udelay(mtt);
                        /* Enable DMA interrupt */
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 3ea47f28e143..d2e61e002926 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -397,6 +397,14 @@ static struct macsec_cb *macsec_skb_cb(struct sk_buff *skb)
 #define DEFAULT_ENCRYPT false
 #define DEFAULT_ENCODING_SA 0
+static bool send_sci(const struct macsec_secy *secy)
+{
+        const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
+        return tx_sc->send_sci ||
+                (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb);
+}
 static sci_t make_sci(u8 *addr, __be16 port)
 {
        sci_t sci;
@@ -437,15 +445,15 @@ static unsigned int macsec_extra_len(bool sci_present)
 /* Fill SecTAG according to IEEE 802.1AE-2006 10.5.3 */
 static void macsec_fill_sectag(struct macsec_eth_header *h,
-                               const struct macsec_secy *secy, u32 pn)
+                               const struct macsec_secy *secy, u32 pn,
+                               bool sci_present)
 {
        const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
-        memset(&h->tci_an, 0, macsec_sectag_len(tx_sc->send_sci));
+        memset(&h->tci_an, 0, macsec_sectag_len(sci_present));
        h->eth.h_proto = htons(ETH_P_MACSEC);
-        if (tx_sc->send_sci ||
+        if (sci_present) {
-            (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb)) {
                h->tci_an |= MACSEC_TCI_SC;
                memcpy(&h->secure_channel_id, &secy->sci,
                       sizeof(h->secure_channel_id));
@@ -650,6 +658,7 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
        struct macsec_tx_sc *tx_sc;
        struct macsec_tx_sa *tx_sa;
        struct macsec_dev *macsec = macsec_priv(dev);
+        bool sci_present;
        u32 pn;
        secy = &macsec->secy;
@@ -687,7 +696,8 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
        unprotected_len = skb->len;
        eth = eth_hdr(skb);
-        hh = (struct macsec_eth_header *)skb_push(skb, macsec_extra_len(tx_sc->send_sci));
+        sci_present = send_sci(secy);
+        hh = (struct macsec_eth_header *)skb_push(skb, macsec_extra_len(sci_present));
        memmove(hh, eth, 2 * ETH_ALEN);
        pn = tx_sa_update_pn(tx_sa, secy);
@@ -696,7 +706,7 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
                kfree_skb(skb);
                return ERR_PTR(-ENOLINK);
        }
-        macsec_fill_sectag(hh, secy, pn);
+        macsec_fill_sectag(hh, secy, pn, sci_present);
        macsec_set_shortlen(hh, unprotected_len - 2 * ETH_ALEN);
        skb_put(skb, secy->icv_len);
@@ -726,10 +736,10 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
        skb_to_sgvec(skb, sg, 0, skb->len);
        if (tx_sc->encrypt) {
-                int len = skb->len - macsec_hdr_len(tx_sc->send_sci) -
+                int len = skb->len - macsec_hdr_len(sci_present) -
                          secy->icv_len;
                aead_request_set_crypt(req, sg, sg, len, iv);
-                aead_request_set_ad(req, macsec_hdr_len(tx_sc->send_sci));
+                aead_request_set_ad(req, macsec_hdr_len(sci_present));
        } else {
                aead_request_set_crypt(req, sg, sg, 0, iv);
                aead_request_set_ad(req, skb->len - secy->icv_len);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 3234fcdea317..26d6f0bbe14b 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -623,7 +623,8 @@ hash_add:
        return 0;
 clear_multi:
-        dev_set_allmulti(lowerdev, -1);
+        if (dev->flags & IFF_ALLMULTI)
+                dev_set_allmulti(lowerdev, -1);
 del_unicast:
        dev_uc_del(lowerdev, dev->dev_addr);
 out:
@@ -1278,6 +1279,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
        struct net_device *lowerdev;
        int err;
        int macmode;
+        bool create = false;
        if (!tb[IFLA_LINK])
                return -EINVAL;
@@ -1304,12 +1306,18 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                err = macvlan_port_create(lowerdev);
                if (err < 0)
                        return err;
+                create = true;
        }
        port = macvlan_port_get_rtnl(lowerdev);
        /* Only 1 macvlan device can be created in passthru mode */
-        if (port->passthru)
+        if (port->passthru) {
-                return -EINVAL;
+                /* The macvlan port must be not created this time,
+                 * still goto destroy_macvlan_port for readability.
+                 */
+                err = -EINVAL;
+                goto destroy_macvlan_port;
+        }
        vlan->lowerdev = lowerdev;
        vlan->dev      = dev;
@@ -1325,24 +1333,28 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                vlan->flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
        if (vlan->mode == MACVLAN_MODE_PASSTHRU) {
-                if (port->count)
+                if (port->count) {
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto destroy_macvlan_port;
+                }
                port->passthru = true;
                eth_hw_addr_inherit(dev, lowerdev);
        }
        if (data && data[IFLA_MACVLAN_MACADDR_MODE]) {
-                if (vlan->mode != MACVLAN_MODE_SOURCE)
+                if (vlan->mode != MACVLAN_MODE_SOURCE) {
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto destroy_macvlan_port;
+                }
                macmode = nla_get_u32(data[IFLA_MACVLAN_MACADDR_MODE]);
                err = macvlan_changelink_sources(vlan, macmode, data);
                if (err)
-                        return err;
+                        goto destroy_macvlan_port;
        }
        err = register_netdevice(dev);
        if (err < 0)
-                return err;
+                goto destroy_macvlan_port;
        dev->priv_flags |= IFF_MACVLAN;
        err = netdev_upper_dev_link(lowerdev, dev);
@@ -1357,7 +1369,9 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
 unregister_netdev:
        unregister_netdevice(dev);
+destroy_macvlan_port:
+        if (create)
+                macvlan_port_destroy(port->dev);
        return err;
 }
 EXPORT_SYMBOL_GPL(macvlan_common_newlink);
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 070e3290aa6e..7869b0651576 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -491,7 +491,13 @@ static int macvtap_newlink(struct net *src_net,
        /* Don't put anything that may fail after macvlan_common_newlink
         * because we can't undo what it does.
         */
-        return macvlan_common_newlink(src_net, dev, tb, data);
+        err = macvlan_common_newlink(src_net, dev, tb, data);
+        if (err) {
+                netdev_rx_handler_unregister(dev);
+                return err;
+        }
+        return 0;
 }
 static void macvtap_dellink(struct net_device *dev,
@@ -736,13 +742,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
        if (zerocopy)
                err = zerocopy_sg_from_iter(skb, from);
-        else {
+        else
                err = skb_copy_datagram_from_iter(skb, 0, from, len);
-                if (!err && m && m->msg_control) {
-                        struct ubuf_info *uarg = m->msg_control;
-                        uarg->callback(uarg, false);
-                }
-        }
        if (err)
                goto err_kfree;
@@ -773,7 +774,11 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                skb_shinfo(skb)->destructor_arg = m->msg_control;
                skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
                skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
+        } else if (m && m->msg_control) {
+                struct ubuf_info *uarg = m->msg_control;
+                uarg->callback(uarg, false);
        }
        if (vlan) {
                skb->dev = vlan->dev;
                dev_queue_xmit(skb);
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index f279a897a5c7..a52b560e428b 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -42,19 +42,24 @@
 #define AT803X_MMD_ACCESS_CONTROL               0x0D
 #define AT803X_MMD_ACCESS_CONTROL_DATA          0x0E
 #define AT803X_FUNC_DATA                        0x4003
+#define AT803X_REG_CHIP_CONFIG                  0x1f
+#define AT803X_BT_BX_REG_SEL                    0x8000
 #define AT803X_DEBUG_ADDR                       0x1D
 #define AT803X_DEBUG_DATA                       0x1E
+#define AT803X_MODE_CFG_MASK                    0x0F
+#define AT803X_MODE_CFG_SGMII                   0x01
+#define AT803X_PSSR                     0x11    /*PHY-Specific Status Register*/
+#define AT803X_PSSR_MR_AN_COMPLETE      0x0200
 #define AT803X_DEBUG_REG_0                      0x00
 #define AT803X_DEBUG_RX_CLK_DLY_EN              BIT(15)
 #define AT803X_DEBUG_REG_5                      0x05
 #define AT803X_DEBUG_TX_CLK_DLY_EN              BIT(8)
-#define AT803X_REG_CHIP_CONFIG                  0x1f
-#define AT803X_BT_BX_REG_SEL                    0x8000
 #define ATH8030_PHY_ID 0x004dd076
 #define ATH8031_PHY_ID 0x004dd074
 #define ATH8035_PHY_ID 0x004dd072
@@ -209,7 +214,6 @@ static int at803x_suspend(struct phy_device *phydev)
 {
        int value;
        int wol_enabled;
-        int ccr;
        mutex_lock(&phydev->lock);
@@ -225,16 +229,6 @@ static int at803x_suspend(struct phy_device *phydev)
        phy_write(phydev, MII_BMCR, value);
-        if (phydev->interface != PHY_INTERFACE_MODE_SGMII)
-                goto done;
-        /* also power-down SGMII interface */
-        ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG);
-        phy_write(phydev, AT803X_REG_CHIP_CONFIG, ccr & ~AT803X_BT_BX_REG_SEL);
-        phy_write(phydev, MII_BMCR, phy_read(phydev, MII_BMCR) | BMCR_PDOWN);
-        phy_write(phydev, AT803X_REG_CHIP_CONFIG, ccr | AT803X_BT_BX_REG_SEL);
-done:
        mutex_unlock(&phydev->lock);
        return 0;
@@ -243,7 +237,6 @@ done:
 static int at803x_resume(struct phy_device *phydev)
 {
        int value;
-        int ccr;
        mutex_lock(&phydev->lock);
@@ -251,17 +244,6 @@ static int at803x_resume(struct phy_device *phydev)
        value &= ~(BMCR_PDOWN | BMCR_ISOLATE);
        phy_write(phydev, MII_BMCR, value);
-        if (phydev->interface != PHY_INTERFACE_MODE_SGMII)
-                goto done;
-        /* also power-up SGMII interface */
-        ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG);
-        phy_write(phydev, AT803X_REG_CHIP_CONFIG, ccr & ~AT803X_BT_BX_REG_SEL);
-        value = phy_read(phydev, MII_BMCR) & ~(BMCR_PDOWN | BMCR_ISOLATE);
-        phy_write(phydev, MII_BMCR, value);
-        phy_write(phydev, AT803X_REG_CHIP_CONFIG, ccr | AT803X_BT_BX_REG_SEL);
-done:
        mutex_unlock(&phydev->lock);
        return 0;
@@ -381,6 +363,36 @@ static void at803x_link_change_notify(struct phy_device *phydev)
        }
 }
+static int at803x_aneg_done(struct phy_device *phydev)
+{
+        int ccr;
+        int aneg_done = genphy_aneg_done(phydev);
+        if (aneg_done != BMSR_ANEGCOMPLETE)
+                return aneg_done;
+        /*
+         * in SGMII mode, if copper side autoneg is successful,
+         * also check SGMII side autoneg result
+         */
+        ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG);
+        if ((ccr & AT803X_MODE_CFG_MASK) != AT803X_MODE_CFG_SGMII)
+                return aneg_done;
+        /* switch to SGMII/fiber page */
+        phy_write(phydev, AT803X_REG_CHIP_CONFIG, ccr & ~AT803X_BT_BX_REG_SEL);
+        /* check if the SGMII link is OK. */
+        if (!(phy_read(phydev, AT803X_PSSR) & AT803X_PSSR_MR_AN_COMPLETE)) {
+                pr_warn("803x_aneg_done: SGMII link is not ok\n");
+                aneg_done = 0;
+        }
+        /* switch back to copper page */
+        phy_write(phydev, AT803X_REG_CHIP_CONFIG, ccr | AT803X_BT_BX_REG_SEL);
+        return aneg_done;
+}
 static struct phy_driver at803x_driver[] = {
 {
        /* ATHEROS 8035 */
@@ -432,6 +444,7 @@ static struct phy_driver at803x_driver[] = {
        .flags                  = PHY_HAS_INTERRUPT,
        .config_aneg            = genphy_config_aneg,
        .read_status            = genphy_read_status,
+        .aneg_done              = at803x_aneg_done,
        .ack_interrupt          = &at803x_ack_interrupt,
        .config_intr            = &at803x_config_intr,
 } };
diff --git a/drivers/net/phy/dp83848.c b/drivers/net/phy/dp83848.c
index 03d54c4adc88..800b39f06279 100644
--- a/drivers/net/phy/dp83848.c
+++ b/drivers/net/phy/dp83848.c
@@ -19,6 +19,7 @@
 #define TI_DP83848C_PHY_ID              0x20005ca0
 #define NS_DP83848C_PHY_ID              0x20005c90
 #define TLK10X_PHY_ID                   0x2000a210
+#define TI_DP83822_PHY_ID               0x2000a240
 /* Registers */
 #define DP83848_MICR                    0x11 /* MII Interrupt Control Register */
@@ -77,6 +78,7 @@ static struct mdio_device_id __maybe_unused dp83848_tbl[] = {
        { TI_DP83848C_PHY_ID, 0xfffffff0 },
        { NS_DP83848C_PHY_ID, 0xfffffff0 },
        { TLK10X_PHY_ID, 0xfffffff0 },
+        { TI_DP83822_PHY_ID, 0xfffffff0 },
        { }
 };
 MODULE_DEVICE_TABLE(mdio, dp83848_tbl);
@@ -105,6 +107,7 @@ static struct phy_driver dp83848_driver[] = {
        DP83848_PHY_DRIVER(TI_DP83848C_PHY_ID, "TI DP83848C 10/100 Mbps PHY"),
        DP83848_PHY_DRIVER(NS_DP83848C_PHY_ID, "NS DP83848C 10/100 Mbps PHY"),
        DP83848_PHY_DRIVER(TLK10X_PHY_ID, "TI TLK10X 10/100 Mbps PHY"),
+        DP83848_PHY_DRIVER(TI_DP83822_PHY_ID, "TI DP83822 10/100 Mbps PHY"),
 };
 module_phy_driver(dp83848_driver);
diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index c649c101bbab..eb5167210681 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -279,7 +279,7 @@ EXPORT_SYMBOL_GPL(fixed_phy_register);
 void fixed_phy_unregister(struct phy_device *phy)
 {
        phy_device_remove(phy);
+        of_node_put(phy->mdio.dev.of_node);
        fixed_phy_del(phy->mdio.addr);
 }
 EXPORT_SYMBOL_GPL(fixed_phy_unregister);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 081df68d2ce1..ea92d524d5a8 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -318,12 +318,12 @@ static int ksz8041_config_init(struct phy_device *phydev)
        /* Limit supported and advertised modes in fiber mode */
        if (of_property_read_bool(of_node, "micrel,fiber-mode")) {
                phydev->dev_flags |= MICREL_PHY_FXEN;
-                phydev->supported &= SUPPORTED_FIBRE |
+                phydev->supported &= SUPPORTED_100baseT_Full |
-                                     SUPPORTED_100baseT_Full |
                                     SUPPORTED_100baseT_Half;
-                phydev->advertising &= ADVERTISED_FIBRE |
+                phydev->supported |= SUPPORTED_FIBRE;
-                                       ADVERTISED_100baseT_Full |
+                phydev->advertising &= ADVERTISED_100baseT_Full |
                                       ADVERTISED_100baseT_Half;
+                phydev->advertising |= ADVERTISED_FIBRE;
                phydev->autoneg = AUTONEG_DISABLE;
        }
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index e977ba931878..c4ceb082e970 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -723,6 +723,7 @@ struct phy_device *phy_connect(struct net_device *dev, const char *bus_id,
        phydev = to_phy_device(d);
        rc = phy_connect_direct(dev, phydev, handler, interface);
+        put_device(d);
        if (rc)
                return ERR_PTR(rc);
@@ -856,11 +857,17 @@ EXPORT_SYMBOL(phy_attached_print);
 int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                      u32 flags, phy_interface_t interface)
 {
+        struct module *ndev_owner = dev->dev.parent->driver->owner;
        struct mii_bus *bus = phydev->mdio.bus;
        struct device *d = &phydev->mdio.dev;
        int err;
-        if (!try_module_get(bus->owner)) {
+        /* For Ethernet device drivers that register their own MDIO bus, we
+         * will have bus->owner match ndev_mod, so we do not want to increment
+         * our own module->refcnt here, otherwise we would not be able to
+         * unload later on.
+         */
+        if (ndev_owner != bus->owner && !try_module_get(bus->owner)) {
                dev_err(&dev->dev, "failed to get the bus module\n");
                return -EIO;
        }
@@ -920,7 +927,8 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
 error:
        put_device(d);
-        module_put(bus->owner);
+        if (ndev_owner != bus->owner)
+                module_put(bus->owner);
        return err;
 }
 EXPORT_SYMBOL(phy_attach_direct);
@@ -953,6 +961,7 @@ struct phy_device *phy_attach(struct net_device *dev, const char *bus_id,
        phydev = to_phy_device(d);
        rc = phy_attach_direct(dev, phydev, phydev->dev_flags, interface);
+        put_device(d);
        if (rc)
                return ERR_PTR(rc);
@@ -969,6 +978,8 @@ EXPORT_SYMBOL(phy_attach);
 */
 void phy_detach(struct phy_device *phydev)
 {
+        struct net_device *dev = phydev->attached_dev;
+        struct module *ndev_owner = dev->dev.parent->driver->owner;
        struct mii_bus *bus;
        int i;
@@ -996,7 +1007,8 @@ void phy_detach(struct phy_device *phydev)
        bus = phydev->mdio.bus;
        put_device(&phydev->mdio.dev);
-        module_put(bus->owner);
+        if (ndev_owner != bus->owner)
+                module_put(bus->owner);
 }
 EXPORT_SYMBOL(phy_detach);
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index aadd6e9f54ad..9cbe645e3d89 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -102,15 +102,19 @@ static int rtl8211f_config_init(struct phy_device *phydev)
        if (ret < 0)
                return ret;
-        if (phydev->interface == PHY_INTERFACE_MODE_RGMII) {
+        phy_write(phydev, RTL8211F_PAGE_SELECT, 0xd08);
-                /* enable TXDLY */
+        reg = phy_read(phydev, 0x11);
-                phy_write(phydev, RTL8211F_PAGE_SELECT, 0xd08);
-                reg = phy_read(phydev, 0x11);
+        /* enable TX-delay for rgmii-id and rgmii-txid, otherwise disable it */
+        if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
+            phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
                reg |= RTL8211F_TX_DELAY;
-                phy_write(phydev, 0x11, reg);
+        else
-                /* restore to default page 0 */
+                reg &= ~RTL8211F_TX_DELAY;
-                phy_write(phydev, RTL8211F_PAGE_SELECT, 0x0);
-        }
+        phy_write(phydev, 0x11, reg);
+        /* restore to default page 0 */
+        phy_write(phydev, RTL8211F_PAGE_SELECT, 0x0);
        return 0;
 }
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index 2e37eb337d48..24b4a09468dd 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -62,6 +62,10 @@
 /* Vitesse Extended Page Access Register */
 #define MII_VSC82X4_EXT_PAGE_ACCESS     0x1f
+/* Vitesse VSC8601 Extended PHY Control Register 1 */
+#define MII_VSC8601_EPHY_CTL            0x17
+#define MII_VSC8601_EPHY_CTL_RGMII_SKEW (1 << 8)
 #define PHY_ID_VSC8234                  0x000fc620
 #define PHY_ID_VSC8244                  0x000fc6c0
 #define PHY_ID_VSC8514                  0x00070670
@@ -111,6 +115,34 @@ static int vsc824x_config_init(struct phy_device *phydev)
        return err;
 }
+/* This adds a skew for both TX and RX clocks, so the skew should only be
+ * applied to "rgmii-id" interfaces. It may not work as expected
+ * on "rgmii-txid", "rgmii-rxid" or "rgmii" interfaces. */
+static int vsc8601_add_skew(struct phy_device *phydev)
+{
+        int ret;
+        ret = phy_read(phydev, MII_VSC8601_EPHY_CTL);
+        if (ret < 0)
+                return ret;
+        ret |= MII_VSC8601_EPHY_CTL_RGMII_SKEW;
+        return phy_write(phydev, MII_VSC8601_EPHY_CTL, ret);
+}
+static int vsc8601_config_init(struct phy_device *phydev)
+{
+        int ret = 0;
+        if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
+                ret = vsc8601_add_skew(phydev);
+        if (ret < 0)
+                return ret;
+        return genphy_config_init(phydev);
+}
 static int vsc824x_ack_interrupt(struct phy_device *phydev)
 {
        int err = 0;
@@ -275,7 +307,7 @@ static struct phy_driver vsc82xx_driver[] = {
        .phy_id_mask    = 0x000ffff0,
        .features       = PHY_GBIT_FEATURES,
        .flags          = PHY_HAS_INTERRUPT,
-        .config_init    = &genphy_config_init,
+        .config_init    = &vsc8601_config_init,
        .config_aneg    = &genphy_config_aneg,
        .read_status    = &genphy_read_status,
        .ack_interrupt  = &vsc824x_ack_interrupt,
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 8093e39ae263..db6acecabeaa 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1246,13 +1246,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
        if (zerocopy)
                err = zerocopy_sg_from_iter(skb, from);
-        else {
+        else
                err = skb_copy_datagram_from_iter(skb, 0, from, len);
-                if (!err && msg_control) {
-                        struct ubuf_info *uarg = msg_control;
-                        uarg->callback(uarg, false);
-                }
-        }
        if (err) {
                this_cpu_inc(tun->pcpu_stats->rx_dropped);
@@ -1298,6 +1293,9 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                skb_shinfo(skb)->destructor_arg = msg_control;
                skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
                skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
+        } else if (msg_control) {
+                struct ubuf_info *uarg = msg_control;
+                uarg->callback(uarg, false);
        }
        skb_reset_network_header(skb);
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index f79eb12c326a..125cff57c759 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -433,13 +433,13 @@ int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
        mutex_lock(&dev->phy_mutex);
        do {
                ret = asix_set_sw_mii(dev, 0);
-                if (ret == -ENODEV)
+                if (ret == -ENODEV || ret == -ETIMEDOUT)
                        break;
                usleep_range(1000, 1100);
                ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG,
                                    0, 0, 1, &smsr, 0);
        } while (!(smsr & AX_HOST_EN) && (i++ < 30) && (ret != -ENODEV));
-        if (ret == -ENODEV) {
+        if (ret == -ENODEV || ret == -ETIMEDOUT) {
                mutex_unlock(&dev->phy_mutex);
                return ret;
        }
@@ -497,13 +497,13 @@ int asix_mdio_read_nopm(struct net_device *netdev, int phy_id, int loc)
        mutex_lock(&dev->phy_mutex);
        do {
                ret = asix_set_sw_mii(dev, 1);
-                if (ret == -ENODEV)
+                if (ret == -ENODEV || ret == -ETIMEDOUT)
                        break;
                usleep_range(1000, 1100);
                ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG,
                                    0, 0, 1, &smsr, 1);
        } while (!(smsr & AX_HOST_EN) && (i++ < 30) && (ret != -ENODEV));
-        if (ret == -ENODEV) {
+        if (ret == -ENODEV || ret == -ETIMEDOUT) {
                mutex_unlock(&dev->phy_mutex);
                return ret;
        }
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index cce24950a0ab..dc7b6392e75a 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -603,12 +603,12 @@ static void ax88772_suspend(struct usbnet *dev)
        u16 medium;
        /* Stop MAC operation */
-        medium = asix_read_medium_status(dev, 0);
+        medium = asix_read_medium_status(dev, 1);
        medium &= ~AX_MEDIUM_RE;
-        asix_write_medium_mode(dev, medium, 0);
+        asix_write_medium_mode(dev, medium, 1);
        netdev_dbg(dev->net, "ax88772_suspend: medium=0x%04x\n",
-                   asix_read_medium_status(dev, 0));
+                   asix_read_medium_status(dev, 1));
        /* Preserve BMCR for restoring */
        priv->presvd_phy_bmcr =
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index e6338c16081a..8a6675d92b98 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1656,6 +1656,19 @@ static const struct driver_info ax88178a_info = {
        .tx_fixup = ax88179_tx_fixup,
 };
+static const struct driver_info cypress_GX3_info = {
+        .description = "Cypress GX3 SuperSpeed to Gigabit Ethernet Controller",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
 static const struct driver_info dlink_dub1312_info = {
        .description = "D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter",
        .bind = ax88179_bind,
@@ -1718,6 +1731,10 @@ static const struct usb_device_id products[] = {
        USB_DEVICE(0x0b95, 0x178a),
        .driver_info = (unsigned long)&ax88178a_info,
 }, {
+        /* Cypress GX3 SuperSpeed to Gigabit Ethernet Bridge Controller */
+        USB_DEVICE(0x04b4, 0x3610),
+        .driver_info = (unsigned long)&cypress_GX3_info,
+}, {
        /* D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter */
        USB_DEVICE(0x2001, 0x4a00),
        .driver_info = (unsigned long)&dlink_dub1312_info,
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index c47ec0a04c8e..dd623f674487 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -388,12 +388,6 @@ void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
        case USB_CDC_NOTIFY_NETWORK_CONNECTION:
                netif_dbg(dev, timer, dev->net, "CDC: carrier %s\n",
                          event->wValue ? "on" : "off");
-                /* Work-around for devices with broken off-notifications */
-                if (event->wValue &&
-                    !test_bit(__LINK_STATE_NOCARRIER, &dev->net->state))
-                        usbnet_link_change(dev, 0, 0);
                usbnet_link_change(dev, !!event->wValue, 0);
                break;
        case USB_CDC_NOTIFY_SPEED_CHANGE:       /* tx/rx rates */
@@ -466,6 +460,36 @@ static int usbnet_cdc_zte_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
        return 1;
 }
+/* Ensure correct link state
+ *
+ * Some devices (ZTE MF823/831/910) export two carrier on notifications when
+ * connected. This causes the link state to be incorrect. Work around this by
+ * always setting the state to off, then on.
+ */
+void usbnet_cdc_zte_status(struct usbnet *dev, struct urb *urb)
+{
+        struct usb_cdc_notification *event;
+        if (urb->actual_length < sizeof(*event))
+                return;
+        event = urb->transfer_buffer;
+        if (event->bNotificationType != USB_CDC_NOTIFY_NETWORK_CONNECTION) {
+                usbnet_cdc_status(dev, urb);
+                return;
+        }
+        netif_dbg(dev, timer, dev->net, "CDC: carrier %s\n",
+                  event->wValue ? "on" : "off");
+        if (event->wValue &&
+            netif_carrier_ok(dev->net))
+                netif_carrier_off(dev->net);
+        usbnet_link_change(dev, !!event->wValue, 0);
+}
 static const struct driver_info cdc_info = {
        .description =  "CDC Ethernet Device",
        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
@@ -481,7 +505,7 @@ static const struct driver_info	zte_cdc_info = {
        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
        .bind =         usbnet_cdc_zte_bind,
        .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
+        .status =       usbnet_cdc_zte_status,
        .set_rx_mode =  usbnet_cdc_update_filter,
        .manage_power = usbnet_manage_power,
        .rx_fixup = usbnet_cdc_zte_rx_fixup,
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 96a5028621c8..3a98f3762a4c 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -602,6 +602,21 @@ static const struct driver_info cdc_mbim_info_ndp_to_end = {
        .data = CDC_NCM_FLAG_NDP_TO_END,
 };
+/* Some modems (e.g. Telit LE922A6) do not work properly with altsetting
+ * toggle done in cdc_ncm_bind_common. CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE
+ * flag is used to avoid this procedure.
+ */
+static const struct driver_info cdc_mbim_info_avoid_altsetting_toggle = {
+        .description = "CDC MBIM",
+        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
+        .bind = cdc_mbim_bind,
+        .unbind = cdc_mbim_unbind,
+        .manage_power = cdc_mbim_manage_power,
+        .rx_fixup = cdc_mbim_rx_fixup,
+        .tx_fixup = cdc_mbim_tx_fixup,
+        .data = CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE,
+};
 static const struct usb_device_id mbim_devs[] = {
        /* This duplicate NCM entry is intentional. MBIM devices can
         * be disguised as NCM by default, and this is necessary to
@@ -626,6 +641,12 @@ static const struct usb_device_id mbim_devs[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
          .driver_info = (unsigned long)&cdc_mbim_info_ndp_to_end,
        },
+        /* Telit LE922A6 in MBIM composition */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1041, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
+        },
        /* default entry */
        { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
          .driver_info = (unsigned long)&cdc_mbim_info_zlp,
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 877c9516e781..afbfc0f656f3 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -839,11 +839,18 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
        iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber;
+        /* Device-specific flags */
+        ctx->drvflags = drvflags;
        /* Reset data interface. Some devices will not reset properly
         * unless they are configured first.  Toggle the altsetting to
-         * force a reset
+         * force a reset.
+         * Some other devices do not work properly with this procedure
+         * that can be avoided using quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE
         */
-        usb_set_interface(dev->udev, iface_no, data_altsetting);
+        if (!(ctx->drvflags & CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE))
+                usb_set_interface(dev->udev, iface_no, data_altsetting);
        temp = usb_set_interface(dev->udev, iface_no, 0);
        if (temp) {
                dev_dbg(&intf->dev, "set interface failed\n");
@@ -890,9 +897,6 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
        /* finish setting up the device specific data */
        cdc_ncm_setup(dev);
-        /* Device-specific flags */
-        ctx->drvflags = drvflags;
        /* Allocate the delayed NDP if needed. */
        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
                ctx->delayed_ndp16 = kzalloc(ctx->max_ndp_size, GFP_KERNEL);
diff --git a/drivers/net/usb/kalmia.c b/drivers/net/usb/kalmia.c
index 5662babf0583..3e37724d30ae 100644
--- a/drivers/net/usb/kalmia.c
+++ b/drivers/net/usb/kalmia.c
@@ -151,7 +151,7 @@ kalmia_bind(struct usbnet *dev, struct usb_interface *intf)
        status = kalmia_init_and_get_ethernet_addr(dev, ethernet_addr);
-        if (status < 0) {
+        if (status) {
                usb_set_intfdata(intf, NULL);
                usb_driver_release_interface(driver_of(intf), intf);
                return status;
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index db558b8b32fe..f33460cec79f 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3395,6 +3395,7 @@ static int lan78xx_probe(struct usb_interface *intf,
        if (buf) {
                dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL);
                if (!dev->urb_intr) {
+                        ret = -ENOMEM;
                        kfree(buf);
                        goto out3;
                } else {
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 3ff76c6db4f6..6fe1cdb0174f 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -894,6 +894,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
        {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
+        {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
        {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
        {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G Systems */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 44d439f50961..efb84f092492 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1730,7 +1730,7 @@ static u8 r8152_rx_csum(struct r8152 *tp, struct rx_desc *rx_desc)
        u8 checksum = CHECKSUM_NONE;
        u32 opts2, opts3;
-        if (tp->version == RTL_VER_01)
+        if (tp->version == RTL_VER_01 || tp->version == RTL_VER_02)
                goto return_result;
        opts2 = le32_to_cpu(rx_desc->opts2);
@@ -1745,7 +1745,7 @@ static u8 r8152_rx_csum(struct r8152 *tp, struct rx_desc *rx_desc)
                        checksum = CHECKSUM_NONE;
                else
                        checksum = CHECKSUM_UNNECESSARY;
-        } else if (RD_IPV6_CS) {
+        } else if (opts2 & RD_IPV6_CS) {
                if ((opts2 & RD_UDP_CS) && !(opts3 & UDPF))
                        checksum = CHECKSUM_UNNECESSARY;
                else if ((opts2 & RD_TCP_CS) && !(opts3 & TCPF))
@@ -3266,10 +3266,8 @@ static int rtl8152_open(struct net_device *netdev)
                goto out;
        res = usb_autopm_get_interface(tp->intf);
-        if (res < 0) {
+        if (res < 0)
-                free_all_mem(tp);
+                goto out_free;
-                goto out;
-        }
        mutex_lock(&tp->control);
@@ -3285,10 +3283,9 @@ static int rtl8152_open(struct net_device *netdev)
                        netif_device_detach(tp->netdev);
                netif_warn(tp, ifup, netdev, "intr_urb submit failed: %d\n",
                           res);
-                free_all_mem(tp);
+                goto out_unlock;
-        } else {
-                napi_enable(&tp->napi);
        }
+        napi_enable(&tp->napi);
        mutex_unlock(&tp->control);
@@ -3297,7 +3294,13 @@ static int rtl8152_open(struct net_device *netdev)
        tp->pm_notifier.notifier_call = rtl_notifier;
        register_pm_notifier(&tp->pm_notifier);
 #endif
+        return 0;
+out_unlock:
+        mutex_unlock(&tp->control);
+        usb_autopm_put_interface(tp->intf);
+out_free:
+        free_all_mem(tp);
 out:
        return res;
 }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index fad84f3f4109..cbf1c613c67a 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -969,12 +969,17 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
        struct virtnet_info *vi = netdev_priv(dev);
        struct virtio_device *vdev = vi->vdev;
        int ret;
-        struct sockaddr *addr = p;
+        struct sockaddr *addr;
        struct scatterlist sg;
-        ret = eth_prepare_mac_addr_change(dev, p);
+        addr = kmalloc(sizeof(*addr), GFP_KERNEL);
+        if (!addr)
+                return -ENOMEM;
+        memcpy(addr, p, sizeof(*addr));
+        ret = eth_prepare_mac_addr_change(dev, addr);
        if (ret)
-                return ret;
+                goto out;
        if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
                sg_init_one(&sg, addr->sa_data, dev->addr_len);
@@ -982,7 +987,8 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
                                          VIRTIO_NET_CTRL_MAC_ADDR_SET, &sg)) {
                        dev_warn(&vdev->dev,
                                 "Failed to set mac address by vq command.\n");
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out;
                }
        } else if (virtio_has_feature(vdev, VIRTIO_NET_F_MAC) &&
                   !virtio_has_feature(vdev, VIRTIO_F_VERSION_1)) {
@@ -996,8 +1002,11 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
        }
        eth_commit_mac_addr_change(dev, p);
+        ret = 0;
-        return 0;
+out:
+        kfree(addr);
+        return ret;
 }
 static struct rtnl_link_stats64 *virtnet_stats(struct net_device *dev,
@@ -1497,6 +1506,11 @@ static void virtnet_free_queues(struct virtnet_info *vi)
                netif_napi_del(&vi->rq[i].napi);
        }
+        /* We called napi_hash_del() before netif_napi_del(),
+         * we need to respect an RCU grace period before freeing vi->rq
+         */
+        synchronize_net();
        kfree(vi->rq);
        kfree(vi->sq);
 }
@@ -2038,23 +2052,33 @@ static struct virtio_device_id id_table[] = {
        { 0 },
 };
+#define VIRTNET_FEATURES \
+        VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM, \
+        VIRTIO_NET_F_MAC, \
+        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6, \
+        VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6, \
+        VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO, \
+        VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ, \
+        VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN, \
+        VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ, \
+        VIRTIO_NET_F_CTRL_MAC_ADDR, \
+        VIRTIO_NET_F_MTU
 static unsigned int features[] = {
-        VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM,
+        VIRTNET_FEATURES,
-        VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
+};
-        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
-        VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
+static unsigned int features_legacy[] = {
-        VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO,
+        VIRTNET_FEATURES,
-        VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ,
+        VIRTIO_NET_F_GSO,
-        VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN,
-        VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ,
-        VIRTIO_NET_F_CTRL_MAC_ADDR,
        VIRTIO_F_ANY_LAYOUT,
-        VIRTIO_NET_F_MTU,
 };
 static struct virtio_driver virtio_net_driver = {
        .feature_table = features,
        .feature_table_size = ARRAY_SIZE(features),
+        .feature_table_legacy = features_legacy,
+        .feature_table_size_legacy = ARRAY_SIZE(features_legacy),
        .driver.name =  KBUILD_MODNAME,
        .driver.owner = THIS_MODULE,
        .id_table =     id_table,
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index b5554f2ebee4..ef83ae3b0a44 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2279,6 +2279,7 @@ vmxnet3_set_mc(struct net_device *netdev)
                                        &adapter->shared->devRead.rxFilterConf;
        u8 *new_table = NULL;
        dma_addr_t new_table_pa = 0;
+        bool new_table_pa_valid = false;
        u32 new_mode = VMXNET3_RXM_UCAST;
        if (netdev->flags & IFF_PROMISC) {
@@ -2307,13 +2308,15 @@ vmxnet3_set_mc(struct net_device *netdev)
                                                        new_table,
                                                        sz,
                                                        PCI_DMA_TODEVICE);
+                                if (!dma_mapping_error(&adapter->pdev->dev,
+                                                       new_table_pa)) {
+                                        new_mode |= VMXNET3_RXM_MCAST;
+                                        new_table_pa_valid = true;
+                                        rxConf->mfTablePA = cpu_to_le64(
+                                                                new_table_pa);
+                                }
                        }
+                        if (!new_table_pa_valid) {
-                        if (!dma_mapping_error(&adapter->pdev->dev,
-                                               new_table_pa)) {
-                                new_mode |= VMXNET3_RXM_MCAST;
-                                rxConf->mfTablePA = cpu_to_le64(new_table_pa);
-                        } else {
                                netdev_info(netdev,
                                            "failed to copy mcast list, setting ALL_MULTI\n");
                                new_mode |= VMXNET3_RXM_ALL_MULTI;
@@ -2338,7 +2341,7 @@ vmxnet3_set_mc(struct net_device *netdev)
                               VMXNET3_CMD_UPDATE_MAC_FILTERS);
        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
-        if (new_table_pa)
+        if (new_table_pa_valid)
                dma_unmap_single(&adapter->pdev->dev, new_table_pa,
                                 rxConf->mfTableLen, PCI_DMA_TODEVICE);
        kfree(new_table);
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 85c271c70d42..820de6a9ddde 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -956,6 +956,7 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
        if (skb->pkt_type == PACKET_LOOPBACK) {
                skb->dev = vrf_dev;
                skb->skb_iif = vrf_dev->ifindex;
+                IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
                skb->pkt_type = PACKET_HOST;
                goto out;
        }
@@ -996,6 +997,7 @@ static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev,
 {
        skb->dev = vrf_dev;
        skb->skb_iif = vrf_dev->ifindex;
+        IPCB(skb)->flags |= IPSKB_L3SLAVE;
        /* loopback traffic; do not push through packet taps again.
         * Reset pkt_type for upper layers to process skb
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index e7d16687538b..2ba01ca02c9c 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -583,7 +583,7 @@ static struct sk_buff **vxlan_gro_receive(struct sock *sk,
                }
        }
-        pp = eth_gro_receive(head, skb);
+        pp = call_gro_receive(eth_gro_receive, head, skb);
        flush = 0;
 out:
@@ -611,6 +611,7 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
        struct vxlan_rdst *rd = NULL;
        struct vxlan_fdb *f;
        int notify = 0;
+        int rc;
        f = __vxlan_find_mac(vxlan, mac);
        if (f) {
@@ -641,8 +642,7 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                if ((flags & NLM_F_APPEND) &&
                    (is_multicast_ether_addr(f->eth_addr) ||
                     is_zero_ether_addr(f->eth_addr))) {
-                        int rc = vxlan_fdb_append(f, ip, port, vni, ifindex,
+                        rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
-                                                  &rd);
                        if (rc < 0)
                                return rc;
@@ -673,7 +673,11 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                INIT_LIST_HEAD(&f->remotes);
                memcpy(f->eth_addr, mac, ETH_ALEN);
-                vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
+                rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
+                if (rc < 0) {
+                        kfree(f);
+                        return rc;
+                }
                ++vxlan->addrcnt;
                hlist_add_head_rcu(&f->hlist,
@@ -943,17 +947,22 @@ static bool vxlan_snoop(struct net_device *dev,
 static bool vxlan_group_used(struct vxlan_net *vn, struct vxlan_dev *dev)
 {
        struct vxlan_dev *vxlan;
+        struct vxlan_sock *sock4;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct vxlan_sock *sock6;
+#endif
        unsigned short family = dev->default_dst.remote_ip.sa.sa_family;
+        sock4 = rtnl_dereference(dev->vn4_sock);
        /* The vxlan_sock is only used by dev, leaving group has
         * no effect on other vxlan devices.
         */
-        if (family == AF_INET && dev->vn4_sock &&
+        if (family == AF_INET && sock4 && atomic_read(&sock4->refcnt) == 1)
-            atomic_read(&dev->vn4_sock->refcnt) == 1)
                return false;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (family == AF_INET6 && dev->vn6_sock &&
+        sock6 = rtnl_dereference(dev->vn6_sock);
-            atomic_read(&dev->vn6_sock->refcnt) == 1)
+        if (family == AF_INET6 && sock6 && atomic_read(&sock6->refcnt) == 1)
                return false;
 #endif
@@ -961,10 +970,12 @@ static bool vxlan_group_used(struct vxlan_net *vn, struct vxlan_dev *dev)
                if (!netif_running(vxlan->dev) || vxlan == dev)
                        continue;
-                if (family == AF_INET && vxlan->vn4_sock != dev->vn4_sock)
+                if (family == AF_INET &&
+                    rtnl_dereference(vxlan->vn4_sock) != sock4)
                        continue;
 #if IS_ENABLED(CONFIG_IPV6)
-                if (family == AF_INET6 && vxlan->vn6_sock != dev->vn6_sock)
+                if (family == AF_INET6 &&
+                    rtnl_dereference(vxlan->vn6_sock) != sock6)
                        continue;
 #endif
@@ -1005,22 +1016,25 @@ static bool __vxlan_sock_release_prep(struct vxlan_sock *vs)
 static void vxlan_sock_release(struct vxlan_dev *vxlan)
 {
-        bool ipv4 = __vxlan_sock_release_prep(vxlan->vn4_sock);
+        struct vxlan_sock *sock4 = rtnl_dereference(vxlan->vn4_sock);
 #if IS_ENABLED(CONFIG_IPV6)
-        bool ipv6 = __vxlan_sock_release_prep(vxlan->vn6_sock);
+        struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
+        rcu_assign_pointer(vxlan->vn6_sock, NULL);
 #endif
+        rcu_assign_pointer(vxlan->vn4_sock, NULL);
        synchronize_net();
-        if (ipv4) {
+        if (__vxlan_sock_release_prep(sock4)) {
-                udp_tunnel_sock_release(vxlan->vn4_sock->sock);
+                udp_tunnel_sock_release(sock4->sock);
-                kfree(vxlan->vn4_sock);
+                kfree(sock4);
        }
 #if IS_ENABLED(CONFIG_IPV6)
-        if (ipv6) {
+        if (__vxlan_sock_release_prep(sock6)) {
-                udp_tunnel_sock_release(vxlan->vn6_sock->sock);
+                udp_tunnel_sock_release(sock6->sock);
-                kfree(vxlan->vn6_sock);
+                kfree(sock6);
        }
 #endif
 }
@@ -1036,18 +1050,21 @@ static int vxlan_igmp_join(struct vxlan_dev *vxlan)
        int ret = -EINVAL;
        if (ip->sa.sa_family == AF_INET) {
+                struct vxlan_sock *sock4 = rtnl_dereference(vxlan->vn4_sock);
                struct ip_mreqn mreq = {
                        .imr_multiaddr.s_addr   = ip->sin.sin_addr.s_addr,
                        .imr_ifindex            = ifindex,
                };
-                sk = vxlan->vn4_sock->sock->sk;
+                sk = sock4->sock->sk;
                lock_sock(sk);
                ret = ip_mc_join_group(sk, &mreq);
                release_sock(sk);
 #if IS_ENABLED(CONFIG_IPV6)
        } else {
-                sk = vxlan->vn6_sock->sock->sk;
+                struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
+                sk = sock6->sock->sk;
                lock_sock(sk);
                ret = ipv6_stub->ipv6_sock_mc_join(sk, ifindex,
                                                   &ip->sin6.sin6_addr);
@@ -1067,18 +1084,21 @@ static int vxlan_igmp_leave(struct vxlan_dev *vxlan)
        int ret = -EINVAL;
        if (ip->sa.sa_family == AF_INET) {
+                struct vxlan_sock *sock4 = rtnl_dereference(vxlan->vn4_sock);
                struct ip_mreqn mreq = {
                        .imr_multiaddr.s_addr   = ip->sin.sin_addr.s_addr,
                        .imr_ifindex            = ifindex,
                };
-                sk = vxlan->vn4_sock->sock->sk;
+                sk = sock4->sock->sk;
                lock_sock(sk);
                ret = ip_mc_leave_group(sk, &mreq);
                release_sock(sk);
 #if IS_ENABLED(CONFIG_IPV6)
        } else {
-                sk = vxlan->vn6_sock->sock->sk;
+                struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
+                sk = sock6->sock->sk;
                lock_sock(sk);
                ret = ipv6_stub->ipv6_sock_mc_drop(sk, ifindex,
                                                   &ip->sin6.sin6_addr);
@@ -1828,11 +1848,15 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
                                          struct dst_cache *dst_cache,
                                          const struct ip_tunnel_info *info)
 {
+        struct vxlan_sock *sock6 = rcu_dereference(vxlan->vn6_sock);
        bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
        struct dst_entry *ndst;
        struct flowi6 fl6;
        int err;
+        if (!sock6)
+                return ERR_PTR(-EIO);
        if (tos && !info)
                use_cache = false;
        if (use_cache) {
@@ -1850,7 +1874,7 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
        fl6.flowi6_proto = IPPROTO_UDP;
        err = ipv6_stub->ipv6_dst_lookup(vxlan->net,
-                                         vxlan->vn6_sock->sock->sk,
+                                         sock6->sock->sk,
                                         &ndst, &fl6);
        if (err < 0)
                return ERR_PTR(err);
@@ -1995,9 +2019,11 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
        }
        if (dst->sa.sa_family == AF_INET) {
-                if (!vxlan->vn4_sock)
+                struct vxlan_sock *sock4 = rcu_dereference(vxlan->vn4_sock);
+                if (!sock4)
                        goto drop;
-                sk = vxlan->vn4_sock->sock->sk;
+                sk = sock4->sock->sk;
                rt = vxlan_get_route(vxlan, skb,
                                     rdst ? rdst->remote_ifindex : 0, tos,
@@ -2050,12 +2076,13 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                                    src_port, dst_port, xnet, !udp_sum);
 #if IS_ENABLED(CONFIG_IPV6)
        } else {
+                struct vxlan_sock *sock6 = rcu_dereference(vxlan->vn6_sock);
                struct dst_entry *ndst;
                u32 rt6i_flags;
-                if (!vxlan->vn6_sock)
+                if (!sock6)
                        goto drop;
-                sk = vxlan->vn6_sock->sock->sk;
+                sk = sock6->sock->sk;
                ndst = vxlan6_get_route(vxlan, skb,
                                        rdst ? rdst->remote_ifindex : 0, tos,
@@ -2415,9 +2442,10 @@ static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
        dport = info->key.tp_dst ? : vxlan->cfg.dst_port;
        if (ip_tunnel_info_af(info) == AF_INET) {
+                struct vxlan_sock *sock4 = rcu_dereference(vxlan->vn4_sock);
                struct rtable *rt;
-                if (!vxlan->vn4_sock)
+                if (!sock4)
                        return -EINVAL;
                rt = vxlan_get_route(vxlan, skb, 0, info->key.tos,
                                     info->key.u.ipv4.dst,
@@ -2429,8 +2457,6 @@ static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 #if IS_ENABLED(CONFIG_IPV6)
                struct dst_entry *ndst;
-                if (!vxlan->vn6_sock)
-                        return -EINVAL;
                ndst = vxlan6_get_route(vxlan, skb, 0, info->key.tos,
                                        info->key.label, &info->key.u.ipv6.dst,
                                        &info->key.u.ipv6.src, NULL, info);
@@ -2740,10 +2766,10 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6)
                return PTR_ERR(vs);
 #if IS_ENABLED(CONFIG_IPV6)
        if (ipv6)
-                vxlan->vn6_sock = vs;
+                rcu_assign_pointer(vxlan->vn6_sock, vs);
        else
 #endif
-                vxlan->vn4_sock = vs;
+                rcu_assign_pointer(vxlan->vn4_sock, vs);
        vxlan_vs_add_dev(vs, vxlan);
        return 0;
 }
@@ -2754,9 +2780,9 @@ static int vxlan_sock_add(struct vxlan_dev *vxlan)
        bool metadata = vxlan->flags & VXLAN_F_COLLECT_METADATA;
        int ret = 0;
-        vxlan->vn4_sock = NULL;
+        RCU_INIT_POINTER(vxlan->vn4_sock, NULL);
 #if IS_ENABLED(CONFIG_IPV6)
-        vxlan->vn6_sock = NULL;
+        RCU_INIT_POINTER(vxlan->vn6_sock, NULL);
        if (ipv6 || metadata)
                ret = __vxlan_sock_add(vxlan, true);
 #endif
diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
index 33ab3345d333..4e9fe75d7067 100644
--- a/drivers/net/wan/Kconfig
+++ b/drivers/net/wan/Kconfig
@@ -294,7 +294,7 @@ config FSL_UCC_HDLC
 config SLIC_DS26522
        tristate "Slic Maxim ds26522 card support"
        depends on SPI
-        depends on FSL_SOC || ARCH_MXC || ARCH_LAYERSCAPE
+        depends on FSL_SOC || ARCH_MXC || ARCH_LAYERSCAPE || COMPILE_TEST
        help
          This module initializes and configures the slic maxim card
          in T1 or E1 mode.
diff --git a/drivers/net/wan/slic_ds26522.c b/drivers/net/wan/slic_ds26522.c
index d06a887a2352..b776a0ab106c 100644
--- a/drivers/net/wan/slic_ds26522.c
+++ b/drivers/net/wan/slic_ds26522.c
@@ -223,12 +223,19 @@ static int slic_ds26522_probe(struct spi_device *spi)
        return ret;
 }
+static const struct spi_device_id slic_ds26522_id[] = {
+        { .name = "ds26522" },
+        { /* sentinel */ },
+};
+MODULE_DEVICE_TABLE(spi, slic_ds26522_id);
 static const struct of_device_id slic_ds26522_match[] = {
        {
         .compatible = "maxim,ds26522",
         },
        {},
 };
+MODULE_DEVICE_TABLE(of, slic_ds26522_match);
 static struct spi_driver slic_ds26522_driver = {
        .driver = {
@@ -239,6 +246,7 @@ static struct spi_driver slic_ds26522_driver = {
                   },
        .probe = slic_ds26522_probe,
        .remove = slic_ds26522_remove,
+        .id_table = slic_ds26522_id,
 };
 static int __init slic_ds26522_init(void)
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index dda49af1eb74..521f1c55c19e 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -450,6 +450,7 @@ struct ath10k_debug {
        u32 pktlog_filter;
        u32 reg_addr;
        u32 nf_cal_period;
+        void *cal_data;
        struct ath10k_fw_crash_data *fw_crash_data;
 };
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 832da6ed9f13..82a4c67f3672 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -30,6 +30,8 @@
 /* ms */
 #define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000
+#define ATH10K_DEBUG_CAL_DATA_LEN 12064
 #define ATH10K_FW_CRASH_DUMP_VERSION 1
 /**
@@ -1451,56 +1453,51 @@ static const struct file_operations fops_fw_dbglog = {
        .llseek = default_llseek,
 };
-static int ath10k_debug_cal_data_open(struct inode *inode, struct file *file)
+static int ath10k_debug_cal_data_fetch(struct ath10k *ar)
 {
-        struct ath10k *ar = inode->i_private;
-        void *buf;
        u32 hi_addr;
        __le32 addr;
        int ret;
-        mutex_lock(&ar->conf_mutex);
+        lockdep_assert_held(&ar->conf_mutex);
-        if (ar->state != ATH10K_STATE_ON &&
-            ar->state != ATH10K_STATE_UTF) {
-                ret = -ENETDOWN;
-                goto err;
-        }
-        buf = vmalloc(ar->hw_params.cal_data_len);
+        if (WARN_ON(ar->hw_params.cal_data_len > ATH10K_DEBUG_CAL_DATA_LEN))
-        if (!buf) {
+                return -EINVAL;
-                ret = -ENOMEM;
-                goto err;
-        }
        hi_addr = host_interest_item_address(HI_ITEM(hi_board_data));
        ret = ath10k_hif_diag_read(ar, hi_addr, &addr, sizeof(addr));
        if (ret) {
-                ath10k_warn(ar, "failed to read hi_board_data address: %d\n", ret);
+                ath10k_warn(ar, "failed to read hi_board_data address: %d\n",
-                goto err_vfree;
+                            ret);
+                return ret;
        }
-        ret = ath10k_hif_diag_read(ar, le32_to_cpu(addr), buf,
+        ret = ath10k_hif_diag_read(ar, le32_to_cpu(addr), ar->debug.cal_data,
                                   ar->hw_params.cal_data_len);
        if (ret) {
                ath10k_warn(ar, "failed to read calibration data: %d\n", ret);
-                goto err_vfree;
+                return ret;
        }
-        file->private_data = buf;
+        return 0;
+}
-        mutex_unlock(&ar->conf_mutex);
+static int ath10k_debug_cal_data_open(struct inode *inode, struct file *file)
+{
+        struct ath10k *ar = inode->i_private;
-        return 0;
+        mutex_lock(&ar->conf_mutex);
-err_vfree:
+        if (ar->state == ATH10K_STATE_ON ||
-        vfree(buf);
+            ar->state == ATH10K_STATE_UTF) {
+                ath10k_debug_cal_data_fetch(ar);
+        }
-err:
+        file->private_data = ar;
        mutex_unlock(&ar->conf_mutex);
-        return ret;
+        return 0;
 }
 static ssize_t ath10k_debug_cal_data_read(struct file *file,
@@ -1508,18 +1505,16 @@ static ssize_t ath10k_debug_cal_data_read(struct file *file,
                                          size_t count, loff_t *ppos)
 {
        struct ath10k *ar = file->private_data;
-        void *buf = file->private_data;
-        return simple_read_from_buffer(user_buf, count, ppos,
+        mutex_lock(&ar->conf_mutex);
-                                       buf, ar->hw_params.cal_data_len);
-}
-static int ath10k_debug_cal_data_release(struct inode *inode,
+        count = simple_read_from_buffer(user_buf, count, ppos,
-                                         struct file *file)
+                                        ar->debug.cal_data,
-{
+                                        ar->hw_params.cal_data_len);
-        vfree(file->private_data);
-        return 0;
+        mutex_unlock(&ar->conf_mutex);
+        return count;
 }
 static ssize_t ath10k_write_ani_enable(struct file *file,
@@ -1580,7 +1575,6 @@ static const struct file_operations fops_ani_enable = {
 static const struct file_operations fops_cal_data = {
        .open = ath10k_debug_cal_data_open,
        .read = ath10k_debug_cal_data_read,
-        .release = ath10k_debug_cal_data_release,
        .owner = THIS_MODULE,
        .llseek = default_llseek,
 };
@@ -1932,6 +1926,8 @@ void ath10k_debug_stop(struct ath10k *ar)
 {
        lockdep_assert_held(&ar->conf_mutex);
+        ath10k_debug_cal_data_fetch(ar);
        /* Must not use _sync to avoid deadlock, we do that in
         * ath10k_debug_destroy(). The check for htt_stats_mask is to avoid
         * warning from del_timer(). */
@@ -2344,6 +2340,10 @@ int ath10k_debug_create(struct ath10k *ar)
        if (!ar->debug.fw_crash_data)
                return -ENOMEM;
+        ar->debug.cal_data = vzalloc(ATH10K_DEBUG_CAL_DATA_LEN);
+        if (!ar->debug.cal_data)
+                return -ENOMEM;
        INIT_LIST_HEAD(&ar->debug.fw_stats.pdevs);
        INIT_LIST_HEAD(&ar->debug.fw_stats.vdevs);
        INIT_LIST_HEAD(&ar->debug.fw_stats.peers);
@@ -2357,6 +2357,9 @@ void ath10k_debug_destroy(struct ath10k *ar)
        vfree(ar->debug.fw_crash_data);
        ar->debug.fw_crash_data = NULL;
+        vfree(ar->debug.cal_data);
+        ar->debug.cal_data = NULL;
        ath10k_debug_fw_stats_reset(ar);
        kfree(ar->debug.tpc_stats);
diff --git a/drivers/net/wireless/ath/ath6kl/sdio.c b/drivers/net/wireless/ath/ath6kl/sdio.c
index eab0ab976af2..76eb33679d4b 100644
--- a/drivers/net/wireless/ath/ath6kl/sdio.c
+++ b/drivers/net/wireless/ath/ath6kl/sdio.c
@@ -1401,6 +1401,7 @@ static const struct sdio_device_id ath6kl_sdio_devices[] = {
        {SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6004_BASE | 0x0))},
        {SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6004_BASE | 0x1))},
        {SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6004_BASE | 0x2))},
+        {SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6004_BASE | 0x18))},
        {},
 };
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index b6f064a8d264..7e27a06e5df1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -33,7 +33,6 @@ struct coeff {
 enum ar9003_cal_types {
        IQ_MISMATCH_CAL = BIT(0),
-        TEMP_COMP_CAL = BIT(1),
 };
 static void ar9003_hw_setup_calibration(struct ath_hw *ah,
@@ -59,12 +58,6 @@ static void ar9003_hw_setup_calibration(struct ath_hw *ah,
                /* Kick-off cal */
                REG_SET_BIT(ah, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL);
                break;
-        case TEMP_COMP_CAL:
-                ath_dbg(common, CALIBRATE,
-                        "starting Temperature Compensation Calibration\n");
-                REG_SET_BIT(ah, AR_CH0_THERM, AR_CH0_THERM_LOCAL);
-                REG_SET_BIT(ah, AR_CH0_THERM, AR_CH0_THERM_START);
-                break;
        default:
                ath_err(common, "Invalid calibration type\n");
                break;
@@ -93,8 +86,7 @@ static bool ar9003_hw_per_calibration(struct ath_hw *ah,
                /*
                * Accumulate cal measures for active chains
                */
-                if (cur_caldata->calCollect)
+                cur_caldata->calCollect(ah);
-                        cur_caldata->calCollect(ah);
                ah->cal_samples++;
                if (ah->cal_samples >= cur_caldata->calNumSamples) {
@@ -107,8 +99,7 @@ static bool ar9003_hw_per_calibration(struct ath_hw *ah,
                        /*
                        * Process accumulated data
                        */
-                        if (cur_caldata->calPostProc)
+                        cur_caldata->calPostProc(ah, numChains);
-                                cur_caldata->calPostProc(ah, numChains);
                        /* Calibration has finished. */
                        caldata->CalValid |= cur_caldata->calType;
@@ -323,16 +314,9 @@ static const struct ath9k_percal_data iq_cal_single_sample = {
        ar9003_hw_iqcalibrate
 };
-static const struct ath9k_percal_data temp_cal_single_sample = {
-        TEMP_COMP_CAL,
-        MIN_CAL_SAMPLES,
-        PER_MAX_LOG_COUNT,
-};
 static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
 {
        ah->iq_caldata.calData = &iq_cal_single_sample;
-        ah->temp_caldata.calData = &temp_cal_single_sample;
        if (AR_SREV_9300_20_OR_LATER(ah)) {
                ah->enabled_cals |= TX_IQ_CAL;
@@ -340,7 +324,7 @@ static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
                        ah->enabled_cals |= TX_IQ_ON_AGC_CAL;
        }
-        ah->supp_cals = IQ_MISMATCH_CAL | TEMP_COMP_CAL;
+        ah->supp_cals = IQ_MISMATCH_CAL;
 }
 #define OFF_UPPER_LT 24
@@ -1399,9 +1383,6 @@ static void ar9003_hw_init_cal_common(struct ath_hw *ah)
        INIT_CAL(&ah->iq_caldata);
        INSERT_CAL(ah, &ah->iq_caldata);
-        INIT_CAL(&ah->temp_caldata);
-        INSERT_CAL(ah, &ah->temp_caldata);
        /* Initialize current pointer to first element in list */
        ah->cal_list_curr = ah->cal_list;
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 2a5d3ad1169c..9cbca1229bac 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -830,7 +830,6 @@ struct ath_hw {
        /* Calibration */
        u32 supp_cals;
        struct ath9k_cal_list iq_caldata;
-        struct ath9k_cal_list temp_caldata;
        struct ath9k_cal_list adcgain_caldata;
        struct ath9k_cal_list adcdc_caldata;
        struct ath9k_cal_list *cal_list;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index b777e1b2f87a..78d9966a3957 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -4516,7 +4516,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
        /* store current 11d setting */
        if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
                                  &ifp->vif->is_11d)) {
-                supports_11d = false;
+                is_11d = supports_11d = false;
        } else {
                country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
                                              settings->beacon.tail_len,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 4fdc3dad3e85..b88e2048ae0b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -1087,6 +1087,15 @@ iwl_mvm_netdetect_config(struct iwl_mvm *mvm,
                ret = iwl_mvm_switch_to_d3(mvm);
                if (ret)
                        return ret;
+        } else {
+                /* In theory, we wouldn't have to stop a running sched
+                 * scan in order to start another one (for
+                 * net-detect).  But in practice this doesn't seem to
+                 * work properly, so stop any running sched_scan now.
+                 */
+                ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
+                if (ret)
+                        return ret;
        }
        /* rfkill release can be either for wowlan or netdetect */
@@ -1254,7 +1263,10 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
 out:
        if (ret < 0) {
                iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
-                ieee80211_restart_hw(mvm->hw);
+                if (mvm->restart_fw > 0) {
+                        mvm->restart_fw--;
+                        ieee80211_restart_hw(mvm->hw);
+                }
                iwl_mvm_free_nd(mvm);
        }
 out_noreset:
@@ -2088,6 +2100,16 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
        iwl_mvm_update_changed_regdom(mvm);
        if (mvm->net_detect) {
+                /* If this is a non-unified image, we restart the FW,
+                 * so no need to stop the netdetect scan.  If that
+                 * fails, continue and try to get the wake-up reasons,
+                 * but trigger a HW restart by keeping a failure code
+                 * in ret.
+                 */
+                if (unified_image)
+                        ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_NETDETECT,
+                                                false);
                iwl_mvm_query_netdetect_reasons(mvm, vif);
                /* has unlocked the mutex, so skip that */
                goto out;
@@ -2271,7 +2293,8 @@ static void iwl_mvm_d3_test_disconn_work_iter(void *_data, u8 *mac,
 static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
 {
        struct iwl_mvm *mvm = inode->i_private;
-        int remaining_time = 10;
+        bool unified_image = fw_has_capa(&mvm->fw->ucode_capa,
+                                         IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
        mvm->d3_test_active = false;
@@ -2282,17 +2305,21 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
        mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_DISABLED;
        iwl_abort_notification_waits(&mvm->notif_wait);
-        ieee80211_restart_hw(mvm->hw);
+        if (!unified_image) {
+                int remaining_time = 10;
-        /* wait for restart and disconnect all interfaces */
+                ieee80211_restart_hw(mvm->hw);
-        while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
-               remaining_time > 0) {
+                /* wait for restart and disconnect all interfaces */
-                remaining_time--;
+                while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
-                msleep(1000);
+                       remaining_time > 0) {
-        }
+                        remaining_time--;
+                        msleep(1000);
+                }
-        if (remaining_time == 0)
+                if (remaining_time == 0)
-                IWL_ERR(mvm, "Timed out waiting for HW restart to finish!\n");
+                        IWL_ERR(mvm, "Timed out waiting for HW restart!\n");
+        }
        ieee80211_iterate_active_interfaces_atomic(
                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index 07da4efe8458..7b7d2a146e30 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -1529,8 +1529,8 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
                .data = { &cmd, },
                .len = { sizeof(cmd) },
        };
-        size_t delta, len;
+        size_t delta;
-        ssize_t ret;
+        ssize_t ret, len;
        hcmd.id = iwl_cmd_id(*ppos >> 24 ? UMAC_RD_WR : LMAC_RD_WR,
                             DEBUG_GROUP, 0);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 318efd814037..1db1dc13e988 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -4121,7 +4121,6 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
                                     struct iwl_mvm_internal_rxq_notif *notif,
                                     u32 size)
 {
-        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(notif_waitq);
        u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
        int ret;
@@ -4143,7 +4142,7 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
        }
        if (notif->sync)
-                ret = wait_event_timeout(notif_waitq,
+                ret = wait_event_timeout(mvm->rx_sync_waitq,
                                         atomic_read(&mvm->queue_sync_counter) == 0,
                                         HZ);
        WARN_ON_ONCE(!ret);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index d17cbf603f7c..c60703e0c246 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -937,6 +937,7 @@ struct iwl_mvm {
        /* sync d0i3_tx queue and IWL_MVM_STATUS_IN_D0I3 status flag */
        spinlock_t d0i3_tx_lock;
        wait_queue_head_t d0i3_exit_waitq;
+        wait_queue_head_t rx_sync_waitq;
        /* BT-Coex */
        struct iwl_bt_coex_profile_notif last_bt_notif;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 05fe6dd1a2c8..4d35deb628bc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -619,6 +619,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
        spin_lock_init(&mvm->refs_lock);
        skb_queue_head_init(&mvm->d0i3_tx);
        init_waitqueue_head(&mvm->d0i3_exit_waitq);
+        init_waitqueue_head(&mvm->rx_sync_waitq);
        atomic_set(&mvm->queue_sync_counter, 0);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index a57c6ef5bc14..6c802cee900c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -547,7 +547,8 @@ void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                                  "Received expired RX queue sync message\n");
                        return;
                }
-                atomic_dec(&mvm->queue_sync_counter);
+                if (!atomic_dec_return(&mvm->queue_sync_counter))
+                        wake_up(&mvm->rx_sync_waitq);
        }
        switch (internal_notif->type) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index f279fdd6eb44..fa9743205491 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1199,6 +1199,9 @@ static int iwl_mvm_num_scans(struct iwl_mvm *mvm)
 static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
 {
+        bool unified_image = fw_has_capa(&mvm->fw->ucode_capa,
+                                         IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
        /* This looks a bit arbitrary, but the idea is that if we run
         * out of possible simultaneous scans and the userspace is
         * trying to run a scan type that is already running, we
@@ -1225,12 +1228,30 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
                        return -EBUSY;
                return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
        case IWL_MVM_SCAN_NETDETECT:
-                /* No need to stop anything for net-detect since the
+                /* For non-unified images, there's no need to stop
-                 * firmware is restarted anyway.  This way, any sched
+                 * anything for net-detect since the firmware is
-                 * scans that were running will be restarted when we
+                 * restarted anyway.  This way, any sched scans that
-                 * resume.
+                 * were running will be restarted when we resume.
-                */
+                 */
-                return 0;
+                if (!unified_image)
+                        return 0;
+                /* If this is a unified image and we ran out of scans,
+                 * we need to stop something.  Prefer stopping regular
+                 * scans, because the results are useless at this
+                 * point, and we should be able to keep running
+                 * another scheduled scan while suspended.
+                 */
+                if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
+                        return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR,
+                                                 true);
+                if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
+                        return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED,
+                                                 true);
+                /* fall through, something is wrong if no scan was
+                 * running but we ran out of scans.
+                 */
        default:
                WARN_ON(1);
                break;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 001be406a3d3..2f8134b2a504 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -541,48 +541,64 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 MODULE_DEVICE_TABLE(pci, iwl_hw_card_ids);
 #ifdef CONFIG_ACPI
-#define SPL_METHOD              "SPLC"
+#define ACPI_SPLC_METHOD        "SPLC"
-#define SPL_DOMAINTYPE_MODULE   BIT(0)
+#define ACPI_SPLC_DOMAIN_WIFI   (0x07)
-#define SPL_DOMAINTYPE_WIFI     BIT(1)
-#define SPL_DOMAINTYPE_WIGIG    BIT(2)
-#define SPL_DOMAINTYPE_RFEM     BIT(3)
-static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx)
+static u64 splc_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splc)
 {
-        union acpi_object *limits, *domain_type, *power_limit;
+        union acpi_object *data_pkg, *dflt_pwr_limit;
+        int i;
-        if (splx->type != ACPI_TYPE_PACKAGE ||
-            splx->package.count != 2 ||
+        /* We need at least two elements, one for the revision and one
-            splx->package.elements[0].type != ACPI_TYPE_INTEGER ||
+         * for the data itself.  Also check that the revision is
-            splx->package.elements[0].integer.value != 0) {
+         * supported (currently only revision 0).
-                IWL_ERR(trans, "Unsupported splx structure\n");
+        */
+        if (splc->type != ACPI_TYPE_PACKAGE ||
+            splc->package.count < 2 ||
+            splc->package.elements[0].type != ACPI_TYPE_INTEGER ||
+            splc->package.elements[0].integer.value != 0) {
+                IWL_DEBUG_INFO(trans,
+                               "Unsupported structure returned by the SPLC method.  Ignoring.\n");
                return 0;
        }
-        limits = &splx->package.elements[1];
+        /* loop through all the packages to find the one for WiFi */
-        if (limits->type != ACPI_TYPE_PACKAGE ||
+        for (i = 1; i < splc->package.count; i++) {
-            limits->package.count < 2 ||
+                union acpi_object *domain;
-            limits->package.elements[0].type != ACPI_TYPE_INTEGER ||
-            limits->package.elements[1].type != ACPI_TYPE_INTEGER) {
+                data_pkg = &splc->package.elements[i];
-                IWL_ERR(trans, "Invalid limits element\n");
-                return 0;
+                /* Skip anything that is not a package with the right
+                 * amount of elements (i.e. at least 2 integers).
+                 */
+                if (data_pkg->type != ACPI_TYPE_PACKAGE ||
+                    data_pkg->package.count < 2 ||
+                    data_pkg->package.elements[0].type != ACPI_TYPE_INTEGER ||
+                    data_pkg->package.elements[1].type != ACPI_TYPE_INTEGER)
+                        continue;
+                domain = &data_pkg->package.elements[0];
+                if (domain->integer.value == ACPI_SPLC_DOMAIN_WIFI)
+                        break;
+                data_pkg = NULL;
        }
-        domain_type = &limits->package.elements[0];
+        if (!data_pkg) {
-        power_limit = &limits->package.elements[1];
+                IWL_DEBUG_INFO(trans,
-        if (!(domain_type->integer.value & SPL_DOMAINTYPE_WIFI)) {
+                               "No element for the WiFi domain returned by the SPLC method.\n");
-                IWL_DEBUG_INFO(trans, "WiFi power is not limited\n");
                return 0;
        }
-        return power_limit->integer.value;
+        dflt_pwr_limit = &data_pkg->package.elements[1];
+        return dflt_pwr_limit->integer.value;
 }
 static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
 {
        acpi_handle pxsx_handle;
        acpi_handle handle;
-        struct acpi_buffer splx = {ACPI_ALLOCATE_BUFFER, NULL};
+        struct acpi_buffer splc = {ACPI_ALLOCATE_BUFFER, NULL};
        acpi_status status;
        pxsx_handle = ACPI_HANDLE(&pdev->dev);
@@ -593,23 +609,24 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
        }
        /* Get the method's handle */
-        status = acpi_get_handle(pxsx_handle, (acpi_string)SPL_METHOD, &handle);
+        status = acpi_get_handle(pxsx_handle, (acpi_string)ACPI_SPLC_METHOD,
+                                 &handle);
        if (ACPI_FAILURE(status)) {
-                IWL_DEBUG_INFO(trans, "SPL method not found\n");
+                IWL_DEBUG_INFO(trans, "SPLC method not found\n");
                return;
        }
        /* Call SPLC with no arguments */
-        status = acpi_evaluate_object(handle, NULL, NULL, &splx);
+        status = acpi_evaluate_object(handle, NULL, NULL, &splc);
        if (ACPI_FAILURE(status)) {
                IWL_ERR(trans, "SPLC invocation failed (0x%x)\n", status);
                return;
        }
-        trans->dflt_pwr_limit = splx_get_pwr_limit(trans, splx.pointer);
+        trans->dflt_pwr_limit = splc_get_pwr_limit(trans, splc.pointer);
        IWL_DEBUG_INFO(trans, "Default power limit set to %lld\n",
                       trans->dflt_pwr_limit);
-        kfree(splx.pointer);
+        kfree(splc.pointer);
 }
 #else /* CONFIG_ACPI */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index e9a278b60dfd..5f840f16f40b 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -592,6 +592,7 @@ error:
 static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq,
                              int slots_num, u32 txq_id)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        int ret;
        txq->need_update = false;
@@ -606,6 +607,13 @@ static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq,
                return ret;
        spin_lock_init(&txq->lock);
+        if (txq_id == trans_pcie->cmd_queue) {
+                static struct lock_class_key iwl_pcie_cmd_queue_lock_class;
+                lockdep_set_class(&txq->lock, &iwl_pcie_cmd_queue_lock_class);
+        }
        __skb_queue_head_init(&txq->overflow_q);
        /*
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 431f13b4faf6..d3bad5779376 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -826,7 +826,7 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
                data->bcn_delta = do_div(delta, bcn_int);
        } else {
                data->tsf_offset -= delta;
-                data->bcn_delta = -do_div(delta, bcn_int);
+                data->bcn_delta = -(s64)do_div(delta, bcn_int);
        }
 }
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index 94480123efa3..274dd5a1574a 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -45,7 +45,7 @@ static int mwifiex_11n_dispatch_amsdu_pkt(struct mwifiex_private *priv,
                skb_trim(skb, le16_to_cpu(local_rx_pd->rx_pkt_length));
                ieee80211_amsdu_to_8023s(skb, &list, priv->curr_addr,
-                                         priv->wdev.iftype, 0, false);
+                                         priv->wdev.iftype, 0, NULL, NULL);
                while (!skb_queue_empty(&list)) {
                        struct rx_packet_hdr *rx_hdr;
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 39ce76ad00bc..16241d21727b 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -2222,8 +2222,9 @@ done:
                        is_scanning_required = 1;
                } else {
                        mwifiex_dbg(priv->adapter, MSG,
-                                    "info: trying to associate to '%s' bssid %pM\n",
+                                    "info: trying to associate to '%.*s' bssid %pM\n",
-                                    (char *)req_ssid.ssid, bss->bssid);
+                                    req_ssid.ssid_len, (char *)req_ssid.ssid,
+                                    bss->bssid);
                        memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN);
                        break;
                }
@@ -2283,8 +2284,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
        }
        mwifiex_dbg(adapter, INFO,
-                    "info: Trying to associate to %s and bssid %pM\n",
+                    "info: Trying to associate to %.*s and bssid %pM\n",
-                    (char *)sme->ssid, sme->bssid);
+                    (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
        if (!mwifiex_stop_bg_scan(priv))
                cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
@@ -2417,8 +2418,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
        }
        mwifiex_dbg(priv->adapter, MSG,
-                    "info: trying to join to %s and bssid %pM\n",
+                    "info: trying to join to %.*s and bssid %pM\n",
-                    (char *)params->ssid, params->bssid);
+                    params->ssid_len, (char *)params->ssid, params->bssid);
        mwifiex_set_ibss_params(priv, params);
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
index 1016628926d2..08d587a342d3 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
@@ -238,7 +238,7 @@ struct rtl8xxxu_rxdesc16 {
        u32 pattern1match:1;
        u32 pattern0match:1;
 #endif
-        __le32 tsfl;
+        u32 tsfl;
 #if 0
        u32 bassn:12;
        u32 bavld:1;
@@ -368,7 +368,7 @@ struct rtl8xxxu_rxdesc24 {
        u32 ldcp:1;
        u32 splcp:1;
 #endif
-        __le32 tsfl;
+        u32 tsfl;
 };
 struct rtl8xxxu_txdesc32 {
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
index df54d27e7851..a793fedc3654 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
@@ -1461,7 +1461,9 @@ static int rtl8192eu_active_to_emu(struct rtl8xxxu_priv *priv)
        int count, ret = 0;
        /* Turn off RF */
-        rtl8xxxu_write8(priv, REG_RF_CTRL, 0);
+        val8 = rtl8xxxu_read8(priv, REG_RF_CTRL);
+        val8 &= ~RF_ENABLE;
+        rtl8xxxu_write8(priv, REG_RF_CTRL, val8);
        /* Switch DPDT_SEL_P output from register 0x65[2] */
        val8 = rtl8xxxu_read8(priv, REG_LEDCFG2);
@@ -1593,6 +1595,10 @@ static void rtl8192e_enable_rf(struct rtl8xxxu_priv *priv)
        u32 val32;
        u8 val8;
+        val32 = rtl8xxxu_read32(priv, REG_RX_WAIT_CCA);
+        val32 |= (BIT(22) | BIT(23));
+        rtl8xxxu_write32(priv, REG_RX_WAIT_CCA, val32);
        val8 = rtl8xxxu_read8(priv, REG_GPIO_MUXCFG);
        val8 |= BIT(5);
        rtl8xxxu_write8(priv, REG_GPIO_MUXCFG, val8);
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
index 6c086b5657e9..02b8ddd98a95 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
@@ -1498,6 +1498,10 @@ static void rtl8723b_enable_rf(struct rtl8xxxu_priv *priv)
        u32 val32;
        u8 val8;
+        val32 = rtl8xxxu_read32(priv, REG_RX_WAIT_CCA);
+        val32 |= (BIT(22) | BIT(23));
+        rtl8xxxu_write32(priv, REG_RX_WAIT_CCA, val32);
        /*
         * No indication anywhere as to what 0x0790 does. The 2 antenna
         * vendor code preserves bits 6-7 here.
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
index b2d7f6e69667..a5e6ec2152bf 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
@@ -5197,7 +5197,12 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
                pkt_offset = roundup(pkt_len + drvinfo_sz + desc_shift +
                                     sizeof(struct rtl8xxxu_rxdesc16), 128);
-                if (pkt_cnt > 1)
+                /*
+                 * Only clone the skb if there's enough data at the end to
+                 * at least cover the rx descriptor
+                 */
+                if (pkt_cnt > 1 &&
+                    urb_len > (pkt_offset + sizeof(struct rtl8xxxu_rxdesc16)))
                        next_skb = skb_clone(skb, GFP_ATOMIC);
                rx_status = IEEE80211_SKB_RXCB(skb);
@@ -5215,7 +5220,7 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
                        rtl8xxxu_rx_parse_phystats(priv, rx_status, phy_stats,
                                                   rx_desc->rxmcs);
-                rx_status->mactime = le32_to_cpu(rx_desc->tsfl);
+                rx_status->mactime = rx_desc->tsfl;
                rx_status->flag |= RX_FLAG_MACTIME_START;
                if (!rx_desc->swdec)
@@ -5285,7 +5290,7 @@ int rtl8xxxu_parse_rxdesc24(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
                rtl8xxxu_rx_parse_phystats(priv, rx_status, phy_stats,
                                           rx_desc->rxmcs);
-        rx_status->mactime = le32_to_cpu(rx_desc->tsfl);
+        rx_status->mactime = rx_desc->tsfl;
        rx_status->flag |= RX_FLAG_MACTIME_START;
        if (!rx_desc->swdec)
diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
index f95760c13c56..8e7f23c11680 100644
--- a/drivers/net/wireless/realtek/rtlwifi/core.c
+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
@@ -111,7 +111,7 @@ static void rtl_fw_do_work(const struct firmware *firmware, void *context,
                        if (!err)
                                goto found_alt;
                }
-                pr_err("Firmware %s not available\n", rtlpriv->cfg->fw_name);
+                pr_err("Selected firmware is not available\n");
                rtlpriv->max_fw_size = 0;
                return;
        }
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
index e7b11b40e68d..f361808def47 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
@@ -86,6 +86,7 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
        u8 tid;
+        char *fw_name;
        rtl8188ee_bt_reg_init(hw);
        rtlpriv->dm.dm_initialgain_enable = 1;
@@ -169,10 +170,10 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
                return 1;
        }
-        rtlpriv->cfg->fw_name = "rtlwifi/rtl8188efw.bin";
+        fw_name = "rtlwifi/rtl8188efw.bin";
        rtlpriv->max_fw_size = 0x8000;
-        pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
+        pr_info("Using firmware %s\n", fw_name);
-        err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
+        err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
                                      rtlpriv->io.dev, GFP_KERNEL, hw,
                                      rtl_fw_cb);
        if (err) {
@@ -284,7 +285,6 @@ static const struct rtl_hal_cfg rtl88ee_hal_cfg = {
        .bar_id = 2,
        .write_readback = true,
        .name = "rtl88e_pci",
-        .fw_name = "rtlwifi/rtl8188efw.bin",
        .ops = &rtl8188ee_hal_ops,
        .mod_params = &rtl88ee_mod_params,
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
index 87aa209ae325..8b6e37ce3f66 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
@@ -96,6 +96,7 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        char *fw_name = "rtlwifi/rtl8192cfwU.bin";
        rtl8192ce_bt_reg_init(hw);
@@ -167,15 +168,12 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
        }
        /* request fw */
-        if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
+        if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
-            !IS_92C_SERIAL(rtlhal->version))
+                fw_name = "rtlwifi/rtl8192cfwU_B.bin";
-                rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU.bin";
-        else if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
-                rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU_B.bin";
        rtlpriv->max_fw_size = 0x4000;
-        pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
+        pr_info("Using firmware %s\n", fw_name);
-        err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
+        err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
                                      rtlpriv->io.dev, GFP_KERNEL, hw,
                                      rtl_fw_cb);
        if (err) {
@@ -262,7 +260,6 @@ static const struct rtl_hal_cfg rtl92ce_hal_cfg = {
        .bar_id = 2,
        .write_readback = true,
        .name = "rtl92c_pci",
-        .fw_name = "rtlwifi/rtl8192cfw.bin",
        .ops = &rtl8192ce_hal_ops,
        .mod_params = &rtl92ce_mod_params,
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
index 7c6f7f0d18c6..f953320f0e23 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
@@ -59,6 +59,7 @@ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
 {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        int err;
+        char *fw_name;
        rtlpriv->dm.dm_initialgain_enable = true;
        rtlpriv->dm.dm_flag = 0;
@@ -77,18 +78,18 @@ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
        }
        if (IS_VENDOR_UMC_A_CUT(rtlpriv->rtlhal.version) &&
            !IS_92C_SERIAL(rtlpriv->rtlhal.version)) {
-                rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_A.bin";
+                fw_name = "rtlwifi/rtl8192cufw_A.bin";
        } else if (IS_81XXC_VENDOR_UMC_B_CUT(rtlpriv->rtlhal.version)) {
-                rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_B.bin";
+                fw_name = "rtlwifi/rtl8192cufw_B.bin";
        } else {
-                rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_TMSC.bin";
+                fw_name = "rtlwifi/rtl8192cufw_TMSC.bin";
        }
        /* provide name of alternative file */
        rtlpriv->cfg->alt_fw_name = "rtlwifi/rtl8192cufw.bin";
-        pr_info("Loading firmware %s\n", rtlpriv->cfg->fw_name);
+        pr_info("Loading firmware %s\n", fw_name);
        rtlpriv->max_fw_size = 0x4000;
        err = request_firmware_nowait(THIS_MODULE, 1,
-                                      rtlpriv->cfg->fw_name, rtlpriv->io.dev,
+                                      fw_name, rtlpriv->io.dev,
                                      GFP_KERNEL, hw, rtl_fw_cb);
        return err;
 }
@@ -187,7 +188,6 @@ static struct rtl_hal_usbint_cfg rtl92cu_interface_cfg = {
 static struct rtl_hal_cfg rtl92cu_hal_cfg = {
        .name = "rtl92c_usb",
-        .fw_name = "rtlwifi/rtl8192cufw.bin",
        .ops = &rtl8192cu_hal_ops,
        .mod_params = &rtl92cu_mod_params,
        .usb_interface_cfg = &rtl92cu_interface_cfg,
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
index 0538a4d09568..1ebfee18882f 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
@@ -92,6 +92,7 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
        u8 tid;
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        char *fw_name = "rtlwifi/rtl8192defw.bin";
        rtlpriv->dm.dm_initialgain_enable = true;
        rtlpriv->dm.dm_flag = 0;
@@ -181,10 +182,10 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
        rtlpriv->max_fw_size = 0x8000;
        pr_info("Driver for Realtek RTL8192DE WLAN interface\n");
-        pr_info("Loading firmware file %s\n", rtlpriv->cfg->fw_name);
+        pr_info("Loading firmware file %s\n", fw_name);
        /* request fw */
-        err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
+        err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
                                      rtlpriv->io.dev, GFP_KERNEL, hw,
                                      rtl_fw_cb);
        if (err) {
@@ -266,7 +267,6 @@ static const struct rtl_hal_cfg rtl92de_hal_cfg = {
        .bar_id = 2,
        .write_readback = true,
        .name = "rtl8192de",
-        .fw_name = "rtlwifi/rtl8192defw.bin",
        .ops = &rtl8192de_hal_ops,
        .mod_params = &rtl92de_mod_params,
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
index ac299cbe59b0..46b605de36e7 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
@@ -91,6 +91,7 @@ int rtl92ee_init_sw_vars(struct ieee80211_hw *hw)
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
        int err = 0;
+        char *fw_name;
        rtl92ee_bt_reg_init(hw);
        rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
@@ -170,11 +171,11 @@ int rtl92ee_init_sw_vars(struct ieee80211_hw *hw)
        }
        /* request fw */
-        rtlpriv->cfg->fw_name = "rtlwifi/rtl8192eefw.bin";
+        fw_name = "rtlwifi/rtl8192eefw.bin";
        rtlpriv->max_fw_size = 0x8000;
-        pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
+        pr_info("Using firmware %s\n", fw_name);
-        err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
+        err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
                                      rtlpriv->io.dev, GFP_KERNEL, hw,
                                      rtl_fw_cb);
        if (err) {
@@ -266,7 +267,6 @@ static const struct rtl_hal_cfg rtl92ee_hal_cfg = {
        .bar_id = 2,
        .write_readback = true,
        .name = "rtl92ee_pci",
-        .fw_name = "rtlwifi/rtl8192eefw.bin",
        .ops = &rtl8192ee_hal_ops,
        .mod_params = &rtl92ee_mod_params,
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
index 5e8e02d5de8a..3e1eaeac4fdc 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
@@ -89,12 +89,13 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
        struct ieee80211_hw *hw = context;
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rt_firmware *pfirmware = NULL;
+        char *fw_name = "rtlwifi/rtl8192sefw.bin";
        RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
                         "Firmware callback routine entered!\n");
        complete(&rtlpriv->firmware_loading_complete);
        if (!firmware) {
-                pr_err("Firmware %s not available\n", rtlpriv->cfg->fw_name);
+                pr_err("Firmware %s not available\n", fw_name);
                rtlpriv->max_fw_size = 0;
                return;
        }
@@ -117,6 +118,7 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
        int err = 0;
        u16 earlyrxthreshold = 7;
+        char *fw_name = "rtlwifi/rtl8192sefw.bin";
        rtlpriv->dm.dm_initialgain_enable = true;
        rtlpriv->dm.dm_flag = 0;
@@ -214,9 +216,9 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
        rtlpriv->max_fw_size = RTL8190_MAX_FIRMWARE_CODE_SIZE*2 +
                               sizeof(struct fw_hdr);
        pr_info("Driver for Realtek RTL8192SE/RTL8191SE\n"
-                "Loading firmware %s\n", rtlpriv->cfg->fw_name);
+                "Loading firmware %s\n", fw_name);
        /* request fw */
-        err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
+        err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
                                      rtlpriv->io.dev, GFP_KERNEL, hw,
                                      rtl92se_fw_cb);
        if (err) {
@@ -310,7 +312,6 @@ static const struct rtl_hal_cfg rtl92se_hal_cfg = {
        .bar_id = 1,
        .write_readback = false,
        .name = "rtl92s_pci",
-        .fw_name = "rtlwifi/rtl8192sefw.bin",
        .ops = &rtl8192se_hal_ops,
        .mod_params = &rtl92se_mod_params,
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
index 89c828ad89f4..c51a9e8234e9 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
@@ -94,6 +94,7 @@ int rtl8723e_init_sw_vars(struct ieee80211_hw *hw)
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
        int err = 0;
+        char *fw_name = "rtlwifi/rtl8723fw.bin";
        rtl8723e_bt_reg_init(hw);
@@ -176,14 +177,12 @@ int rtl8723e_init_sw_vars(struct ieee80211_hw *hw)
                return 1;
        }
-        if (IS_VENDOR_8723_A_CUT(rtlhal->version))
+        if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version))
-                rtlpriv->cfg->fw_name = "rtlwifi/rtl8723fw.bin";
+                fw_name = "rtlwifi/rtl8723fw_B.bin";
-        else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version))
-                rtlpriv->cfg->fw_name = "rtlwifi/rtl8723fw_B.bin";
        rtlpriv->max_fw_size = 0x6000;
-        pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
+        pr_info("Using firmware %s\n", fw_name);
-        err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
+        err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
                                      rtlpriv->io.dev, GFP_KERNEL, hw,
                                      rtl_fw_cb);
        if (err) {
@@ -280,7 +279,6 @@ static const struct rtl_hal_cfg rtl8723e_hal_cfg = {
        .bar_id = 2,
        .write_readback = true,
        .name = "rtl8723e_pci",
-        .fw_name = "rtlwifi/rtl8723efw.bin",
        .ops = &rtl8723e_hal_ops,
        .mod_params = &rtl8723e_mod_params,
        .maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
index 20b53f035483..847644d1f5f5 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
@@ -91,6 +91,7 @@ int rtl8723be_init_sw_vars(struct ieee80211_hw *hw)
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        char *fw_name = "rtlwifi/rtl8723befw.bin";
        rtl8723be_bt_reg_init(hw);
        rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer();
@@ -184,8 +185,8 @@ int rtl8723be_init_sw_vars(struct ieee80211_hw *hw)
        }
        rtlpriv->max_fw_size = 0x8000;
-        pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
+        pr_info("Using firmware %s\n", fw_name);
-        err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
+        err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
                                      rtlpriv->io.dev, GFP_KERNEL, hw,
                                      rtl_fw_cb);
        if (err) {
@@ -280,7 +281,6 @@ static const struct rtl_hal_cfg rtl8723be_hal_cfg = {
        .bar_id = 2,
        .write_readback = true,
        .name = "rtl8723be_pci",
-        .fw_name = "rtlwifi/rtl8723befw.bin",
        .ops = &rtl8723be_hal_ops,
        .mod_params = &rtl8723be_mod_params,
        .maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
index 22f687b1f133..297938e0effd 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
@@ -93,6 +93,7 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        char *fw_name, *wowlan_fw_name;
        rtl8821ae_bt_reg_init(hw);
        rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer();
@@ -203,17 +204,17 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
        }
        if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE) {
-                rtlpriv->cfg->fw_name = "rtlwifi/rtl8812aefw.bin";
+                fw_name = "rtlwifi/rtl8812aefw.bin";
-                rtlpriv->cfg->wowlan_fw_name = "rtlwifi/rtl8812aefw_wowlan.bin";
+                wowlan_fw_name = "rtlwifi/rtl8812aefw_wowlan.bin";
        } else {
-                rtlpriv->cfg->fw_name = "rtlwifi/rtl8821aefw.bin";
+                fw_name = "rtlwifi/rtl8821aefw.bin";
-                rtlpriv->cfg->wowlan_fw_name = "rtlwifi/rtl8821aefw_wowlan.bin";
+                wowlan_fw_name = "rtlwifi/rtl8821aefw_wowlan.bin";
        }
        rtlpriv->max_fw_size = 0x8000;
        /*load normal firmware*/
-        pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
+        pr_info("Using firmware %s\n", fw_name);
-        err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
+        err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
                                      rtlpriv->io.dev, GFP_KERNEL, hw,
                                      rtl_fw_cb);
        if (err) {
@@ -222,9 +223,9 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
                return 1;
        }
        /*load wowlan firmware*/
-        pr_info("Using firmware %s\n", rtlpriv->cfg->wowlan_fw_name);
+        pr_info("Using firmware %s\n", wowlan_fw_name);
        err = request_firmware_nowait(THIS_MODULE, 1,
-                                      rtlpriv->cfg->wowlan_fw_name,
+                                      wowlan_fw_name,
                                      rtlpriv->io.dev, GFP_KERNEL, hw,
                                      rtl_wowlan_fw_cb);
        if (err) {
@@ -320,7 +321,6 @@ static const struct rtl_hal_cfg rtl8821ae_hal_cfg = {
        .bar_id = 2,
        .write_readback = true,
        .name = "rtl8821ae_pci",
-        .fw_name = "rtlwifi/rtl8821aefw.bin",
        .ops = &rtl8821ae_hal_ops,
        .mod_params = &rtl8821ae_mod_params,
        .maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index 595f7d5d091a..dafe486f8448 100644
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
@@ -2278,9 +2278,7 @@ struct rtl_hal_cfg {
        u8 bar_id;
        bool write_readback;
        char *name;
-        char *fw_name;
        char *alt_fw_name;
-        char *wowlan_fw_name;
        struct rtl_hal_ops *ops;
        struct rtl_mod_params *mod_params;
        struct rtl_hal_usbint_cfg *usb_interface_cfg;
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index a6e94b1a12cb..47fe7f96a242 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -391,7 +391,6 @@ static void wl1271_remove(struct sdio_func *func)
        pm_runtime_get_noresume(&func->dev);
        platform_device_unregister(glue->core);
-        kfree(glue);
 }
 #ifdef CONFIG_PM
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index e17879dd5d5a..bf2744e1e3db 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -304,7 +304,7 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue)
                queue->rx_skbs[id] = skb;
                ref = gnttab_claim_grant_reference(&queue->gref_rx_head);
-                BUG_ON((signed short)ref < 0);
+                WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
                queue->grant_rx_ref[id] = ref;
                page = skb_frag_page(&skb_shinfo(skb)->frags[0]);
@@ -428,7 +428,7 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset,
        id = get_id_from_freelist(&queue->tx_skb_freelist, queue->tx_skbs);
        tx = RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++);
        ref = gnttab_claim_grant_reference(&queue->gref_tx_head);
-        BUG_ON((signed short)ref < 0);
+        WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
        gnttab_grant_foreign_access_ref(ref, queue->info->xbdev->otherend_id,
                                        gfn, GNTMAP_readonly);
diff --git a/drivers/nfc/mei_phy.c b/drivers/nfc/mei_phy.c
index 83deda4bb4d6..6f9563a96488 100644
--- a/drivers/nfc/mei_phy.c
+++ b/drivers/nfc/mei_phy.c
@@ -133,7 +133,7 @@ static int mei_nfc_if_version(struct nfc_mei_phy *phy)
                return -ENOMEM;
        bytes_recv = mei_cldev_recv(phy->cldev, (u8 *)reply, if_version_length);
-        if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
+        if (bytes_recv < 0 || bytes_recv < if_version_length) {
                pr_err("Could not read IF version\n");
                r = -EIO;
                goto err;
diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c
index 0d5c29ae51de..7310a261c858 100644
--- a/drivers/ntb/hw/intel/ntb_hw_intel.c
+++ b/drivers/ntb/hw/intel/ntb_hw_intel.c
@@ -112,17 +112,17 @@ MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
 module_param_named(xeon_b2b_usd_bar4_addr64,
                   xeon_b2b_usd_addr.bar4_addr64, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_usd_bar4_addr64,
                 "XEON B2B USD BAR 4 64-bit address");
 module_param_named(xeon_b2b_usd_bar4_addr32,
                   xeon_b2b_usd_addr.bar4_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_usd_bar4_addr32,
                 "XEON B2B USD split-BAR 4 32-bit address");
 module_param_named(xeon_b2b_usd_bar5_addr32,
                   xeon_b2b_usd_addr.bar5_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_usd_bar5_addr32,
                 "XEON B2B USD split-BAR 5 32-bit address");
 module_param_named(xeon_b2b_dsd_bar2_addr64,
@@ -132,17 +132,17 @@ MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
 module_param_named(xeon_b2b_dsd_bar4_addr64,
                   xeon_b2b_dsd_addr.bar4_addr64, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_dsd_bar4_addr64,
                 "XEON B2B DSD BAR 4 64-bit address");
 module_param_named(xeon_b2b_dsd_bar4_addr32,
                   xeon_b2b_dsd_addr.bar4_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_dsd_bar4_addr32,
                 "XEON B2B DSD split-BAR 4 32-bit address");
 module_param_named(xeon_b2b_dsd_bar5_addr32,
                   xeon_b2b_dsd_addr.bar5_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_dsd_bar5_addr32,
                 "XEON B2B DSD split-BAR 5 32-bit address");
 #ifndef ioread64
@@ -1755,6 +1755,8 @@ static int xeon_setup_b2b_mw(struct intel_ntb_dev *ndev,
                                            XEON_B2B_MIN_SIZE);
                if (!ndev->peer_mmio)
                        return -EIO;
+                ndev->peer_addr = pci_resource_start(pdev, b2b_bar);
        }
        return 0;
@@ -2019,6 +2021,7 @@ static int intel_ntb_init_pci(struct intel_ntb_dev *ndev, struct pci_dev *pdev)
                goto err_mmio;
        }
        ndev->peer_mmio = ndev->self_mmio;
+        ndev->peer_addr = pci_resource_start(pdev, 0);
        return 0;
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 8601c10acf74..4eb8adb34508 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -257,7 +257,7 @@ enum {
 #define NTB_QP_DEF_NUM_ENTRIES  100
 #define NTB_LINK_DOWN_TIMEOUT   10
 #define DMA_RETRIES             20
-#define DMA_OUT_RESOURCE_TO     50
+#define DMA_OUT_RESOURCE_TO     msecs_to_jiffies(50)
 static void ntb_transport_rxc_db(unsigned long data);
 static const struct ntb_ctx_ops ntb_transport_ops;
diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
index 6a50f20bf1cd..e75d4fdc0866 100644
--- a/drivers/ntb/test/ntb_perf.c
+++ b/drivers/ntb/test/ntb_perf.c
@@ -72,7 +72,7 @@
 #define MAX_THREADS             32
 #define MAX_TEST_SIZE           SZ_1M
 #define MAX_SRCS                32
-#define DMA_OUT_RESOURCE_TO     50
+#define DMA_OUT_RESOURCE_TO     msecs_to_jiffies(50)
 #define DMA_RETRIES             20
 #define SZ_4G                   (1ULL << 32)
 #define MAX_SEG_ORDER           20 /* no larger than 1M for kmalloc buffer */
@@ -589,7 +589,7 @@ static ssize_t debugfs_run_read(struct file *filp, char __user *ubuf,
                return -ENOMEM;
        if (mutex_is_locked(&perf->run_mutex)) {
-                out_off = snprintf(buf, 64, "running\n");
+                out_off = scnprintf(buf, 64, "running\n");
                goto read_from_buf;
        }
@@ -600,14 +600,14 @@ static ssize_t debugfs_run_read(struct file *filp, char __user *ubuf,
                        break;
                if (pctx->status) {
-                        out_off += snprintf(buf + out_off, 1024 - out_off,
+                        out_off += scnprintf(buf + out_off, 1024 - out_off,
                                            "%d: error %d\n", i,
                                            pctx->status);
                        continue;
                }
                rate = div64_u64(pctx->copied, pctx->diff_us);
-                out_off += snprintf(buf + out_off, 1024 - out_off,
+                out_off += scnprintf(buf + out_off, 1024 - out_off,
                        "%d: copied %llu bytes in %llu usecs, %llu MBytes/s\n",
                        i, pctx->copied, pctx->diff_us, rate);
        }
diff --git a/drivers/ntb/test/ntb_pingpong.c b/drivers/ntb/test/ntb_pingpong.c
index 7d311799fca1..435861189d97 100644
--- a/drivers/ntb/test/ntb_pingpong.c
+++ b/drivers/ntb/test/ntb_pingpong.c
@@ -88,7 +88,7 @@ MODULE_PARM_DESC(delay_ms, "Milliseconds to delay the response to peer");
 static unsigned long db_init = 0x7;
 module_param(db_init, ulong, 0644);
-MODULE_PARM_DESC(delay_ms, "Initial doorbell bits to ring on the peer");
+MODULE_PARM_DESC(db_init, "Initial doorbell bits to ring on the peer");
 struct pp_ctx {
        struct ntb_dev                  *ntb;
diff --git a/drivers/nvdimm/Kconfig b/drivers/nvdimm/Kconfig
index 8b2b740d6679..124c2432ac9c 100644
--- a/drivers/nvdimm/Kconfig
+++ b/drivers/nvdimm/Kconfig
@@ -89,7 +89,7 @@ config NVDIMM_PFN
          Select Y if unsure
 config NVDIMM_DAX
-        tristate "NVDIMM DAX: Raw access to persistent memory"
+        bool "NVDIMM DAX: Raw access to persistent memory"
        default LIBNVDIMM
        depends on NVDIMM_PFN
        help
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index a8b6949a8778..23d4a1728cdf 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -715,7 +715,7 @@ EXPORT_SYMBOL_GPL(nd_cmd_in_size);
 u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
                const struct nd_cmd_desc *desc, int idx, const u32 *in_field,
-                const u32 *out_field)
+                const u32 *out_field, unsigned long remainder)
 {
        if (idx >= desc->out_num)
                return UINT_MAX;
@@ -727,9 +727,24 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
                return in_field[1];
        else if (nvdimm && cmd == ND_CMD_VENDOR && idx == 2)
                return out_field[1];
-        else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2)
+        else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2) {
-                return out_field[1] - 8;
+                /*
-        else if (cmd == ND_CMD_CALL) {
+                 * Per table 9-276 ARS Data in ACPI 6.1, out_field[1] is
+                 * "Size of Output Buffer in bytes, including this
+                 * field."
+                 */
+                if (out_field[1] < 4)
+                        return 0;
+                /*
+                 * ACPI 6.1 is ambiguous if 'status' is included in the
+                 * output size. If we encounter an output size that
+                 * overshoots the remainder by 4 bytes, assume it was
+                 * including 'status'.
+                 */
+                if (out_field[1] - 8 == remainder)
+                        return remainder;
+                return out_field[1] - 4;
+        } else if (cmd == ND_CMD_CALL) {
                struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field;
                return pkg->nd_size_out;
@@ -876,7 +891,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
        /* process an output envelope */
        for (i = 0; i < desc->out_num; i++) {
                u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i,
-                                (u32 *) in_env, (u32 *) out_env);
+                                (u32 *) in_env, (u32 *) out_env, 0);
                u32 copy;
                if (out_size == UINT_MAX) {
diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
index 3509cff68ef9..abe5c6bc756c 100644
--- a/drivers/nvdimm/namespace_devs.c
+++ b/drivers/nvdimm/namespace_devs.c
@@ -2176,12 +2176,14 @@ static struct device **scan_labels(struct nd_region *nd_region)
        return devs;
 err:
-        for (i = 0; devs[i]; i++)
+        if (devs) {
-                if (is_nd_blk(&nd_region->dev))
+                for (i = 0; devs[i]; i++)
-                        namespace_blk_release(devs[i]);
+                        if (is_nd_blk(&nd_region->dev))
-                else
+                                namespace_blk_release(devs[i]);
-                        namespace_pmem_release(devs[i]);
+                        else
-        kfree(devs);
+                                namespace_pmem_release(devs[i]);
+                kfree(devs);
+        }
        return NULL;
 }
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 42b3a8217073..24618431a14b 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -47,7 +47,7 @@ static struct nd_region *to_region(struct pmem_device *pmem)
        return to_nd_region(to_dev(pmem)->parent);
 }
-static void pmem_clear_poison(struct pmem_device *pmem, phys_addr_t offset,
+static int pmem_clear_poison(struct pmem_device *pmem, phys_addr_t offset,
                unsigned int len)
 {
        struct device *dev = to_dev(pmem);
@@ -62,8 +62,12 @@ static void pmem_clear_poison(struct pmem_device *pmem, phys_addr_t offset,
                                __func__, (unsigned long long) sector,
                                cleared / 512, cleared / 512 > 1 ? "s" : "");
                badblocks_clear(&pmem->bb, sector, cleared / 512);
+        } else {
+                return -EIO;
        }
        invalidate_pmem(pmem->virt_addr + offset, len);
+        return 0;
 }
 static void write_pmem(void *pmem_addr, struct page *page,
@@ -123,7 +127,7 @@ static int pmem_do_bvec(struct pmem_device *pmem, struct page *page,
                flush_dcache_page(page);
                write_pmem(pmem_addr, page, off, len);
                if (unlikely(bad_pmem)) {
-                        pmem_clear_poison(pmem, pmem_off, len);
+                        rc = pmem_clear_poison(pmem, pmem_off, len);
                        write_pmem(pmem_addr, page, off, len);
                }
        }
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 329381a28edf..79e679d12f3b 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -554,7 +554,7 @@ int nvme_identify_ctrl(struct nvme_ctrl *dev, struct nvme_id_ctrl **id)
        /* gcc-4.4.4 (at least) has issues with initializers and anon unions */
        c.identify.opcode = nvme_admin_identify;
-        c.identify.cns = cpu_to_le32(1);
+        c.identify.cns = cpu_to_le32(NVME_ID_CNS_CTRL);
        *id = kmalloc(sizeof(struct nvme_id_ctrl), GFP_KERNEL);
        if (!*id)
@@ -572,7 +572,7 @@ static int nvme_identify_ns_list(struct nvme_ctrl *dev, unsigned nsid, __le32 *n
        struct nvme_command c = { };
        c.identify.opcode = nvme_admin_identify;
-        c.identify.cns = cpu_to_le32(2);
+        c.identify.cns = cpu_to_le32(NVME_ID_CNS_NS_ACTIVE_LIST);
        c.identify.nsid = cpu_to_le32(nsid);
        return nvme_submit_sync_cmd(dev->admin_q, &c, ns_list, 0x1000);
 }
@@ -900,9 +900,9 @@ static int nvme_revalidate_ns(struct nvme_ns *ns, struct nvme_id_ns **id)
                return -ENODEV;
        }
-        if (ns->ctrl->vs >= NVME_VS(1, 1))
+        if (ns->ctrl->vs >= NVME_VS(1, 1, 0))
                memcpy(ns->eui, (*id)->eui64, sizeof(ns->eui));
-        if (ns->ctrl->vs >= NVME_VS(1, 2))
+        if (ns->ctrl->vs >= NVME_VS(1, 2, 0))
                memcpy(ns->uuid, (*id)->nguid, sizeof(ns->uuid));
        return 0;
@@ -1086,6 +1086,8 @@ static int nvme_wait_ready(struct nvme_ctrl *ctrl, u64 cap, bool enabled)
        int ret;
        while ((ret = ctrl->ops->reg_read32(ctrl, NVME_REG_CSTS, &csts)) == 0) {
+                if (csts == ~0)
+                        return -ENODEV;
                if ((csts & NVME_CSTS_RDY) == bit)
                        break;
@@ -1240,7 +1242,7 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
        }
        page_shift = NVME_CAP_MPSMIN(cap) + 12;
-        if (ctrl->vs >= NVME_VS(1, 1))
+        if (ctrl->vs >= NVME_VS(1, 1, 0))
                ctrl->subsystem = NVME_CAP_NSSRC(cap);
        ret = nvme_identify_ctrl(ctrl, &id);
@@ -1840,7 +1842,7 @@ static void nvme_scan_work(struct work_struct *work)
                return;
        nn = le32_to_cpu(id->nn);
-        if (ctrl->vs >= NVME_VS(1, 1) &&
+        if (ctrl->vs >= NVME_VS(1, 1, 0) &&
            !(ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS)) {
                if (!nvme_scan_ns_list(ctrl, nn))
                        goto done;
diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
index f5e3011e31fc..5daf2f4be0cd 100644
--- a/drivers/nvme/host/lightnvm.c
+++ b/drivers/nvme/host/lightnvm.c
@@ -612,7 +612,7 @@ int nvme_nvm_register(struct nvme_ns *ns, char *disk_name, int node,
        ret = nvm_register(dev);
-        ns->lba_shift = ilog2(dev->sec_size) - 9;
+        ns->lba_shift = ilog2(dev->sec_size);
        if (sysfs_create_group(&dev->dev.kobj, attrs))
                pr_warn("%s: failed to create sysfs group for identification\n",
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 0fc99f0f2571..5e52034ab010 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -99,6 +99,7 @@ struct nvme_dev {
        dma_addr_t cmb_dma_addr;
        u64 cmb_size;
        u32 cmbsz;
+        u32 cmbloc;
        struct nvme_ctrl ctrl;
        struct completion ioq_wait;
 };
@@ -893,7 +894,7 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
                         "I/O %d QID %d timeout, reset controller\n",
                         req->tag, nvmeq->qid);
                nvme_dev_disable(dev, false);
-                queue_work(nvme_workq, &dev->reset_work);
+                nvme_reset(dev);
                /*
                 * Mark the request as handled, since the inline shutdown
@@ -1214,7 +1215,7 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
        u64 cap = lo_hi_readq(dev->bar + NVME_REG_CAP);
        struct nvme_queue *nvmeq;
-        dev->subsystem = readl(dev->bar + NVME_REG_VS) >= NVME_VS(1, 1) ?
+        dev->subsystem = readl(dev->bar + NVME_REG_VS) >= NVME_VS(1, 1, 0) ?
                                                NVME_CAP_NSSRC(cap) : 0;
        if (dev->subsystem &&
@@ -1241,20 +1242,16 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
        result = nvme_enable_ctrl(&dev->ctrl, cap);
        if (result)
-                goto free_nvmeq;
+                return result;
        nvmeq->cq_vector = 0;
        result = queue_request_irq(nvmeq);
        if (result) {
                nvmeq->cq_vector = -1;
-                goto free_nvmeq;
+                return result;
        }
        return result;
- free_nvmeq:
-        nvme_free_queues(dev, 0);
-        return result;
 }
 static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
@@ -1291,7 +1288,7 @@ static void nvme_watchdog_timer(unsigned long data)
        /* Skip controllers under certain specific conditions. */
        if (nvme_should_reset(dev, csts)) {
-                if (queue_work(nvme_workq, &dev->reset_work))
+                if (!nvme_reset(dev))
                        dev_warn(dev->dev,
                                "Failed status: 0x%x, reset controller.\n",
                                csts);
@@ -1316,10 +1313,8 @@ static int nvme_create_io_queues(struct nvme_dev *dev)
        max = min(dev->max_qid, dev->queue_count - 1);
        for (i = dev->online_queues; i <= max; i++) {
                ret = nvme_create_queue(dev->queues[i], i);
-                if (ret) {
+                if (ret)
-                        nvme_free_queues(dev, i);
                        break;
-                }
        }
        /*
@@ -1331,28 +1326,37 @@ static int nvme_create_io_queues(struct nvme_dev *dev)
        return ret >= 0 ? 0 : ret;
 }
+static ssize_t nvme_cmb_show(struct device *dev,
+                             struct device_attribute *attr,
+                             char *buf)
+{
+        struct nvme_dev *ndev = to_nvme_dev(dev_get_drvdata(dev));
+        return snprintf(buf, PAGE_SIZE, "cmbloc : x%08x\ncmbsz  : x%08x\n",
+                       ndev->cmbloc, ndev->cmbsz);
+}
+static DEVICE_ATTR(cmb, S_IRUGO, nvme_cmb_show, NULL);
 static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
 {
        u64 szu, size, offset;
-        u32 cmbloc;
        resource_size_t bar_size;
        struct pci_dev *pdev = to_pci_dev(dev->dev);
        void __iomem *cmb;
        dma_addr_t dma_addr;
-        if (!use_cmb_sqes)
-                return NULL;
        dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ);
        if (!(NVME_CMB_SZ(dev->cmbsz)))
                return NULL;
+        dev->cmbloc = readl(dev->bar + NVME_REG_CMBLOC);
-        cmbloc = readl(dev->bar + NVME_REG_CMBLOC);
+        if (!use_cmb_sqes)
+                return NULL;
        szu = (u64)1 << (12 + 4 * NVME_CMB_SZU(dev->cmbsz));
        size = szu * NVME_CMB_SZ(dev->cmbsz);
-        offset = szu * NVME_CMB_OFST(cmbloc);
+        offset = szu * NVME_CMB_OFST(dev->cmbloc);
-        bar_size = pci_resource_len(pdev, NVME_CMB_BIR(cmbloc));
+        bar_size = pci_resource_len(pdev, NVME_CMB_BIR(dev->cmbloc));
        if (offset > bar_size)
                return NULL;
@@ -1365,7 +1369,7 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
        if (size > bar_size - offset)
                size = bar_size - offset;
-        dma_addr = pci_resource_start(pdev, NVME_CMB_BIR(cmbloc)) + offset;
+        dma_addr = pci_resource_start(pdev, NVME_CMB_BIR(dev->cmbloc)) + offset;
        cmb = ioremap_wc(dma_addr, size);
        if (!cmb)
                return NULL;
@@ -1450,13 +1454,9 @@ static int nvme_setup_io_queues(struct nvme_dev *dev)
        result = queue_request_irq(adminq);
        if (result) {
                adminq->cq_vector = -1;
-                goto free_queues;
+                return result;
        }
        return nvme_create_io_queues(dev);
- free_queues:
-        nvme_free_queues(dev, 1);
-        return result;
 }
 static void nvme_del_queue_end(struct request *req, int error)
@@ -1511,9 +1511,9 @@ static int nvme_delete_queue(struct nvme_queue *nvmeq, u8 opcode)
        return 0;
 }
-static void nvme_disable_io_queues(struct nvme_dev *dev)
+static void nvme_disable_io_queues(struct nvme_dev *dev, int queues)
 {
-        int pass, queues = dev->online_queues - 1;
+        int pass;
        unsigned long timeout;
        u8 opcode = nvme_admin_delete_sq;
@@ -1616,9 +1616,25 @@ static int nvme_pci_enable(struct nvme_dev *dev)
                        dev->q_depth);
        }
-        if (readl(dev->bar + NVME_REG_VS) >= NVME_VS(1, 2))
+        /*
+         * CMBs can currently only exist on >=1.2 PCIe devices. We only
+         * populate sysfs if a CMB is implemented. Note that we add the
+         * CMB attribute to the nvme_ctrl kobj which removes the need to remove
+         * it on exit. Since nvme_dev_attrs_group has no name we can pass
+         * NULL as final argument to sysfs_add_file_to_group.
+         */
+        if (readl(dev->bar + NVME_REG_VS) >= NVME_VS(1, 2, 0)) {
                dev->cmb = nvme_map_cmb(dev);
+                if (dev->cmbsz) {
+                        if (sysfs_add_file_to_group(&dev->ctrl.device->kobj,
+                                                    &dev_attr_cmb.attr, NULL))
+                                dev_warn(dev->dev,
+                                         "failed to add sysfs attribute for CMB\n");
+                }
+        }
        pci_enable_pcie_error_reporting(pdev);
        pci_save_state(pdev);
        return 0;
@@ -1649,7 +1665,7 @@ static void nvme_pci_disable(struct nvme_dev *dev)
 static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
 {
-        int i;
+        int i, queues;
        u32 csts = -1;
        del_timer_sync(&dev->watchdog_timer);
@@ -1660,6 +1676,7 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
                csts = readl(dev->bar + NVME_REG_CSTS);
        }
+        queues = dev->online_queues - 1;
        for (i = dev->queue_count - 1; i > 0; i--)
                nvme_suspend_queue(dev->queues[i]);
@@ -1671,7 +1688,7 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
                if (dev->queue_count)
                        nvme_suspend_queue(dev->queues[0]);
        } else {
-                nvme_disable_io_queues(dev);
+                nvme_disable_io_queues(dev, queues);
                nvme_disable_admin_queue(dev, shutdown);
        }
        nvme_pci_disable(dev);
@@ -1818,11 +1835,10 @@ static int nvme_reset(struct nvme_dev *dev)
 {
        if (!dev->ctrl.admin_q || blk_queue_dying(dev->ctrl.admin_q))
                return -ENODEV;
+        if (work_busy(&dev->reset_work))
+                return -ENODEV;
        if (!queue_work(nvme_workq, &dev->reset_work))
                return -EBUSY;
-        flush_work(&dev->reset_work);
        return 0;
 }
@@ -1846,7 +1862,12 @@ static int nvme_pci_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val)
 static int nvme_pci_reset_ctrl(struct nvme_ctrl *ctrl)
 {
-        return nvme_reset(to_nvme_dev(ctrl));
+        struct nvme_dev *dev = to_nvme_dev(ctrl);
+        int ret = nvme_reset(dev);
+        if (!ret)
+                flush_work(&dev->reset_work);
+        return ret;
 }
 static const struct nvme_ctrl_ops nvme_pci_ctrl_ops = {
@@ -1940,7 +1961,7 @@ static void nvme_reset_notify(struct pci_dev *pdev, bool prepare)
        if (prepare)
                nvme_dev_disable(dev, false);
        else
-                queue_work(nvme_workq, &dev->reset_work);
+                nvme_reset(dev);
 }
 static void nvme_shutdown(struct pci_dev *pdev)
@@ -2009,7 +2030,7 @@ static int nvme_resume(struct device *dev)
        struct pci_dev *pdev = to_pci_dev(dev);
        struct nvme_dev *ndev = pci_get_drvdata(pdev);
-        queue_work(nvme_workq, &ndev->reset_work);
+        nvme_reset(ndev);
        return 0;
 }
 #endif
@@ -2048,7 +2069,7 @@ static pci_ers_result_t nvme_slot_reset(struct pci_dev *pdev)
        dev_info(dev->ctrl.device, "restart after slot reset\n");
        pci_restore_state(pdev);
-        queue_work(nvme_workq, &dev->reset_work);
+        nvme_reset(dev);
        return PCI_ERS_RESULT_RECOVERED;
 }
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 5a8388177959..3d25add36d91 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -83,6 +83,7 @@ enum nvme_rdma_queue_flags {
        NVME_RDMA_Q_CONNECTED = (1 << 0),
        NVME_RDMA_IB_QUEUE_ALLOCATED = (1 << 1),
        NVME_RDMA_Q_DELETING = (1 << 2),
+        NVME_RDMA_Q_LIVE = (1 << 3),
 };
 struct nvme_rdma_queue {
@@ -624,10 +625,18 @@ static int nvme_rdma_connect_io_queues(struct nvme_rdma_ctrl *ctrl)
        for (i = 1; i < ctrl->queue_count; i++) {
                ret = nvmf_connect_io_queue(&ctrl->ctrl, i);
-                if (ret)
+                if (ret) {
-                        break;
+                        dev_info(ctrl->ctrl.device,
+                                "failed to connect i/o queue: %d\n", ret);
+                        goto out_free_queues;
+                }
+                set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[i].flags);
        }
+        return 0;
+out_free_queues:
+        nvme_rdma_free_io_queues(ctrl);
        return ret;
 }
@@ -712,6 +721,8 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
        if (ret)
                goto stop_admin_q;
+        set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[0].flags);
        ret = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
        if (ret)
                goto stop_admin_q;
@@ -761,8 +772,10 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
        nvme_stop_keep_alive(&ctrl->ctrl);
-        for (i = 0; i < ctrl->queue_count; i++)
+        for (i = 0; i < ctrl->queue_count; i++) {
                clear_bit(NVME_RDMA_Q_CONNECTED, &ctrl->queues[i].flags);
+                clear_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[i].flags);
+        }
        if (ctrl->queue_count > 1)
                nvme_stop_queues(&ctrl->ctrl);
@@ -1378,6 +1391,24 @@ nvme_rdma_timeout(struct request *rq, bool reserved)
        return BLK_EH_HANDLED;
 }
+/*
+ * We cannot accept any other command until the Connect command has completed.
+ */
+static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
+                struct request *rq)
+{
+        if (unlikely(!test_bit(NVME_RDMA_Q_LIVE, &queue->flags))) {
+                struct nvme_command *cmd = (struct nvme_command *)rq->cmd;
+                if (rq->cmd_type != REQ_TYPE_DRV_PRIV ||
+                    cmd->common.opcode != nvme_fabrics_command ||
+                    cmd->fabrics.fctype != nvme_fabrics_type_connect)
+                        return false;
+        }
+        return true;
+}
 static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
                const struct blk_mq_queue_data *bd)
 {
@@ -1394,6 +1425,9 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
        WARN_ON_ONCE(rq->tag < 0);
+        if (!nvme_rdma_queue_is_ready(queue, rq))
+                return BLK_MQ_RQ_QUEUE_BUSY;
        dev = queue->device->dev;
        ib_dma_sync_single_for_cpu(dev, sqe->dma,
                        sizeof(struct nvme_command), DMA_TO_DEVICE);
@@ -1544,6 +1578,8 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl)
        if (error)
                goto out_cleanup_queue;
+        set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[0].flags);
        error = nvmf_reg_read64(&ctrl->ctrl, NVME_REG_CAP, &ctrl->cap);
        if (error) {
                dev_err(ctrl->ctrl.device,
diff --git a/drivers/nvme/host/scsi.c b/drivers/nvme/host/scsi.c
index c2a0a1c7d05d..3eaa4d27801e 100644
--- a/drivers/nvme/host/scsi.c
+++ b/drivers/nvme/host/scsi.c
@@ -606,7 +606,7 @@ static int nvme_fill_device_id_eui64(struct nvme_ns *ns, struct sg_io_hdr *hdr,
        eui = id_ns->eui64;
        len = sizeof(id_ns->eui64);
-        if (ns->ctrl->vs >= NVME_VS(1, 2)) {
+        if (ns->ctrl->vs >= NVME_VS(1, 2, 0)) {
                if (bitmap_empty(eui, len * 8)) {
                        eui = id_ns->nguid;
                        len = sizeof(id_ns->nguid);
@@ -679,7 +679,7 @@ static int nvme_trans_device_id_page(struct nvme_ns *ns, struct sg_io_hdr *hdr,
 {
        int res;
-        if (ns->ctrl->vs >= NVME_VS(1, 1)) {
+        if (ns->ctrl->vs >= NVME_VS(1, 1, 0)) {
                res = nvme_fill_device_id_eui64(ns, hdr, resp, alloc_len);
                if (res != -EOPNOTSUPP)
                        return res;
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 7ab9c9381b98..6fe4c48a21e4 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -199,7 +199,7 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
         */
        /* we support multiple ports and multiples hosts: */
-        id->mic = (1 << 0) | (1 << 1);
+        id->cmic = (1 << 0) | (1 << 1);
        /* no limit on data transfer sizes for now */
        id->mdts = 0;
@@ -511,13 +511,13 @@ int nvmet_parse_admin_cmd(struct nvmet_req *req)
        case nvme_admin_identify:
                req->data_len = 4096;
                switch (le32_to_cpu(cmd->identify.cns)) {
-                case 0x00:
+                case NVME_ID_CNS_NS:
                        req->execute = nvmet_execute_identify_ns;
                        return 0;
-                case 0x01:
+                case NVME_ID_CNS_CTRL:
                        req->execute = nvmet_execute_identify_ctrl;
                        return 0;
-                case 0x02:
+                case NVME_ID_CNS_NS_ACTIVE_LIST:
                        req->execute = nvmet_execute_identify_nslist;
                        return 0;
                }
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 6559d5afa7bf..a21437a33adb 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -838,9 +838,13 @@ static void nvmet_fatal_error_handler(struct work_struct *work)
 void nvmet_ctrl_fatal_error(struct nvmet_ctrl *ctrl)
 {
-        ctrl->csts |= NVME_CSTS_CFS;
+        mutex_lock(&ctrl->lock);
-        INIT_WORK(&ctrl->fatal_err_work, nvmet_fatal_error_handler);
+        if (!(ctrl->csts & NVME_CSTS_CFS)) {
-        schedule_work(&ctrl->fatal_err_work);
+                ctrl->csts |= NVME_CSTS_CFS;
+                INIT_WORK(&ctrl->fatal_err_work, nvmet_fatal_error_handler);
+                schedule_work(&ctrl->fatal_err_work);
+        }
+        mutex_unlock(&ctrl->lock);
 }
 EXPORT_SYMBOL_GPL(nvmet_ctrl_fatal_error);
@@ -882,7 +886,7 @@ struct nvmet_subsys *nvmet_subsys_alloc(const char *subsysnqn,
        if (!subsys)
                return NULL;
-        subsys->ver = (1 << 16) | (2 << 8) | 1; /* NVMe 1.2.1 */
+        subsys->ver = NVME_VS(1, 2, 1); /* NVMe 1.2.1 */
        switch (type) {
        case NVME_NQN_NVME:
diff --git a/drivers/nvme/target/discovery.c b/drivers/nvme/target/discovery.c
index 6f65646e89cf..12f39eea569f 100644
--- a/drivers/nvme/target/discovery.c
+++ b/drivers/nvme/target/discovery.c
@@ -54,7 +54,7 @@ static void nvmet_format_discovery_entry(struct nvmf_disc_rsp_page_hdr *hdr,
        /* we support only dynamic controllers */
        e->cntlid = cpu_to_le16(NVME_CNTLID_DYNAMIC);
        e->asqsz = cpu_to_le16(NVMF_AQ_DEPTH);
-        e->nqntype = type;
+        e->subtype = type;
        memcpy(e->trsvcid, port->disc_addr.trsvcid, NVMF_TRSVCID_SIZE);
        memcpy(e->traddr, port->disc_addr.traddr, NVMF_TRADDR_SIZE);
        memcpy(e->tsas.common, port->disc_addr.tsas.common, NVMF_TSAS_SIZE);
@@ -187,7 +187,7 @@ int nvmet_parse_discovery_cmd(struct nvmet_req *req)
        case nvme_admin_identify:
                req->data_len = 4096;
                switch (le32_to_cpu(cmd->identify.cns)) {
-                case 0x01:
+                case NVME_ID_CNS_CTRL:
                        req->execute =
                                nvmet_execute_identify_disc_ctrl;
                        return 0;
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index f8d23999e0f2..005ef5d17a19 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -951,6 +951,7 @@ err_destroy_cq:
 static void nvmet_rdma_destroy_queue_ib(struct nvmet_rdma_queue *queue)
 {
+        ib_drain_qp(queue->cm_id->qp);
        rdma_destroy_qp(queue->cm_id);
        ib_free_cq(queue->cq);
 }
@@ -1066,6 +1067,7 @@ nvmet_rdma_alloc_queue(struct nvmet_rdma_device *ndev,
        spin_lock_init(&queue->rsp_wr_wait_lock);
        INIT_LIST_HEAD(&queue->free_rsps);
        spin_lock_init(&queue->rsps_lock);
+        INIT_LIST_HEAD(&queue->queue_list);
        queue->idx = ida_simple_get(&nvmet_rdma_queue_ida, 0, 0, GFP_KERNEL);
        if (queue->idx < 0) {
@@ -1244,7 +1246,6 @@ static void __nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue)
        if (disconnect) {
                rdma_disconnect(queue->cm_id);
-                ib_drain_qp(queue->cm_id->qp);
                schedule_work(&queue->release_work);
        }
 }
@@ -1269,7 +1270,12 @@ static void nvmet_rdma_queue_connect_fail(struct rdma_cm_id *cm_id,
 {
        WARN_ON_ONCE(queue->state != NVMET_RDMA_Q_CONNECTING);
-        pr_err("failed to connect queue\n");
+        mutex_lock(&nvmet_rdma_queue_mutex);
+        if (!list_empty(&queue->queue_list))
+                list_del_init(&queue->queue_list);
+        mutex_unlock(&nvmet_rdma_queue_mutex);
+        pr_err("failed to connect queue %d\n", queue->idx);
        schedule_work(&queue->release_work);
 }
@@ -1352,7 +1358,13 @@ static int nvmet_rdma_cm_handler(struct rdma_cm_id *cm_id,
        case RDMA_CM_EVENT_ADDR_CHANGE:
        case RDMA_CM_EVENT_DISCONNECTED:
        case RDMA_CM_EVENT_TIMEWAIT_EXIT:
-                nvmet_rdma_queue_disconnect(queue);
+                /*
+                 * We might end up here when we already freed the qp
+                 * which means queue release sequence is in progress,
+                 * so don't get in the way...
+                 */
+                if (queue)
+                        nvmet_rdma_queue_disconnect(queue);
                break;
        case RDMA_CM_EVENT_DEVICE_REMOVAL:
                ret = nvmet_rdma_device_removal(cm_id, queue);
diff --git a/drivers/of/base.c b/drivers/of/base.c
index d687e6de24a0..a0bccb54a9bd 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -2077,8 +2077,6 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
                        name = of_get_property(of_aliases, "stdout", NULL);
                if (name)
                        of_stdout = of_find_node_opts_by_path(name, &of_stdout_options);
-                if (of_stdout)
-                        console_set_by_of();
        }
        if (!of_aliases)
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index b470f7e3521d..262281bd68fa 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -292,6 +292,7 @@ struct phy_device *of_phy_find_device(struct device_node *phy_np)
                mdiodev = to_mdio_device(d);
                if (mdiodev->flags & MDIO_DEVICE_FLAG_PHY)
                        return to_phy_device(d);
+                put_device(d);
        }
        return NULL;
@@ -456,8 +457,11 @@ int of_phy_register_fixed_link(struct device_node *np)
                status.link = 1;
                status.duplex = of_property_read_bool(fixed_link_node,
                                                      "full-duplex");
-                if (of_property_read_u32(fixed_link_node, "speed", &status.speed))
+                if (of_property_read_u32(fixed_link_node, "speed",
+                                         &status.speed)) {
+                        of_node_put(fixed_link_node);
                        return -EINVAL;
+                }
                status.pause = of_property_read_bool(fixed_link_node, "pause");
                status.asym_pause = of_property_read_bool(fixed_link_node,
                                                          "asym-pause");
@@ -486,3 +490,18 @@ int of_phy_register_fixed_link(struct device_node *np)
        return -ENODEV;
 }
 EXPORT_SYMBOL(of_phy_register_fixed_link);
+void of_phy_deregister_fixed_link(struct device_node *np)
+{
+        struct phy_device *phydev;
+        phydev = of_phy_find_device(np);
+        if (!phydev)
+                return;
+        fixed_phy_unregister(phydev);
+        put_device(&phydev->mdio.dev);  /* of_phy_find_device() */
+        phy_device_free(phydev);        /* fixed_phy_register() */
+}
+EXPORT_SYMBOL(of_phy_deregister_fixed_link);
diff --git a/drivers/pci/host/pci-layerscape.c b/drivers/pci/host/pci-layerscape.c
index 2cb7315e26d0..653707996342 100644
--- a/drivers/pci/host/pci-layerscape.c
+++ b/drivers/pci/host/pci-layerscape.c
@@ -247,6 +247,7 @@ static int __init ls_pcie_probe(struct platform_device *pdev)
        pp = &pcie->pp;
        pp->dev = dev;
+        pcie->drvdata = match->data;
        pp->ops = pcie->drvdata->ops;
        dbi_base = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs");
@@ -256,7 +257,6 @@ static int __init ls_pcie_probe(struct platform_device *pdev)
                return PTR_ERR(pcie->pp.dbi_base);
        }
-        pcie->drvdata = match->data;
        pcie->lut = pcie->pp.dbi_base + pcie->drvdata->lut_offset;
        if (!ls_pcie_is_bridge(pcie))
diff --git a/drivers/pci/host/pcie-designware-plat.c b/drivers/pci/host/pcie-designware-plat.c
index 537f58a664fa..1a02038c4640 100644
--- a/drivers/pci/host/pcie-designware-plat.c
+++ b/drivers/pci/host/pcie-designware-plat.c
@@ -3,7 +3,7 @@
 *
 * Copyright (C) 2015-2016 Synopsys, Inc. (www.synopsys.com)
 *
- * Authors: Joao Pinto <jpinto@synopsys.com>
+ * Authors: Joao Pinto <Joao.Pinto@synopsys.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
index 035f50c03281..bed19994c1e9 100644
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -637,8 +637,6 @@ int dw_pcie_host_init(struct pcie_port *pp)
                }
        }
-        pp->iatu_unroll_enabled = dw_pcie_iatu_unroll_enabled(pp);
        if (pp->ops->host_init)
                pp->ops->host_init(pp);
@@ -809,6 +807,11 @@ void dw_pcie_setup_rc(struct pcie_port *pp)
 {
        u32 val;
+        /* get iATU unroll support */
+        pp->iatu_unroll_enabled = dw_pcie_iatu_unroll_enabled(pp);
+        dev_dbg(pp->dev, "iATU unroll: %s\n",
+                pp->iatu_unroll_enabled ? "enabled" : "disabled");
        /* set the number of lanes */
        val = dw_pcie_readl_rc(pp, PCIE_PORT_LINK_CONTROL);
        val &= ~PORT_LINK_MODE_MASK;
diff --git a/drivers/pci/host/pcie-qcom.c b/drivers/pci/host/pcie-qcom.c
index ef0a84c7a588..35936409b2d4 100644
--- a/drivers/pci/host/pcie-qcom.c
+++ b/drivers/pci/host/pcie-qcom.c
@@ -533,11 +533,11 @@ static int qcom_pcie_probe(struct platform_device *pdev)
        if (IS_ERR(pcie->phy))
                return PTR_ERR(pcie->phy);
+        pp->dev = dev;
        ret = pcie->ops->get_resources(pcie);
        if (ret)
                return ret;
-        pp->dev = dev;
        pp->root_bus_nr = -1;
        pp->ops = &qcom_pcie_dw_ops;
diff --git a/drivers/pci/host/pcie-rockchip.c b/drivers/pci/host/pcie-rockchip.c
index e0b22dab9b7a..e04f69beb42d 100644
--- a/drivers/pci/host/pcie-rockchip.c
+++ b/drivers/pci/host/pcie-rockchip.c
@@ -190,6 +190,9 @@ struct rockchip_pcie {
        struct  reset_control *mgmt_rst;
        struct  reset_control *mgmt_sticky_rst;
        struct  reset_control *pipe_rst;
+        struct  reset_control *pm_rst;
+        struct  reset_control *aclk_rst;
+        struct  reset_control *pclk_rst;
        struct  clk *aclk_pcie;
        struct  clk *aclk_perf_pcie;
        struct  clk *hclk_pcie;
@@ -408,6 +411,44 @@ static int rockchip_pcie_init_port(struct rockchip_pcie *rockchip)
        gpiod_set_value(rockchip->ep_gpio, 0);
+        err = reset_control_assert(rockchip->aclk_rst);
+        if (err) {
+                dev_err(dev, "assert aclk_rst err %d\n", err);
+                return err;
+        }
+        err = reset_control_assert(rockchip->pclk_rst);
+        if (err) {
+                dev_err(dev, "assert pclk_rst err %d\n", err);
+                return err;
+        }
+        err = reset_control_assert(rockchip->pm_rst);
+        if (err) {
+                dev_err(dev, "assert pm_rst err %d\n", err);
+                return err;
+        }
+        udelay(10);
+        err = reset_control_deassert(rockchip->pm_rst);
+        if (err) {
+                dev_err(dev, "deassert pm_rst err %d\n", err);
+                return err;
+        }
+        err = reset_control_deassert(rockchip->aclk_rst);
+        if (err) {
+                dev_err(dev, "deassert mgmt_sticky_rst err %d\n", err);
+                return err;
+        }
+        err = reset_control_deassert(rockchip->pclk_rst);
+        if (err) {
+                dev_err(dev, "deassert mgmt_sticky_rst err %d\n", err);
+                return err;
+        }
        err = phy_init(rockchip->phy);
        if (err < 0) {
                dev_err(dev, "fail to init phy, err %d\n", err);
@@ -781,6 +822,27 @@ static int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip)
                return PTR_ERR(rockchip->pipe_rst);
        }
+        rockchip->pm_rst = devm_reset_control_get(dev, "pm");
+        if (IS_ERR(rockchip->pm_rst)) {
+                if (PTR_ERR(rockchip->pm_rst) != -EPROBE_DEFER)
+                        dev_err(dev, "missing pm reset property in node\n");
+                return PTR_ERR(rockchip->pm_rst);
+        }
+        rockchip->pclk_rst = devm_reset_control_get(dev, "pclk");
+        if (IS_ERR(rockchip->pclk_rst)) {
+                if (PTR_ERR(rockchip->pclk_rst) != -EPROBE_DEFER)
+                        dev_err(dev, "missing pclk reset property in node\n");
+                return PTR_ERR(rockchip->pclk_rst);
+        }
+        rockchip->aclk_rst = devm_reset_control_get(dev, "aclk");
+        if (IS_ERR(rockchip->aclk_rst)) {
+                if (PTR_ERR(rockchip->aclk_rst) != -EPROBE_DEFER)
+                        dev_err(dev, "missing aclk reset property in node\n");
+                return PTR_ERR(rockchip->aclk_rst);
+        }
        rockchip->ep_gpio = devm_gpiod_get(dev, "ep", GPIOD_OUT_HIGH);
        if (IS_ERR(rockchip->ep_gpio)) {
                dev_err(dev, "missing ep-gpios property in node\n");
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index bfdd0744b686..ad70507cfb56 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -610,6 +610,7 @@ static int msi_verify_entries(struct pci_dev *dev)
 * msi_capability_init - configure device's MSI capability structure
 * @dev: pointer to the pci_dev data structure of MSI device function
 * @nvec: number of interrupts to allocate
+ * @affinity: flag to indicate cpu irq affinity mask should be set
 *
 * Setup the MSI capability structure of the device with the requested
 * number of interrupts.  A return value of zero indicates the successful
@@ -752,6 +753,7 @@ static void msix_program_entries(struct pci_dev *dev,
 * @dev: pointer to the pci_dev data structure of MSI-X device function
 * @entries: pointer to an array of struct msix_entry entries
 * @nvec: number of @entries
+ * @affinity: flag to indicate cpu irq affinity mask should be set
 *
 * Setup the MSI-X capability structure of device function with a
 * single MSI-X irq. A return of zero indicates the successful setup of
diff --git a/drivers/pci/pci-mid.c b/drivers/pci/pci-mid.c
index 55f453de562e..c7f3408e3148 100644
--- a/drivers/pci/pci-mid.c
+++ b/drivers/pci/pci-mid.c
@@ -29,6 +29,11 @@ static int mid_pci_set_power_state(struct pci_dev *pdev, pci_power_t state)
        return intel_mid_pci_set_power_state(pdev, state);
 }
+static pci_power_t mid_pci_get_power_state(struct pci_dev *pdev)
+{
+        return intel_mid_pci_get_power_state(pdev);
+}
 static pci_power_t mid_pci_choose_state(struct pci_dev *pdev)
 {
        return PCI_D3hot;
@@ -52,6 +57,7 @@ static bool mid_pci_need_resume(struct pci_dev *dev)
 static struct pci_platform_pm_ops mid_pci_platform_pm = {
        .is_manageable  = mid_pci_power_manageable,
        .set_state      = mid_pci_set_power_state,
+        .get_state      = mid_pci_get_power_state,
        .choose_state   = mid_pci_choose_state,
        .sleep_wake     = mid_pci_sleep_wake,
        .run_wake       = mid_pci_run_wake,
diff --git a/drivers/pci/pcie/aer/aer_inject.c b/drivers/pci/pcie/aer/aer_inject.c
index db553dc22c8e..2b6a59266689 100644
--- a/drivers/pci/pcie/aer/aer_inject.c
+++ b/drivers/pci/pcie/aer/aer_inject.c
@@ -307,20 +307,6 @@ out:
        return 0;
 }
-static struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
-{
-        while (1) {
-                if (!pci_is_pcie(dev))
-                        break;
-                if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
-                        return dev;
-                if (!dev->bus->self)
-                        break;
-                dev = dev->bus->self;
-        }
-        return NULL;
-}
 static int find_aer_device_iter(struct device *device, void *data)
 {
        struct pcie_device **result = data;
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index ab002671fa60..104c46d53121 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1439,6 +1439,21 @@ static void program_hpp_type1(struct pci_dev *dev, struct hpp_type1 *hpp)
                dev_warn(&dev->dev, "PCI-X settings not supported\n");
 }
+static bool pcie_root_rcb_set(struct pci_dev *dev)
+{
+        struct pci_dev *rp = pcie_find_root_port(dev);
+        u16 lnkctl;
+        if (!rp)
+                return false;
+        pcie_capability_read_word(rp, PCI_EXP_LNKCTL, &lnkctl);
+        if (lnkctl & PCI_EXP_LNKCTL_RCB)
+                return true;
+        return false;
+}
 static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
 {
        int pos;
@@ -1468,9 +1483,20 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
                        ~hpp->pci_exp_devctl_and, hpp->pci_exp_devctl_or);
        /* Initialize Link Control Register */
-        if (pcie_cap_has_lnkctl(dev))
+        if (pcie_cap_has_lnkctl(dev)) {
+                /*
+                 * If the Root Port supports Read Completion Boundary of
+                 * 128, set RCB to 128.  Otherwise, clear it.
+                 */
+                hpp->pci_exp_lnkctl_and |= PCI_EXP_LNKCTL_RCB;
+                hpp->pci_exp_lnkctl_or &= ~PCI_EXP_LNKCTL_RCB;
+                if (pcie_root_rcb_set(dev))
+                        hpp->pci_exp_lnkctl_or |= PCI_EXP_LNKCTL_RCB;
                pcie_capability_clear_and_set_word(dev, PCI_EXP_LNKCTL,
                        ~hpp->pci_exp_lnkctl_and, hpp->pci_exp_lnkctl_or);
+        }
        /* Find Advanced Error Reporting Enhanced Capability */
        pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 66c4d8f42233..9526e341988b 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -121,6 +121,14 @@ int pci_claim_resource(struct pci_dev *dev, int resource)
                return -EINVAL;
        }
+        /*
+         * If we have a shadow copy in RAM, the PCI device doesn't respond
+         * to the shadow range, so we don't need to claim it, and upstream
+         * bridges don't need to route the range to the device.
+         */
+        if (res->flags & IORESOURCE_ROM_SHADOW)
+                return 0;
        root = pci_find_parent_resource(dev, res);
        if (!root) {
                dev_info(&dev->dev, "can't claim BAR %d %pR: no compatible bridge window\n",
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index 153f3122283d..b6b316de055c 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -107,7 +107,7 @@ int soc_pcmcia_regulator_set(struct soc_pcmcia_socket *skt,
                ret = regulator_enable(r->reg);
        } else {
-                regulator_disable(r->reg);
+                ret = regulator_disable(r->reg);
        }
        if (ret == 0)
                r->on = on;
diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
index c2ac7646b99f..a8ac4bcef2c0 100644
--- a/drivers/perf/xgene_pmu.c
+++ b/drivers/perf/xgene_pmu.c
@@ -1011,7 +1011,7 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu,
        rc = acpi_dev_get_resources(adev, &resource_list,
                                    acpi_pmu_dev_add_resource, &res);
        acpi_dev_free_resource_list(&resource_list);
-        if (rc < 0 || IS_ERR(&res)) {
+        if (rc < 0) {
                dev_err(dev, "PMU type %d: No resource address found\n", type);
                goto err;
        }
diff --git a/drivers/phy/phy-da8xx-usb.c b/drivers/phy/phy-da8xx-usb.c
index 32ae78c8ca17..c85fb0b59729 100644
--- a/drivers/phy/phy-da8xx-usb.c
+++ b/drivers/phy/phy-da8xx-usb.c
@@ -198,7 +198,8 @@ static int da8xx_usb_phy_probe(struct platform_device *pdev)
        } else {
                int ret;
-                ret = phy_create_lookup(d_phy->usb11_phy, "usb-phy", "ohci.0");
+                ret = phy_create_lookup(d_phy->usb11_phy, "usb-phy",
+                                        "ohci-da8xx");
                if (ret)
                        dev_warn(dev, "Failed to create usb11 phy lookup\n");
                ret = phy_create_lookup(d_phy->usb20_phy, "usb-phy",
@@ -216,7 +217,7 @@ static int da8xx_usb_phy_remove(struct platform_device *pdev)
        if (!pdev->dev.of_node) {
                phy_remove_lookup(d_phy->usb20_phy, "usb-phy", "musb-da8xx");
-                phy_remove_lookup(d_phy->usb11_phy, "usb-phy", "ohci.0");
+                phy_remove_lookup(d_phy->usb11_phy, "usb-phy", "ohci-da8xx");
        }
        return 0;
diff --git a/drivers/phy/phy-rockchip-pcie.c b/drivers/phy/phy-rockchip-pcie.c
index a2b4c6b58aea..6904633cad68 100644
--- a/drivers/phy/phy-rockchip-pcie.c
+++ b/drivers/phy/phy-rockchip-pcie.c
@@ -249,21 +249,10 @@ err_refclk:
 static int rockchip_pcie_phy_exit(struct phy *phy)
 {
        struct rockchip_pcie_phy *rk_phy = phy_get_drvdata(phy);
-        int err = 0;
        clk_disable_unprepare(rk_phy->clk_pciephy_ref);
-        err = reset_control_deassert(rk_phy->phy_rst);
+        return 0;
-        if (err) {
-                dev_err(&phy->dev, "deassert phy_rst err %d\n", err);
-                goto err_reset;
-        }
-        return err;
-err_reset:
-        clk_prepare_enable(rk_phy->clk_pciephy_ref);
-        return err;
 }
 static const struct phy_ops ops = {
diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
index b9342a2af7b3..fec34f5213c4 100644
--- a/drivers/phy/phy-sun4i-usb.c
+++ b/drivers/phy/phy-sun4i-usb.c
@@ -264,7 +264,7 @@ static int sun4i_usb_phy_init(struct phy *_phy)
                return ret;
        }
-        if (data->cfg->enable_pmu_unk1) {
+        if (phy->pmu && data->cfg->enable_pmu_unk1) {
                val = readl(phy->pmu + REG_PMU_UNK1);
                writel(val & ~2, phy->pmu + REG_PMU_UNK1);
        }
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index 87e6334eab93..547ca7b3f098 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -459,8 +459,6 @@ static int twl4030_phy_power_off(struct phy *phy)
        struct twl4030_usb *twl = phy_get_drvdata(phy);
        dev_dbg(twl->dev, "%s\n", __func__);
-        pm_runtime_mark_last_busy(twl->dev);
-        pm_runtime_put_autosuspend(twl->dev);
        return 0;
 }
@@ -472,6 +470,8 @@ static int twl4030_phy_power_on(struct phy *phy)
        dev_dbg(twl->dev, "%s\n", __func__);
        pm_runtime_get_sync(twl->dev);
        schedule_delayed_work(&twl->id_workaround_work, HZ);
+        pm_runtime_mark_last_busy(twl->dev);
+        pm_runtime_put_autosuspend(twl->dev);
        return 0;
 }
diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed-g5.c b/drivers/pinctrl/aspeed/pinctrl-aspeed-g5.c
index e1ab864e1a7f..87b46390b695 100644
--- a/drivers/pinctrl/aspeed/pinctrl-aspeed-g5.c
+++ b/drivers/pinctrl/aspeed/pinctrl-aspeed-g5.c
@@ -26,7 +26,7 @@
 #define ASPEED_G5_NR_PINS 228
-#define COND1           SIG_DESC_BIT(SCU90, 6, 0)
+#define COND1           { SCU90, BIT(6), 0, 0 }
 #define COND2           { SCU94, GENMASK(1, 0), 0, 0 }
 #define B14 0
@@ -151,21 +151,21 @@ FUNC_GROUP_DECL(GPID0, F19, E21);
 #define GPID2_DESC      SIG_DESC_SET(SCU8C, 9)
-#define D20 26
+#define F20 26
 SIG_EXPR_LIST_DECL_SINGLE(SD2DAT0, SD2, SD2_DESC);
 SIG_EXPR_DECL(GPID2IN, GPID2, GPID2_DESC);
 SIG_EXPR_DECL(GPID2IN, GPID, GPID_DESC);
 SIG_EXPR_LIST_DECL_DUAL(GPID2IN, GPID2, GPID);
-MS_PIN_DECL(D20, GPIOD2, SD2DAT0, GPID2IN);
+MS_PIN_DECL(F20, GPIOD2, SD2DAT0, GPID2IN);
-#define D21 27
+#define D20 27
 SIG_EXPR_LIST_DECL_SINGLE(SD2DAT1, SD2, SD2_DESC);
 SIG_EXPR_DECL(GPID2OUT, GPID2, GPID2_DESC);
 SIG_EXPR_DECL(GPID2OUT, GPID, GPID_DESC);
 SIG_EXPR_LIST_DECL_DUAL(GPID2OUT, GPID2, GPID);
-MS_PIN_DECL(D21, GPIOD3, SD2DAT1, GPID2OUT);
+MS_PIN_DECL(D20, GPIOD3, SD2DAT1, GPID2OUT);
-FUNC_GROUP_DECL(GPID2, D20, D21);
+FUNC_GROUP_DECL(GPID2, F20, D20);
 #define GPIE_DESC       SIG_DESC_SET(HW_STRAP1, 21)
 #define GPIE0_DESC      SIG_DESC_SET(SCU8C, 12)
@@ -182,28 +182,88 @@ SIG_EXPR_LIST_DECL_SINGLE(NDCD3, NDCD3, SIG_DESC_SET(SCU80, 17));
 SIG_EXPR_DECL(GPIE0OUT, GPIE0, GPIE0_DESC);
 SIG_EXPR_DECL(GPIE0OUT, GPIE, GPIE_DESC);
 SIG_EXPR_LIST_DECL_DUAL(GPIE0OUT, GPIE0, GPIE);
-MS_PIN_DECL(C20, GPIE0, NDCD3, GPIE0OUT);
+MS_PIN_DECL(C20, GPIOE1, NDCD3, GPIE0OUT);
 FUNC_GROUP_DECL(GPIE0, B20, C20);
-#define SPI1_DESC       SIG_DESC_SET(HW_STRAP1, 13)
+#define SPI1_DESC               { HW_STRAP1, GENMASK(13, 12), 1, 0 }
+#define SPI1DEBUG_DESC          { HW_STRAP1, GENMASK(13, 12), 2, 0 }
+#define SPI1PASSTHRU_DESC       { HW_STRAP1, GENMASK(13, 12), 3, 0 }
 #define C18 64
-SIG_EXPR_LIST_DECL_SINGLE(SYSCS, SPI1, COND1, SPI1_DESC);
+SIG_EXPR_DECL(SYSCS, SPI1DEBUG, COND1, SPI1DEBUG_DESC);
+SIG_EXPR_DECL(SYSCS, SPI1PASSTHRU, COND1, SPI1PASSTHRU_DESC);
+SIG_EXPR_LIST_DECL_DUAL(SYSCS, SPI1DEBUG, SPI1PASSTHRU);
 SS_PIN_DECL(C18, GPIOI0, SYSCS);
 #define E15 65
-SIG_EXPR_LIST_DECL_SINGLE(SYSCK, SPI1, COND1, SPI1_DESC);
+SIG_EXPR_DECL(SYSCK, SPI1DEBUG, COND1, SPI1DEBUG_DESC);
+SIG_EXPR_DECL(SYSCK, SPI1PASSTHRU, COND1, SPI1PASSTHRU_DESC);
+SIG_EXPR_LIST_DECL_DUAL(SYSCK, SPI1DEBUG, SPI1PASSTHRU);
 SS_PIN_DECL(E15, GPIOI1, SYSCK);
-#define A14 66
+#define B16 66
-SIG_EXPR_LIST_DECL_SINGLE(SYSMOSI, SPI1, COND1, SPI1_DESC);
+SIG_EXPR_DECL(SYSMOSI, SPI1DEBUG, COND1, SPI1DEBUG_DESC);
-SS_PIN_DECL(A14, GPIOI2, SYSMOSI);
+SIG_EXPR_DECL(SYSMOSI, SPI1PASSTHRU, COND1, SPI1PASSTHRU_DESC);
+SIG_EXPR_LIST_DECL_DUAL(SYSMOSI, SPI1DEBUG, SPI1PASSTHRU);
+SS_PIN_DECL(B16, GPIOI2, SYSMOSI);
 #define C16 67
-SIG_EXPR_LIST_DECL_SINGLE(SYSMISO, SPI1, COND1, SPI1_DESC);
+SIG_EXPR_DECL(SYSMISO, SPI1DEBUG, COND1, SPI1DEBUG_DESC);
+SIG_EXPR_DECL(SYSMISO, SPI1PASSTHRU, COND1, SPI1PASSTHRU_DESC);
+SIG_EXPR_LIST_DECL_DUAL(SYSMISO, SPI1DEBUG, SPI1PASSTHRU);
 SS_PIN_DECL(C16, GPIOI3, SYSMISO);
-FUNC_GROUP_DECL(SPI1, C18, E15, A14, C16);
+#define VB_DESC SIG_DESC_SET(HW_STRAP1, 5)
+#define B15 68
+SIG_EXPR_DECL(SPI1CS0, SPI1, COND1, SPI1_DESC);
+SIG_EXPR_DECL(SPI1CS0, SPI1DEBUG, COND1, SPI1DEBUG_DESC);
+SIG_EXPR_DECL(SPI1CS0, SPI1PASSTHRU, COND1, SPI1PASSTHRU_DESC);
+SIG_EXPR_LIST_DECL(SPI1CS0, SIG_EXPR_PTR(SPI1CS0, SPI1),
+                            SIG_EXPR_PTR(SPI1CS0, SPI1DEBUG),
+                            SIG_EXPR_PTR(SPI1CS0, SPI1PASSTHRU));
+SIG_EXPR_LIST_DECL_SINGLE(VBCS, VGABIOSROM, COND1, VB_DESC);
+MS_PIN_DECL(B15, GPIOI4, SPI1CS0, VBCS);
+#define C15 69
+SIG_EXPR_DECL(SPI1CK, SPI1, COND1, SPI1_DESC);
+SIG_EXPR_DECL(SPI1CK, SPI1DEBUG, COND1, SPI1DEBUG_DESC);
+SIG_EXPR_DECL(SPI1CK, SPI1PASSTHRU, COND1, SPI1PASSTHRU_DESC);
+SIG_EXPR_LIST_DECL(SPI1CK, SIG_EXPR_PTR(SPI1CK, SPI1),
+                            SIG_EXPR_PTR(SPI1CK, SPI1DEBUG),
+                            SIG_EXPR_PTR(SPI1CK, SPI1PASSTHRU));
+SIG_EXPR_LIST_DECL_SINGLE(VBCK, VGABIOSROM, COND1, VB_DESC);
+MS_PIN_DECL(C15, GPIOI5, SPI1CK, VBCK);
+#define A14 70
+SIG_EXPR_DECL(SPI1MOSI, SPI1, COND1, SPI1_DESC);
+SIG_EXPR_DECL(SPI1MOSI, SPI1DEBUG, COND1, SPI1DEBUG_DESC);
+SIG_EXPR_DECL(SPI1MOSI, SPI1PASSTHRU, COND1, SPI1PASSTHRU_DESC);
+SIG_EXPR_LIST_DECL(SPI1MOSI, SIG_EXPR_PTR(SPI1MOSI, SPI1),
+                            SIG_EXPR_PTR(SPI1MOSI, SPI1DEBUG),
+                            SIG_EXPR_PTR(SPI1MOSI, SPI1PASSTHRU));
+SIG_EXPR_LIST_DECL_SINGLE(VBMOSI, VGABIOSROM, COND1, VB_DESC);
+MS_PIN_DECL(A14, GPIOI6, SPI1MOSI, VBMOSI);
+#define A15 71
+SIG_EXPR_DECL(SPI1MISO, SPI1, COND1, SPI1_DESC);
+SIG_EXPR_DECL(SPI1MISO, SPI1DEBUG, COND1, SPI1DEBUG_DESC);
+SIG_EXPR_DECL(SPI1MISO, SPI1PASSTHRU, COND1, SPI1PASSTHRU_DESC);
+SIG_EXPR_LIST_DECL(SPI1MISO, SIG_EXPR_PTR(SPI1MISO, SPI1),
+                            SIG_EXPR_PTR(SPI1MISO, SPI1DEBUG),
+                            SIG_EXPR_PTR(SPI1MISO, SPI1PASSTHRU));
+SIG_EXPR_LIST_DECL_SINGLE(VBMISO, VGABIOSROM, COND1, VB_DESC);
+MS_PIN_DECL(A15, GPIOI7, SPI1MISO, VBMISO);
+FUNC_GROUP_DECL(SPI1, B15, C15, A14, A15);
+FUNC_GROUP_DECL(SPI1DEBUG, C18, E15, B16, C16, B15, C15, A14, A15);
+FUNC_GROUP_DECL(SPI1PASSTHRU, C18, E15, B16, C16, B15, C15, A14, A15);
+FUNC_GROUP_DECL(VGABIOSROM, B15, C15, A14, A15);
+#define R2 72
+SIG_EXPR_LIST_DECL_SINGLE(SGPMCK, SGPM, SIG_DESC_SET(SCU84, 8));
+SS_PIN_DECL(R2, GPIOJ0, SGPMCK);
 #define L2 73
 SIG_EXPR_LIST_DECL_SINGLE(SGPMLD, SGPM, SIG_DESC_SET(SCU84, 9));
@@ -580,6 +640,7 @@ static struct pinctrl_pin_desc aspeed_g5_pins[ASPEED_G5_NR_PINS] = {
        ASPEED_PINCTRL_PIN(A12),
        ASPEED_PINCTRL_PIN(A13),
        ASPEED_PINCTRL_PIN(A14),
+        ASPEED_PINCTRL_PIN(A15),
        ASPEED_PINCTRL_PIN(A2),
        ASPEED_PINCTRL_PIN(A3),
        ASPEED_PINCTRL_PIN(A4),
@@ -592,6 +653,8 @@ static struct pinctrl_pin_desc aspeed_g5_pins[ASPEED_G5_NR_PINS] = {
        ASPEED_PINCTRL_PIN(B12),
        ASPEED_PINCTRL_PIN(B13),
        ASPEED_PINCTRL_PIN(B14),
+        ASPEED_PINCTRL_PIN(B15),
+        ASPEED_PINCTRL_PIN(B16),
        ASPEED_PINCTRL_PIN(B2),
        ASPEED_PINCTRL_PIN(B20),
        ASPEED_PINCTRL_PIN(B3),
@@ -603,6 +666,7 @@ static struct pinctrl_pin_desc aspeed_g5_pins[ASPEED_G5_NR_PINS] = {
        ASPEED_PINCTRL_PIN(C12),
        ASPEED_PINCTRL_PIN(C13),
        ASPEED_PINCTRL_PIN(C14),
+        ASPEED_PINCTRL_PIN(C15),
        ASPEED_PINCTRL_PIN(C16),
        ASPEED_PINCTRL_PIN(C18),
        ASPEED_PINCTRL_PIN(C2),
@@ -614,7 +678,6 @@ static struct pinctrl_pin_desc aspeed_g5_pins[ASPEED_G5_NR_PINS] = {
        ASPEED_PINCTRL_PIN(D10),
        ASPEED_PINCTRL_PIN(D2),
        ASPEED_PINCTRL_PIN(D20),
-        ASPEED_PINCTRL_PIN(D21),
        ASPEED_PINCTRL_PIN(D4),
        ASPEED_PINCTRL_PIN(D5),
        ASPEED_PINCTRL_PIN(D6),
@@ -630,6 +693,7 @@ static struct pinctrl_pin_desc aspeed_g5_pins[ASPEED_G5_NR_PINS] = {
        ASPEED_PINCTRL_PIN(E7),
        ASPEED_PINCTRL_PIN(E9),
        ASPEED_PINCTRL_PIN(F19),
+        ASPEED_PINCTRL_PIN(F20),
        ASPEED_PINCTRL_PIN(F9),
        ASPEED_PINCTRL_PIN(H20),
        ASPEED_PINCTRL_PIN(L1),
@@ -691,11 +755,14 @@ static const struct aspeed_pin_group aspeed_g5_groups[] = {
        ASPEED_PINCTRL_GROUP(RMII2),
        ASPEED_PINCTRL_GROUP(SD1),
        ASPEED_PINCTRL_GROUP(SPI1),
+        ASPEED_PINCTRL_GROUP(SPI1DEBUG),
+        ASPEED_PINCTRL_GROUP(SPI1PASSTHRU),
        ASPEED_PINCTRL_GROUP(TIMER4),
        ASPEED_PINCTRL_GROUP(TIMER5),
        ASPEED_PINCTRL_GROUP(TIMER6),
        ASPEED_PINCTRL_GROUP(TIMER7),
        ASPEED_PINCTRL_GROUP(TIMER8),
+        ASPEED_PINCTRL_GROUP(VGABIOSROM),
 };
 static const struct aspeed_pin_function aspeed_g5_functions[] = {
@@ -733,11 +800,14 @@ static const struct aspeed_pin_function aspeed_g5_functions[] = {
        ASPEED_PINCTRL_FUNC(RMII2),
        ASPEED_PINCTRL_FUNC(SD1),
        ASPEED_PINCTRL_FUNC(SPI1),
+        ASPEED_PINCTRL_FUNC(SPI1DEBUG),
+        ASPEED_PINCTRL_FUNC(SPI1PASSTHRU),
        ASPEED_PINCTRL_FUNC(TIMER4),
        ASPEED_PINCTRL_FUNC(TIMER5),
        ASPEED_PINCTRL_FUNC(TIMER6),
        ASPEED_PINCTRL_FUNC(TIMER7),
        ASPEED_PINCTRL_FUNC(TIMER8),
+        ASPEED_PINCTRL_FUNC(VGABIOSROM),
 };
 static struct aspeed_pinctrl_data aspeed_g5_pinctrl_data = {
diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed.c b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
index 0391f9f13f3e..49aeba912531 100644
--- a/drivers/pinctrl/aspeed/pinctrl-aspeed.c
+++ b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
@@ -166,13 +166,9 @@ static bool aspeed_sig_expr_set(const struct aspeed_sig_expr *expr,
                                bool enable, struct regmap *map)
 {
        int i;
-        bool ret;
-        ret = aspeed_sig_expr_eval(expr, enable, map);
-        if (ret)
-                return ret;
        for (i = 0; i < expr->ndescs; i++) {
+                bool ret;
                const struct aspeed_sig_desc *desc = &expr->descs[i];
                u32 pattern = enable ? desc->enable : desc->disable;
@@ -199,12 +195,18 @@ static bool aspeed_sig_expr_set(const struct aspeed_sig_expr *expr,
 static bool aspeed_sig_expr_enable(const struct aspeed_sig_expr *expr,
                                   struct regmap *map)
 {
+        if (aspeed_sig_expr_eval(expr, true, map))
+                return true;
        return aspeed_sig_expr_set(expr, true, map);
 }
 static bool aspeed_sig_expr_disable(const struct aspeed_sig_expr *expr,
                                    struct regmap *map)
 {
+        if (!aspeed_sig_expr_eval(expr, true, map))
+                return true;
        return aspeed_sig_expr_set(expr, false, map);
 }
diff --git a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
index 7f7700716398..5d1e505c3c63 100644
--- a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
+++ b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
@@ -844,6 +844,6 @@ static struct platform_driver iproc_gpio_driver = {
 static int __init iproc_gpio_init(void)
 {
-        return platform_driver_probe(&iproc_gpio_driver, iproc_gpio_probe);
+        return platform_driver_register(&iproc_gpio_driver);
 }
 arch_initcall_sync(iproc_gpio_init);
diff --git a/drivers/pinctrl/bcm/pinctrl-nsp-gpio.c b/drivers/pinctrl/bcm/pinctrl-nsp-gpio.c
index 35783db1c10b..c8deb8be1da7 100644
--- a/drivers/pinctrl/bcm/pinctrl-nsp-gpio.c
+++ b/drivers/pinctrl/bcm/pinctrl-nsp-gpio.c
@@ -741,6 +741,6 @@ static struct platform_driver nsp_gpio_driver = {
 static int __init nsp_gpio_init(void)
 {
-        return platform_driver_probe(&nsp_gpio_driver, nsp_gpio_probe);
+        return platform_driver_register(&nsp_gpio_driver);
 }
 arch_initcall_sync(nsp_gpio_init);
diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
index 47613201269a..79c4e14a5a75 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx.c
@@ -687,6 +687,7 @@ static int imx_pinctrl_probe_dt(struct platform_device *pdev,
        if (!info->functions)
                return -ENOMEM;
+        info->group_index = 0;
        if (flat_funcs) {
                info->ngroups = of_get_child_count(np);
        } else {
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index d22a9fe2e6df..71bbeb9321ba 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -1808,6 +1808,8 @@ static int byt_pinctrl_probe(struct platform_device *pdev)
                return PTR_ERR(vg->pctl_dev);
        }
+        raw_spin_lock_init(&vg->lock);
        ret = byt_gpio_probe(vg);
        if (ret) {
                pinctrl_unregister(vg->pctl_dev);
@@ -1815,7 +1817,6 @@ static int byt_pinctrl_probe(struct platform_device *pdev)
        }
        platform_set_drvdata(pdev, vg);
-        raw_spin_lock_init(&vg->lock);
        pm_runtime_enable(&pdev->dev);
        return 0;
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 30389f4ccab4..c43b1e9a06af 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1652,12 +1652,15 @@ static int chv_pinctrl_probe(struct platform_device *pdev)
 }
 #ifdef CONFIG_PM_SLEEP
-static int chv_pinctrl_suspend(struct device *dev)
+static int chv_pinctrl_suspend_noirq(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
        struct chv_pinctrl *pctrl = platform_get_drvdata(pdev);
+        unsigned long flags;
        int i;
+        raw_spin_lock_irqsave(&chv_lock, flags);
        pctrl->saved_intmask = readl(pctrl->regs + CHV_INTMASK);
        for (i = 0; i < pctrl->community->npins; i++) {
@@ -1678,15 +1681,20 @@ static int chv_pinctrl_suspend(struct device *dev)
                ctx->padctrl1 = readl(reg);
        }
+        raw_spin_unlock_irqrestore(&chv_lock, flags);
        return 0;
 }
-static int chv_pinctrl_resume(struct device *dev)
+static int chv_pinctrl_resume_noirq(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
        struct chv_pinctrl *pctrl = platform_get_drvdata(pdev);
+        unsigned long flags;
        int i;
+        raw_spin_lock_irqsave(&chv_lock, flags);
        /*
         * Mask all interrupts before restoring per-pin configuration
         * registers because we don't know in which state BIOS left them
@@ -1731,12 +1739,15 @@ static int chv_pinctrl_resume(struct device *dev)
        chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
        chv_writel(pctrl->saved_intmask, pctrl->regs + CHV_INTMASK);
+        raw_spin_unlock_irqrestore(&chv_lock, flags);
        return 0;
 }
 #endif
 static const struct dev_pm_ops chv_pinctrl_pm_ops = {
-        SET_LATE_SYSTEM_SLEEP_PM_OPS(chv_pinctrl_suspend, chv_pinctrl_resume)
+        SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(chv_pinctrl_suspend_noirq,
+                                      chv_pinctrl_resume_noirq)
 };
 static const struct acpi_device_id chv_pinctrl_acpi_match[] = {
diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index 63387a40b973..01443762e570 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -19,6 +19,7 @@
 #include <linux/pinctrl/pinconf.h>
 #include <linux/pinctrl/pinconf-generic.h>
+#include "../core.h"
 #include "pinctrl-intel.h"
 /* Offset from regs */
@@ -1056,6 +1057,26 @@ int intel_pinctrl_remove(struct platform_device *pdev)
 EXPORT_SYMBOL_GPL(intel_pinctrl_remove);
 #ifdef CONFIG_PM_SLEEP
+static bool intel_pinctrl_should_save(struct intel_pinctrl *pctrl, unsigned pin)
+{
+        const struct pin_desc *pd = pin_desc_get(pctrl->pctldev, pin);
+        if (!pd || !intel_pad_usable(pctrl, pin))
+                return false;
+        /*
+         * Only restore the pin if it is actually in use by the kernel (or
+         * by userspace). It is possible that some pins are used by the
+         * BIOS during resume and those are not always locked down so leave
+         * them alone.
+         */
+        if (pd->mux_owner || pd->gpio_owner ||
+            gpiochip_line_is_irq(&pctrl->chip, pin))
+                return true;
+        return false;
+}
 int intel_pinctrl_suspend(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
@@ -1069,7 +1090,7 @@ int intel_pinctrl_suspend(struct device *dev)
                const struct pinctrl_pin_desc *desc = &pctrl->soc->pins[i];
                u32 val;
-                if (!intel_pad_usable(pctrl, desc->number))
+                if (!intel_pinctrl_should_save(pctrl, desc->number))
                        continue;
                val = readl(intel_get_padcfg(pctrl, desc->number, PADCFG0));
@@ -1130,7 +1151,7 @@ int intel_pinctrl_resume(struct device *dev)
                void __iomem *padcfg;
                u32 val;
-                if (!intel_pad_usable(pctrl, desc->number))
+                if (!intel_pinctrl_should_save(pctrl, desc->number))
                        continue;
                padcfg = intel_get_padcfg(pctrl, desc->number, PADCFG0);
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 99da4cf91031..b7bb37167969 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -1512,7 +1512,7 @@ static int st_gpiolib_register_bank(struct st_pinctrl *info,
        if (info->irqmux_base || gpio_irq > 0) {
                err = gpiochip_irqchip_add(&bank->gpio_chip, &st_gpio_irqchip,
                                           0, handle_simple_irq,
-                                           IRQ_TYPE_LEVEL_LOW);
+                                           IRQ_TYPE_NONE);
                if (err) {
                        gpiochip_remove(&bank->gpio_chip);
                        dev_info(dev, "could not add irqchip\n");
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index 200667f08c37..efc43711ff5c 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -1092,9 +1092,11 @@ int stm32_pctl_probe(struct platform_device *pdev)
                return -EINVAL;
        }
-        ret = stm32_pctrl_dt_setup_irq(pdev, pctl);
+        if (of_find_property(np, "interrupt-parent", NULL)) {
-        if (ret)
+                ret = stm32_pctrl_dt_setup_irq(pdev, pctl);
-                return ret;
+                if (ret)
+                        return ret;
+        }
        for_each_child_of_node(np, child)
                if (of_property_read_bool(child, "gpio-controller"))
diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c
index 07462d79d040..1aba2c74160e 100644
--- a/drivers/platform/goldfish/goldfish_pipe.c
+++ b/drivers/platform/goldfish/goldfish_pipe.c
@@ -309,7 +309,8 @@ static ssize_t goldfish_pipe_read_write(struct file *filp, char __user *buffer,
                 * much memory to the process.
                 */
                down_read(&current->mm->mmap_sem);
-                ret = get_user_pages(address, 1, !is_write, 0, &page, NULL);
+                ret = get_user_pages(address, 1, is_write ? 0 : FOLL_WRITE,
+                                &page, NULL);
                up_read(&current->mm->mmap_sem);
                if (ret < 0)
                        break;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 81b8dcca8891..b8a21d7b25d4 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -576,6 +576,7 @@ config ASUS_WMI
 config ASUS_NB_WMI
        tristate "Asus Notebook WMI Driver"
        depends on ASUS_WMI
+        depends on SERIO_I8042 || SERIO_I8042 = n
        ---help---
          This is a driver for newer Asus notebooks. It adds extra features
          like wireless radio and bluetooth control, leds, hotkeys, backlight...
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index d1a091b93192..a7614fc542b5 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -933,6 +933,20 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 900"),
                },
        },
+        {
+                .ident = "Lenovo Yoga 900",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_BOARD_NAME, "VIUU4"),
+                },
+        },
+        {
+                .ident = "Lenovo YOGA 910-13IKB",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 910-13IKB"),
+                },
+        },
        {}
 };
diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
index ed5874217ee7..12dbb5063376 100644
--- a/drivers/platform/x86/intel-hid.c
+++ b/drivers/platform/x86/intel-hid.c
@@ -264,7 +264,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv)
                return AE_OK;
        if (acpi_match_device_ids(dev, ids) == 0)
-                if (acpi_create_platform_device(dev))
+                if (acpi_create_platform_device(dev, NULL))
                        dev_info(&dev->dev,
                                 "intel-hid: created platform device\n");
diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
index 146d02f8c9bc..78080763df51 100644
--- a/drivers/platform/x86/intel-vbtn.c
+++ b/drivers/platform/x86/intel-vbtn.c
@@ -164,7 +164,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv)
                return AE_OK;
        if (acpi_match_device_ids(dev, ids) == 0)
-                if (acpi_create_platform_device(dev))
+                if (acpi_create_platform_device(dev, NULL))
                        dev_info(&dev->dev,
                                 "intel-vbtn: created platform device\n");
diff --git a/drivers/platform/x86/toshiba-wmi.c b/drivers/platform/x86/toshiba-wmi.c
index feac4576b837..2df07ee8f3c3 100644
--- a/drivers/platform/x86/toshiba-wmi.c
+++ b/drivers/platform/x86/toshiba-wmi.c
@@ -24,14 +24,15 @@
 #include <linux/acpi.h>
 #include <linux/input.h>
 #include <linux/input/sparse-keymap.h>
+#include <linux/dmi.h>
 MODULE_AUTHOR("Azael Avalos");
 MODULE_DESCRIPTION("Toshiba WMI Hotkey Driver");
 MODULE_LICENSE("GPL");
-#define TOSHIBA_WMI_EVENT_GUID  "59142400-C6A3-40FA-BADB-8A2652834100"
+#define WMI_EVENT_GUID  "59142400-C6A3-40FA-BADB-8A2652834100"
-MODULE_ALIAS("wmi:"TOSHIBA_WMI_EVENT_GUID);
+MODULE_ALIAS("wmi:"WMI_EVENT_GUID);
 static struct input_dev *toshiba_wmi_input_dev;
@@ -63,6 +64,16 @@ static void toshiba_wmi_notify(u32 value, void *context)
        kfree(response.pointer);
 }
+static struct dmi_system_id toshiba_wmi_dmi_table[] __initdata = {
+        {
+                .ident = "Toshiba laptop",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                },
+        },
+        {}
+};
 static int __init toshiba_wmi_input_setup(void)
 {
        acpi_status status;
@@ -81,7 +92,7 @@ static int __init toshiba_wmi_input_setup(void)
        if (err)
                goto err_free_dev;
-        status = wmi_install_notify_handler(TOSHIBA_WMI_EVENT_GUID,
+        status = wmi_install_notify_handler(WMI_EVENT_GUID,
                                            toshiba_wmi_notify, NULL);
        if (ACPI_FAILURE(status)) {
                err = -EIO;
@@ -95,7 +106,7 @@ static int __init toshiba_wmi_input_setup(void)
        return 0;
 err_remove_notifier:
-        wmi_remove_notify_handler(TOSHIBA_WMI_EVENT_GUID);
+        wmi_remove_notify_handler(WMI_EVENT_GUID);
 err_free_keymap:
        sparse_keymap_free(toshiba_wmi_input_dev);
 err_free_dev:
@@ -105,7 +116,7 @@ static int __init toshiba_wmi_input_setup(void)
 static void toshiba_wmi_input_destroy(void)
 {
-        wmi_remove_notify_handler(TOSHIBA_WMI_EVENT_GUID);
+        wmi_remove_notify_handler(WMI_EVENT_GUID);
        sparse_keymap_free(toshiba_wmi_input_dev);
        input_unregister_device(toshiba_wmi_input_dev);
 }
@@ -114,7 +125,8 @@ static int __init toshiba_wmi_init(void)
 {
        int ret;
-        if (!wmi_has_guid(TOSHIBA_WMI_EVENT_GUID))
+        if (!wmi_has_guid(WMI_EVENT_GUID) ||
+            !dmi_check_system(toshiba_wmi_dmi_table))
                return -ENODEV;
        ret = toshiba_wmi_input_setup();
@@ -130,7 +142,7 @@ static int __init toshiba_wmi_init(void)
 static void __exit toshiba_wmi_exit(void)
 {
-        if (wmi_has_guid(TOSHIBA_WMI_EVENT_GUID))
+        if (wmi_has_guid(WMI_EVENT_GUID))
                toshiba_wmi_input_destroy();
 }
diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
index 381871b2bb46..9d5bd7d5c610 100644
--- a/drivers/pwm/pwm-meson.c
+++ b/drivers/pwm/pwm-meson.c
@@ -474,6 +474,7 @@ static int meson_pwm_probe(struct platform_device *pdev)
        if (IS_ERR(meson->base))
                return PTR_ERR(meson->base);
+        spin_lock_init(&meson->lock);
        meson->chip.dev = &pdev->dev;
        meson->chip.ops = &meson_pwm_ops;
        meson->chip.base = -1;
diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
index 0296d8178ae2..a813239300c3 100644
--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -425,6 +425,8 @@ void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
                if (test_bit(PWMF_EXPORTED, &pwm->flags))
                        pwm_unexport_child(parent, pwm);
        }
+        put_device(parent);
 }
 static int __init pwm_sysfs_init(void)
diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index 436dfe871d32..9013a585507e 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -892,7 +892,8 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
                down_read(&current->mm->mmap_sem);
                pinned = get_user_pages(
                                (unsigned long)xfer->loc_addr & PAGE_MASK,
-                                nr_pages, dir == DMA_FROM_DEVICE, 0,
+                                nr_pages,
+                                dir == DMA_FROM_DEVICE ? FOLL_WRITE : 0,
                                page_list, NULL);
                up_read(&current->mm->mmap_sem);
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 67426c0477d3..5c1519b229e0 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2754,7 +2754,7 @@ static int _regulator_set_voltage_time(struct regulator_dev *rdev,
                ramp_delay = rdev->desc->ramp_delay;
        if (ramp_delay == 0) {
-                rdev_warn(rdev, "ramp_delay not set\n");
+                rdev_dbg(rdev, "ramp_delay not set\n");
                return 0;
        }
diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
index 3314bf299a51..fb44d5215e30 100644
--- a/drivers/regulator/rk808-regulator.c
+++ b/drivers/regulator/rk808-regulator.c
@@ -120,7 +120,7 @@ static const struct regulator_linear_range rk808_ldo3_voltage_ranges[] = {
 static int rk808_buck1_2_get_voltage_sel_regmap(struct regulator_dev *rdev)
 {
        struct rk808_regulator_data *pdata = rdev_get_drvdata(rdev);
-        int id = rdev->desc->id - RK808_ID_DCDC1;
+        int id = rdev_get_id(rdev);
        struct gpio_desc *gpio = pdata->dvs_gpio[id];
        unsigned int val;
        int ret;
@@ -193,7 +193,7 @@ static int rk808_buck1_2_set_voltage_sel(struct regulator_dev *rdev,
                                         unsigned sel)
 {
        struct rk808_regulator_data *pdata = rdev_get_drvdata(rdev);
-        int id = rdev->desc->id - RK808_ID_DCDC1;
+        int id = rdev_get_id(rdev);
        struct gpio_desc *gpio = pdata->dvs_gpio[id];
        unsigned int reg = rdev->desc->vsel_reg;
        unsigned old_sel;
@@ -232,7 +232,7 @@ static int rk808_buck1_2_set_voltage_time_sel(struct regulator_dev *rdev,
                                       unsigned int new_selector)
 {
        struct rk808_regulator_data *pdata = rdev_get_drvdata(rdev);
-        int id = rdev->desc->id - RK808_ID_DCDC1;
+        int id = rdev_get_id(rdev);
        struct gpio_desc *gpio = pdata->dvs_gpio[id];
        /* if there is no dvs1/2 pin, we don't need wait extra time here. */
@@ -245,8 +245,7 @@ static int rk808_buck1_2_set_voltage_time_sel(struct regulator_dev *rdev,
 static int rk808_set_ramp_delay(struct regulator_dev *rdev, int ramp_delay)
 {
        unsigned int ramp_value = RK808_RAMP_RATE_10MV_PER_US;
-        unsigned int reg = rk808_buck_config_regs[rdev->desc->id -
+        unsigned int reg = rk808_buck_config_regs[rdev_get_id(rdev)];
-                                                  RK808_ID_DCDC1];
        switch (ramp_delay) {
        case 1 ... 2000:
diff --git a/drivers/reset/reset-uniphier.c b/drivers/reset/reset-uniphier.c
index 8b2558e7363e..968c3ae4535c 100644
--- a/drivers/reset/reset-uniphier.c
+++ b/drivers/reset/reset-uniphier.c
@@ -154,7 +154,7 @@ const struct uniphier_reset_data uniphier_sld3_mio_reset_data[] = {
        UNIPHIER_RESET_END,
 };
-const struct uniphier_reset_data uniphier_pro5_mio_reset_data[] = {
+const struct uniphier_reset_data uniphier_pro5_sd_reset_data[] = {
        UNIPHIER_MIO_RESET_SD(0, 0),
        UNIPHIER_MIO_RESET_SD(1, 1),
        UNIPHIER_MIO_RESET_EMMC_HW_RESET(6, 1),
@@ -360,7 +360,7 @@ static const struct of_device_id uniphier_reset_match[] = {
                .compatible = "socionext,uniphier-ld20-reset",
                .data = uniphier_ld20_sys_reset_data,
        },
-        /* Media I/O reset */
+        /* Media I/O reset, SD reset */
        {
                .compatible = "socionext,uniphier-sld3-mio-reset",
                .data = uniphier_sld3_mio_reset_data,
@@ -378,20 +378,20 @@ static const struct of_device_id uniphier_reset_match[] = {
                .data = uniphier_sld3_mio_reset_data,
        },
        {
-                .compatible = "socionext,uniphier-pro5-mio-reset",
+                .compatible = "socionext,uniphier-pro5-sd-reset",
-                .data = uniphier_pro5_mio_reset_data,
+                .data = uniphier_pro5_sd_reset_data,
        },
        {
-                .compatible = "socionext,uniphier-pxs2-mio-reset",
+                .compatible = "socionext,uniphier-pxs2-sd-reset",
-                .data = uniphier_pro5_mio_reset_data,
+                .data = uniphier_pro5_sd_reset_data,
        },
        {
                .compatible = "socionext,uniphier-ld11-mio-reset",
                .data = uniphier_sld3_mio_reset_data,
        },
        {
-                .compatible = "socionext,uniphier-ld20-mio-reset",
+                .compatible = "socionext,uniphier-ld20-sd-reset",
-                .data = uniphier_pro5_mio_reset_data,
+                .data = uniphier_pro5_sd_reset_data,
        },
        /* Peripheral reset */
        {
diff --git a/drivers/rtc/rtc-asm9260.c b/drivers/rtc/rtc-asm9260.c
index 18a93d3e3f93..d36534965635 100644
--- a/drivers/rtc/rtc-asm9260.c
+++ b/drivers/rtc/rtc-asm9260.c
@@ -327,6 +327,7 @@ static const struct of_device_id asm9260_dt_ids[] = {
        { .compatible = "alphascale,asm9260-rtc", },
        {}
 };
+MODULE_DEVICE_TABLE(of, asm9260_dt_ids);
 static struct platform_driver asm9260_rtc_driver = {
        .probe          = asm9260_rtc_probe,
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index dd3d59806ffa..7030d7cd3861 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -776,7 +776,7 @@ static void cmos_do_shutdown(int rtc_irq)
        spin_unlock_irq(&rtc_lock);
 }
-static void __exit cmos_do_remove(struct device *dev)
+static void cmos_do_remove(struct device *dev)
 {
        struct cmos_rtc *cmos = dev_get_drvdata(dev);
        struct resource *ports;
@@ -996,8 +996,9 @@ static u32 rtc_handler(void *context)
        struct cmos_rtc *cmos = dev_get_drvdata(dev);
        unsigned char rtc_control = 0;
        unsigned char rtc_intr;
+        unsigned long flags;
-        spin_lock_irq(&rtc_lock);
+        spin_lock_irqsave(&rtc_lock, flags);
        if (cmos_rtc.suspend_ctrl)
                rtc_control = CMOS_READ(RTC_CONTROL);
        if (rtc_control & RTC_AIE) {
@@ -1006,7 +1007,7 @@ static u32 rtc_handler(void *context)
                rtc_intr = CMOS_READ(RTC_INTR_FLAGS);
                rtc_update_irq(cmos->rtc, 1, rtc_intr);
        }
-        spin_unlock_irq(&rtc_lock);
+        spin_unlock_irqrestore(&rtc_lock, flags);
        pm_wakeup_event(dev, 0);
        acpi_clear_event(ACPI_EVENT_RTC);
@@ -1129,7 +1130,7 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
                                pnp_irq(pnp, 0));
 }
-static void __exit cmos_pnp_remove(struct pnp_dev *pnp)
+static void cmos_pnp_remove(struct pnp_dev *pnp)
 {
        cmos_do_remove(&pnp->dev);
 }
@@ -1161,7 +1162,7 @@ static struct pnp_driver cmos_pnp_driver = {
        .name           = (char *) driver_name,
        .id_table       = rtc_ids,
        .probe          = cmos_pnp_probe,
-        .remove         = __exit_p(cmos_pnp_remove),
+        .remove         = cmos_pnp_remove,
        .shutdown       = cmos_pnp_shutdown,
        /* flag ensures resume() gets called, and stops syslog spam */
@@ -1238,7 +1239,7 @@ static int __init cmos_platform_probe(struct platform_device *pdev)
        return cmos_do_probe(&pdev->dev, resource, irq);
 }
-static int __exit cmos_platform_remove(struct platform_device *pdev)
+static int cmos_platform_remove(struct platform_device *pdev)
 {
        cmos_do_remove(&pdev->dev);
        return 0;
@@ -1263,7 +1264,7 @@ static void cmos_platform_shutdown(struct platform_device *pdev)
 MODULE_ALIAS("platform:rtc_cmos");
 static struct platform_driver cmos_platform_driver = {
-        .remove         = __exit_p(cmos_platform_remove),
+        .remove         = cmos_platform_remove,
        .shutdown       = cmos_platform_shutdown,
        .driver = {
                .name           = driver_name,
diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
index b04ea9b5ae67..51e52446eacb 100644
--- a/drivers/rtc/rtc-omap.c
+++ b/drivers/rtc/rtc-omap.c
@@ -113,6 +113,7 @@
 /* OMAP_RTC_OSC_REG bit fields: */
 #define OMAP_RTC_OSC_32KCLK_EN          BIT(6)
 #define OMAP_RTC_OSC_SEL_32KCLK_SRC     BIT(3)
+#define OMAP_RTC_OSC_OSC32K_GZ_DISABLE  BIT(4)
 /* OMAP_RTC_IRQWAKEEN bit fields: */
 #define OMAP_RTC_IRQWAKEEN_ALARM_WAKEEN BIT(1)
@@ -146,6 +147,7 @@ struct omap_rtc {
        u8 interrupts_reg;
        bool is_pmic_controller;
        bool has_ext_clk;
+        bool is_suspending;
        const struct omap_rtc_device_type *type;
        struct pinctrl_dev *pctldev;
 };
@@ -786,8 +788,9 @@ static int omap_rtc_probe(struct platform_device *pdev)
         */
        if (rtc->has_ext_clk) {
                reg = rtc_read(rtc, OMAP_RTC_OSC_REG);
-                rtc_write(rtc, OMAP_RTC_OSC_REG,
+                reg &= ~OMAP_RTC_OSC_OSC32K_GZ_DISABLE;
-                          reg | OMAP_RTC_OSC_SEL_32KCLK_SRC);
+                reg |= OMAP_RTC_OSC_32KCLK_EN | OMAP_RTC_OSC_SEL_32KCLK_SRC;
+                rtc_writel(rtc, OMAP_RTC_OSC_REG, reg);
        }
        rtc->type->lock(rtc);
@@ -898,8 +901,7 @@ static int omap_rtc_suspend(struct device *dev)
                rtc_write(rtc, OMAP_RTC_INTERRUPTS_REG, 0);
        rtc->type->lock(rtc);
-        /* Disable the clock/module */
+        rtc->is_suspending = true;
-        pm_runtime_put_sync(dev);
        return 0;
 }
@@ -908,9 +910,6 @@ static int omap_rtc_resume(struct device *dev)
 {
        struct omap_rtc *rtc = dev_get_drvdata(dev);
-        /* Enable the clock/module so that we can access the registers */
-        pm_runtime_get_sync(dev);
        rtc->type->unlock(rtc);
        if (device_may_wakeup(dev))
                disable_irq_wake(rtc->irq_alarm);
@@ -918,11 +917,34 @@ static int omap_rtc_resume(struct device *dev)
                rtc_write(rtc, OMAP_RTC_INTERRUPTS_REG, rtc->interrupts_reg);
        rtc->type->lock(rtc);
+        rtc->is_suspending = false;
        return 0;
 }
 #endif
-static SIMPLE_DEV_PM_OPS(omap_rtc_pm_ops, omap_rtc_suspend, omap_rtc_resume);
+#ifdef CONFIG_PM
+static int omap_rtc_runtime_suspend(struct device *dev)
+{
+        struct omap_rtc *rtc = dev_get_drvdata(dev);
+        if (rtc->is_suspending && !rtc->has_ext_clk)
+                return -EBUSY;
+        return 0;
+}
+static int omap_rtc_runtime_resume(struct device *dev)
+{
+        return 0;
+}
+#endif
+static const struct dev_pm_ops omap_rtc_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(omap_rtc_suspend, omap_rtc_resume)
+        SET_RUNTIME_PM_OPS(omap_rtc_runtime_suspend,
+                           omap_rtc_runtime_resume, NULL)
+};
 static void omap_rtc_shutdown(struct platform_device *pdev)
 {
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 831935af7389..a7a88476e215 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -1205,7 +1205,7 @@ static int verify_fcx_max_data(struct dasd_device *device, __u8 lpm)
                                 mdc, lpm);
                        return mdc;
                }
-                fcx_max_data = mdc * FCX_MAX_DATA_FACTOR;
+                fcx_max_data = (u32)mdc * FCX_MAX_DATA_FACTOR;
                if (fcx_max_data < private->fcx_max_data) {
                        dev_warn(&device->cdev->dev,
                                 "The maximum data size for zHPF requests %u "
@@ -1675,7 +1675,7 @@ static u32 get_fcx_max_data(struct dasd_device *device)
                         " data size for zHPF requests failed\n");
                return 0;
        } else
-                return mdc * FCX_MAX_DATA_FACTOR;
+                return (u32)mdc * FCX_MAX_DATA_FACTOR;
 }
 /*
diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
index 46be25c7461e..876c7e6e3a99 100644
--- a/drivers/s390/cio/chp.c
+++ b/drivers/s390/cio/chp.c
@@ -780,7 +780,7 @@ static int cfg_wait_idle(void)
 static int __init chp_init(void)
 {
        struct chp_id chpid;
-        int ret;
+        int state, ret;
        ret = crw_register_handler(CRW_RSC_CPATH, chp_process_crw);
        if (ret)
@@ -791,7 +791,9 @@ static int __init chp_init(void)
                return 0;
        /* Register available channel-paths. */
        chp_id_for_each(&chpid) {
-                if (chp_info_get_status(chpid) != CHP_STATUS_NOT_RECOGNIZED)
+                state = chp_info_get_status(chpid);
+                if (state == CHP_STATUS_CONFIGURED ||
+                    state == CHP_STATUS_STANDBY)
                        chp_new(chpid);
        }
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 637cf8973c9e..581001989937 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -384,7 +384,7 @@ void zfcp_dbf_san(char *tag, struct zfcp_dbf *dbf,
        /* if (len > rec_len):
         * dump data up to cap_len ignoring small duplicate in rec->payload
         */
-        spin_lock_irqsave(&dbf->pay_lock, flags);
+        spin_lock(&dbf->pay_lock);
        memset(payload, 0, sizeof(*payload));
        memcpy(payload->area, paytag, ZFCP_DBF_TAG_LEN);
        payload->fsf_req_id = req_id;
diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
index db2739079cbb..790babc5ef66 100644
--- a/drivers/scsi/NCR5380.c
+++ b/drivers/scsi/NCR5380.c
@@ -353,7 +353,7 @@ static void NCR5380_print_phase(struct Scsi_Host *instance)
 #endif
-static int probe_irq __initdata;
+static int probe_irq;
 /**
 * probe_intr   -       helper for IRQ autoprobe
@@ -365,7 +365,7 @@ static int probe_irq __initdata;
 * used by the IRQ probe code.
 */
-static irqreturn_t __init probe_intr(int irq, void *dev_id)
+static irqreturn_t probe_intr(int irq, void *dev_id)
 {
        probe_irq = irq;
        return IRQ_HANDLED;
@@ -380,7 +380,7 @@ static irqreturn_t __init probe_intr(int irq, void *dev_id)
 * and then looking to see what interrupt actually turned up.
 */
-static int __init __maybe_unused NCR5380_probe_irq(struct Scsi_Host *instance,
+static int __maybe_unused NCR5380_probe_irq(struct Scsi_Host *instance,
                                                int possible)
 {
        struct NCR5380_hostdata *hostdata = shost_priv(instance);
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 3d53d636b17b..f0cfb0451757 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -2636,18 +2636,9 @@ static int arcmsr_queue_command_lck(struct scsi_cmnd *cmd,
        struct AdapterControlBlock *acb = (struct AdapterControlBlock *) host->hostdata;
        struct CommandControlBlock *ccb;
        int target = cmd->device->id;
-        int lun = cmd->device->lun;
-        uint8_t scsicmd = cmd->cmnd[0];
        cmd->scsi_done = done;
        cmd->host_scribble = NULL;
        cmd->result = 0;
-        if ((scsicmd == SYNCHRONIZE_CACHE) ||(scsicmd == SEND_DIAGNOSTIC)){
-                if(acb->devstate[target][lun] == ARECA_RAID_GONE) {
-                        cmd->result = (DID_NO_CONNECT << 16);
-                }
-                cmd->scsi_done(cmd);
-                return 0;
-        }
        if (target == 16) {
                /* virtual device for iop message transfer */
                arcmsr_handle_virtual_command(acb, cmd);
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 68138a647dfc..d9239c2d49b1 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -900,8 +900,9 @@ void hwi_ring_cq_db(struct beiscsi_hba *phba,
 static struct sgl_handle *alloc_io_sgl_handle(struct beiscsi_hba *phba)
 {
        struct sgl_handle *psgl_handle;
+        unsigned long flags;
-        spin_lock_bh(&phba->io_sgl_lock);
+        spin_lock_irqsave(&phba->io_sgl_lock, flags);
        if (phba->io_sgl_hndl_avbl) {
                beiscsi_log(phba, KERN_INFO, BEISCSI_LOG_IO,
                            "BM_%d : In alloc_io_sgl_handle,"
@@ -919,14 +920,16 @@ static struct sgl_handle *alloc_io_sgl_handle(struct beiscsi_hba *phba)
                        phba->io_sgl_alloc_index++;
        } else
                psgl_handle = NULL;
-        spin_unlock_bh(&phba->io_sgl_lock);
+        spin_unlock_irqrestore(&phba->io_sgl_lock, flags);
        return psgl_handle;
 }
 static void
 free_io_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
 {
-        spin_lock_bh(&phba->io_sgl_lock);
+        unsigned long flags;
+        spin_lock_irqsave(&phba->io_sgl_lock, flags);
        beiscsi_log(phba, KERN_INFO, BEISCSI_LOG_IO,
                    "BM_%d : In free_,io_sgl_free_index=%d\n",
                    phba->io_sgl_free_index);
@@ -941,7 +944,7 @@ free_io_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
                             "value there=%p\n", phba->io_sgl_free_index,
                             phba->io_sgl_hndl_base
                             [phba->io_sgl_free_index]);
-                 spin_unlock_bh(&phba->io_sgl_lock);
+                 spin_unlock_irqrestore(&phba->io_sgl_lock, flags);
                return;
        }
        phba->io_sgl_hndl_base[phba->io_sgl_free_index] = psgl_handle;
@@ -950,7 +953,7 @@ free_io_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
                phba->io_sgl_free_index = 0;
        else
                phba->io_sgl_free_index++;
-        spin_unlock_bh(&phba->io_sgl_lock);
+        spin_unlock_irqrestore(&phba->io_sgl_lock, flags);
 }
 static inline struct wrb_handle *
@@ -958,15 +961,16 @@ beiscsi_get_wrb_handle(struct hwi_wrb_context *pwrb_context,
                       unsigned int wrbs_per_cxn)
 {
        struct wrb_handle *pwrb_handle;
+        unsigned long flags;
-        spin_lock_bh(&pwrb_context->wrb_lock);
+        spin_lock_irqsave(&pwrb_context->wrb_lock, flags);
        pwrb_handle = pwrb_context->pwrb_handle_base[pwrb_context->alloc_index];
        pwrb_context->wrb_handles_available--;
        if (pwrb_context->alloc_index == (wrbs_per_cxn - 1))
                pwrb_context->alloc_index = 0;
        else
                pwrb_context->alloc_index++;
-        spin_unlock_bh(&pwrb_context->wrb_lock);
+        spin_unlock_irqrestore(&pwrb_context->wrb_lock, flags);
        if (pwrb_handle)
                memset(pwrb_handle->pwrb, 0, sizeof(*pwrb_handle->pwrb));
@@ -1001,14 +1005,16 @@ beiscsi_put_wrb_handle(struct hwi_wrb_context *pwrb_context,
                       struct wrb_handle *pwrb_handle,
                       unsigned int wrbs_per_cxn)
 {
-        spin_lock_bh(&pwrb_context->wrb_lock);
+        unsigned long flags;
+        spin_lock_irqsave(&pwrb_context->wrb_lock, flags);
        pwrb_context->pwrb_handle_base[pwrb_context->free_index] = pwrb_handle;
        pwrb_context->wrb_handles_available++;
        if (pwrb_context->free_index == (wrbs_per_cxn - 1))
                pwrb_context->free_index = 0;
        else
                pwrb_context->free_index++;
-        spin_unlock_bh(&pwrb_context->wrb_lock);
+        spin_unlock_irqrestore(&pwrb_context->wrb_lock, flags);
 }
 /**
@@ -1037,8 +1043,9 @@ free_wrb_handle(struct beiscsi_hba *phba, struct hwi_wrb_context *pwrb_context,
 static struct sgl_handle *alloc_mgmt_sgl_handle(struct beiscsi_hba *phba)
 {
        struct sgl_handle *psgl_handle;
+        unsigned long flags;
-        spin_lock_bh(&phba->mgmt_sgl_lock);
+        spin_lock_irqsave(&phba->mgmt_sgl_lock, flags);
        if (phba->eh_sgl_hndl_avbl) {
                psgl_handle = phba->eh_sgl_hndl_base[phba->eh_sgl_alloc_index];
                phba->eh_sgl_hndl_base[phba->eh_sgl_alloc_index] = NULL;
@@ -1056,14 +1063,16 @@ static struct sgl_handle *alloc_mgmt_sgl_handle(struct beiscsi_hba *phba)
                        phba->eh_sgl_alloc_index++;
        } else
                psgl_handle = NULL;
-        spin_unlock_bh(&phba->mgmt_sgl_lock);
+        spin_unlock_irqrestore(&phba->mgmt_sgl_lock, flags);
        return psgl_handle;
 }
 void
 free_mgmt_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
 {
-        spin_lock_bh(&phba->mgmt_sgl_lock);
+        unsigned long flags;
+        spin_lock_irqsave(&phba->mgmt_sgl_lock, flags);
        beiscsi_log(phba, KERN_INFO, BEISCSI_LOG_CONFIG,
                    "BM_%d : In  free_mgmt_sgl_handle,"
                    "eh_sgl_free_index=%d\n",
@@ -1078,7 +1087,7 @@ free_mgmt_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
                            "BM_%d : Double Free in eh SGL ,"
                            "eh_sgl_free_index=%d\n",
                            phba->eh_sgl_free_index);
-                spin_unlock_bh(&phba->mgmt_sgl_lock);
+                spin_unlock_irqrestore(&phba->mgmt_sgl_lock, flags);
                return;
        }
        phba->eh_sgl_hndl_base[phba->eh_sgl_free_index] = psgl_handle;
@@ -1088,7 +1097,7 @@ free_mgmt_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
                phba->eh_sgl_free_index = 0;
        else
                phba->eh_sgl_free_index++;
-        spin_unlock_bh(&phba->mgmt_sgl_lock);
+        spin_unlock_irqrestore(&phba->mgmt_sgl_lock, flags);
 }
 static void
diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c
index aebc4ddb3060..ac05317bba7f 100644
--- a/drivers/scsi/be2iscsi/be_mgmt.c
+++ b/drivers/scsi/be2iscsi/be_mgmt.c
@@ -1083,7 +1083,7 @@ unsigned int beiscsi_boot_get_sinfo(struct beiscsi_hba *phba)
        nonemb_cmd = &phba->boot_struct.nonemb_cmd;
        nonemb_cmd->size = sizeof(*resp);
        nonemb_cmd->va = pci_alloc_consistent(phba->ctrl.pdev,
-                                              sizeof(nonemb_cmd->size),
+                                              nonemb_cmd->size,
                                              &nonemb_cmd->dma);
        if (!nonemb_cmd->va) {
                mutex_unlock(&ctrl->mbox_lock);
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index d1421139e6ea..2ffe029ff2b6 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -2081,9 +2081,10 @@ void cxgbi_cleanup_task(struct iscsi_task *task)
        /*  never reached the xmit task callout */
        if (tdata->skb)
                __kfree_skb(tdata->skb);
-        memset(tdata, 0, sizeof(*tdata));
        task_release_itt(task, task->hdr_itt);
+        memset(tdata, 0, sizeof(*tdata));
        iscsi_tcp_cleanup_task(task);
 }
 EXPORT_SYMBOL_GPL(cxgbi_cleanup_task);
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 241829e59668..7bb20684e9fa 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -793,6 +793,7 @@ static void alua_rtpg_work(struct work_struct *work)
                WARN_ON(pg->flags & ALUA_PG_RUN_RTPG);
                WARN_ON(pg->flags & ALUA_PG_RUN_STPG);
                spin_unlock_irqrestore(&pg->lock, flags);
+                kref_put(&pg->kref, release_port_group);
                return;
        }
        if (pg->flags & ALUA_SYNC_STPG)
@@ -890,6 +891,7 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
                /* Do not queue if the worker is already running */
                if (!(pg->flags & ALUA_PG_RUNNING)) {
                        kref_get(&pg->kref);
+                        sdev = NULL;
                        start_queue = 1;
                }
        }
@@ -901,7 +903,8 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
        if (start_queue &&
            !queue_delayed_work(alua_wq, &pg->rtpg_work,
                                msecs_to_jiffies(ALUA_RTPG_DELAY_MSECS))) {
-                scsi_device_put(sdev);
+                if (sdev)
+                        scsi_device_put(sdev);
                kref_put(&pg->kref, release_port_group);
        }
 }
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index d007ec18179a..a1d6ab76a514 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2009,7 +2009,7 @@ static struct hpsa_scsi_dev_t *lookup_hpsa_scsi_dev(struct ctlr_info *h,
 static int hpsa_slave_alloc(struct scsi_device *sdev)
 {
-        struct hpsa_scsi_dev_t *sd;
+        struct hpsa_scsi_dev_t *sd = NULL;
        unsigned long flags;
        struct ctlr_info *h;
@@ -2026,7 +2026,8 @@ static int hpsa_slave_alloc(struct scsi_device *sdev)
                        sd->target = sdev_id(sdev);
                        sd->lun = sdev->lun;
                }
-        } else
+        }
+        if (!sd)
                sd = lookup_hpsa_scsi_dev(h, sdev_channel(sdev),
                                        sdev_id(sdev), sdev->lun);
@@ -3840,6 +3841,7 @@ static int hpsa_update_device_info(struct ctlr_info *h,
                sizeof(this_device->vendor));
        memcpy(this_device->model, &inq_buff[16],
                sizeof(this_device->model));
+        this_device->rev = inq_buff[2];
        memset(this_device->device_id, 0,
                sizeof(this_device->device_id));
        if (hpsa_get_device_id(h, scsi3addr, this_device->device_id, 8,
@@ -3929,10 +3931,14 @@ static void figure_bus_target_lun(struct ctlr_info *h,
        if (!is_logical_dev_addr_mode(lunaddrbytes)) {
                /* physical device, target and lun filled in later */
-                if (is_hba_lunid(lunaddrbytes))
+                if (is_hba_lunid(lunaddrbytes)) {
+                        int bus = HPSA_HBA_BUS;
+                        if (!device->rev)
+                                bus = HPSA_LEGACY_HBA_BUS;
                        hpsa_set_bus_target_lun(device,
-                                        HPSA_HBA_BUS, 0, lunid & 0x3fff);
+                                        bus, 0, lunid & 0x3fff);
-                else
+                } else
                        /* defer target, lun assignment for physical devices */
                        hpsa_set_bus_target_lun(device,
                                        HPSA_PHYSICAL_DEVICE_BUS, -1, -1);
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
index 82cdfad874f3..9ea162de80dc 100644
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -69,6 +69,7 @@ struct hpsa_scsi_dev_t {
        u64 sas_address;
        unsigned char vendor[8];        /* bytes 8-15 of inquiry data */
        unsigned char model[16];        /* bytes 16-31 of inquiry data */
+        unsigned char rev;              /* byte 2 of inquiry data */
        unsigned char raid_level;       /* from inquiry page 0xC1 */
        unsigned char volume_offline;   /* discovered via TUR or VPD */
        u16 queue_depth;                /* max queue_depth for this device */
@@ -402,6 +403,7 @@ struct offline_device_entry {
 #define HPSA_RAID_VOLUME_BUS            1
 #define HPSA_EXTERNAL_RAID_VOLUME_BUS   2
 #define HPSA_HBA_BUS                    0
+#define HPSA_LEGACY_HBA_BUS             3
 /*
        Send the command to the hardware
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index a8762a3efeef..532474109624 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -2586,7 +2586,6 @@ static void ipr_process_error(struct ipr_cmnd *ipr_cmd)
        struct ipr_hostrcb *hostrcb = ipr_cmd->u.hostrcb;
        u32 ioasc = be32_to_cpu(ipr_cmd->s.ioasa.hdr.ioasc);
        u32 fd_ioasc;
-        char *envp[] = { "ASYNC_ERR_LOG=1", NULL };
        if (ioa_cfg->sis64)
                fd_ioasc = be32_to_cpu(hostrcb->hcam.u.error64.fd_ioasc);
@@ -2607,8 +2606,8 @@ static void ipr_process_error(struct ipr_cmnd *ipr_cmd)
        }
        list_add_tail(&hostrcb->queue, &ioa_cfg->hostrcb_report_q);
+        schedule_work(&ioa_cfg->work_q);
        hostrcb = ipr_get_free_hostrcb(ioa_cfg);
-        kobject_uevent_env(&ioa_cfg->host->shost_dev.kobj, KOBJ_CHANGE, envp);
        ipr_send_hcam(ioa_cfg, IPR_HCAM_CDB_OP_CODE_LOG_DATA, hostrcb);
 }
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index 04ce7cfb6d1b..50c71678a156 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -308,7 +308,7 @@ struct fc_host_statistics *fc_get_host_stats(struct Scsi_Host *shost)
        fc_stats = &lport->host_stats;
        memset(fc_stats, 0, sizeof(struct fc_host_statistics));
-        fc_stats->seconds_since_last_reset = (lport->boot_time - jiffies) / HZ;
+        fc_stats->seconds_since_last_reset = (jiffies - lport->boot_time) / HZ;
        for_each_possible_cpu(cpu) {
                struct fc_stats *stats;
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index c051694bfcb0..f9b6fba689ff 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -791,9 +791,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
 free_task:
        /* regular RX path uses back_lock */
-        spin_lock_bh(&session->back_lock);
+        spin_lock(&session->back_lock);
        __iscsi_put_task(task);
-        spin_unlock_bh(&session->back_lock);
+        spin_unlock(&session->back_lock);
        return NULL;
 }
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index c5326055beee..f4f77c5b0c83 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -1323,18 +1323,20 @@ lpfc_sli_ringtxcmpl_put(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 {
        lockdep_assert_held(&phba->hbalock);
-        BUG_ON(!piocb || !piocb->vport);
+        BUG_ON(!piocb);
        list_add_tail(&piocb->list, &pring->txcmplq);
        piocb->iocb_flag |= LPFC_IO_ON_TXCMPLQ;
        if ((unlikely(pring->ringno == LPFC_ELS_RING)) &&
           (piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) &&
-           (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN) &&
+           (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN)) {
-            (!(piocb->vport->load_flag & FC_UNLOADING)))
+                BUG_ON(!piocb->vport);
-                mod_timer(&piocb->vport->els_tmofunc,
+                if (!(piocb->vport->load_flag & FC_UNLOADING))
-                          jiffies +
+                        mod_timer(&piocb->vport->els_tmofunc,
-                          msecs_to_jiffies(1000 * (phba->fc_ratov << 1)));
+                                  jiffies +
+                                  msecs_to_jiffies(1000 * (phba->fc_ratov << 1)));
+        }
        return 0;
 }
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index ca86c885dfaa..3aaea713bf37 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -2233,7 +2233,7 @@ struct megasas_instance_template {
 };
 #define MEGASAS_IS_LOGICAL(scp)                                         \
-        (scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1
+        ((scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1)
 #define MEGASAS_DEV_INDEX(scp)                                          \
        (((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) +   \
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 9ff57dee72d7..d8b1fbd4c8aa 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -1700,16 +1700,13 @@ megasas_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
                goto out_done;
        }
-        switch (scmd->cmnd[0]) {
+        /*
-        case SYNCHRONIZE_CACHE:
+         * FW takes care of flush cache on its own for Virtual Disk.
-                /*
+         * No need to send it down for VD. For JBOD send SYNCHRONIZE_CACHE to FW.
-                 * FW takes care of flush cache on its own
+         */
-                 * No need to send it down
+        if ((scmd->cmnd[0] == SYNCHRONIZE_CACHE) && MEGASAS_IS_LOGICAL(scmd)) {
-                 */
                scmd->result = DID_OK << 16;
                goto out_done;
-        default:
-                break;
        }
        return instance->instancet->build_and_issue_cmd(instance, scmd);
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 209a969a979d..1c4744e78173 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -1273,9 +1273,9 @@ scsih_target_alloc(struct scsi_target *starget)
                        sas_target_priv_data->handle = raid_device->handle;
                        sas_target_priv_data->sas_address = raid_device->wwid;
                        sas_target_priv_data->flags |= MPT_TARGET_FLAGS_VOLUME;
-                        sas_target_priv_data->raid_device = raid_device;
                        if (ioc->is_warpdrive)
-                                raid_device->starget = starget;
+                                sas_target_priv_data->raid_device = raid_device;
+                        raid_device->starget = starget;
                }
                spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
                return 0;
@@ -3885,6 +3885,11 @@ _scsih_temp_threshold_events(struct MPT3SAS_ADAPTER *ioc,
        }
 }
+static inline bool ata_12_16_cmd(struct scsi_cmnd *scmd)
+{
+        return (scmd->cmnd[0] == ATA_12 || scmd->cmnd[0] == ATA_16);
+}
 /**
 * _scsih_flush_running_cmds - completing outstanding commands.
 * @ioc: per adapter object
@@ -3906,6 +3911,9 @@ _scsih_flush_running_cmds(struct MPT3SAS_ADAPTER *ioc)
                if (!scmd)
                        continue;
                count++;
+                if (ata_12_16_cmd(scmd))
+                        scsi_internal_device_unblock(scmd->device,
+                                                        SDEV_RUNNING);
                mpt3sas_base_free_smid(ioc, smid);
                scsi_dma_unmap(scmd);
                if (ioc->pci_error_recovery)
@@ -4010,8 +4018,6 @@ _scsih_eedp_error_handling(struct scsi_cmnd *scmd, u16 ioc_status)
            SAM_STAT_CHECK_CONDITION;
 }
 /**
 * scsih_qcmd - main scsi request entry point
 * @scmd: pointer to scsi command object
@@ -4038,6 +4044,13 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
        if (ioc->logging_level & MPT_DEBUG_SCSI)
                scsi_print_command(scmd);
+        /*
+         * Lock the device for any subsequent command until command is
+         * done.
+         */
+        if (ata_12_16_cmd(scmd))
+                scsi_internal_device_block(scmd->device);
        sas_device_priv_data = scmd->device->hostdata;
        if (!sas_device_priv_data || !sas_device_priv_data->sas_target) {
                scmd->result = DID_NO_CONNECT << 16;
@@ -4613,6 +4626,9 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
        if (scmd == NULL)
                return 1;
+        if (ata_12_16_cmd(scmd))
+                scsi_internal_device_unblock(scmd->device, SDEV_RUNNING);
        mpi_request = mpt3sas_base_get_msg_frame(ioc, smid);
        if (mpi_reply == NULL) {
diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
index 86eb19902bac..c7cc8035eacb 100644
--- a/drivers/scsi/mvsas/mv_sas.c
+++ b/drivers/scsi/mvsas/mv_sas.c
@@ -791,8 +791,10 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
        slot->slot_tag = tag;
        slot->buf = pci_pool_alloc(mvi->dma_pool, GFP_ATOMIC, &slot->buf_dma);
-        if (!slot->buf)
+        if (!slot->buf) {
+                rc = -ENOMEM;
                goto err_out_tag;
+        }
        memset(slot->buf, 0, MVS_SLOT_BUF_SZ);
        tei.task = task;
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index ace65db1d2a2..56d6142852a5 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -707,6 +707,11 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
        srb_t *sp;
        int rval;
+        if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags))) {
+                cmd->result = DID_NO_CONNECT << 16;
+                goto qc24_fail_command;
+        }
        if (ha->flags.eeh_busy) {
                if (ha->flags.pci_channel_io_perm_failure) {
                        ql_dbg(ql_dbg_aer, vha, 0x9010,
@@ -1451,6 +1456,20 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
                        sp = req->outstanding_cmds[cnt];
                        if (sp) {
+                                /* Don't abort commands in adapter during EEH
+                                 * recovery as it's not accessible/responding.
+                                 */
+                                if (!ha->flags.eeh_busy) {
+                                        /* Get a reference to the sp and drop the lock.
+                                         * The reference ensures this sp->done() call
+                                         * - and not the call in qla2xxx_eh_abort() -
+                                         * ends the SCSI command (with result 'res').
+                                         */
+                                        sp_get(sp);
+                                        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                                        qla2xxx_eh_abort(GET_CMD_SP(sp));
+                                        spin_lock_irqsave(&ha->hardware_lock, flags);
+                                }
                                req->outstanding_cmds[cnt] = NULL;
                                sp->done(vha, sp, res);
                        }
@@ -2341,6 +2360,8 @@ qla2xxx_scan_finished(struct Scsi_Host *shost, unsigned long time)
 {
        scsi_qla_host_t *vha = shost_priv(shost);
+        if (test_bit(UNLOADING, &vha->dpc_flags))
+                return 1;
        if (!vha->host)
                return 1;
        if (time > vha->hw->loop_reset_delay * HZ)
diff --git a/drivers/scsi/qlogicpti.h b/drivers/scsi/qlogicpti.h
index 4377e87ee79c..892a0b058b99 100644
--- a/drivers/scsi/qlogicpti.h
+++ b/drivers/scsi/qlogicpti.h
@@ -356,8 +356,8 @@ struct qlogicpti {
        /* The rest of the elements are unimportant for performance. */
        struct qlogicpti         *next;
-        __u32                     res_dvma;             /* Ptr to RESPONSE bufs (DVMA)*/
+        dma_addr_t                res_dvma;             /* Ptr to RESPONSE bufs (DVMA)*/
-        __u32                     req_dvma;             /* Ptr to REQUEST bufs (DVMA) */
+        dma_addr_t                req_dvma;             /* Ptr to REQUEST bufs (DVMA) */
        u_char                    fware_majrev, fware_minrev, fware_micrev;
        struct Scsi_Host         *qhost;
        int                       qpti_id;
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index c905709707f0..cf04a364fd8b 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -5134,6 +5134,7 @@ static void __exit scsi_debug_exit(void)
        bus_unregister(&pseudo_lld_bus);
        root_device_unregister(pseudo_primary);
+        vfree(map_storep);
        vfree(dif_storep);
        vfree(fake_storep);
        kfree(sdebug_q_arr);
diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c
index 54d446c9f56e..b8d3b97b217a 100644
--- a/drivers/scsi/scsi_dh.c
+++ b/drivers/scsi/scsi_dh.c
@@ -36,9 +36,9 @@ struct scsi_dh_blist {
 };
 static const struct scsi_dh_blist scsi_dh_blist[] = {
-        {"DGC", "RAID",                 "clariion" },
+        {"DGC", "RAID",                 "emc" },
-        {"DGC", "DISK",                 "clariion" },
+        {"DGC", "DISK",                 "emc" },
-        {"DGC", "VRAID",                "clariion" },
+        {"DGC", "VRAID",                "emc" },
        {"COMPAQ", "MSA1000 VOLUME",    "hp_sw" },
        {"COMPAQ", "HSV110",            "hp_sw" },
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 212e98d940bc..6f7128f49c30 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1307,7 +1307,6 @@ static void scsi_sequential_lun_scan(struct scsi_target *starget,
 static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
                                enum scsi_scan_mode rescan)
 {
-        char devname[64];
        unsigned char scsi_cmd[MAX_COMMAND_SIZE];
        unsigned int length;
        u64 lun;
@@ -1349,9 +1348,6 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
                }
        }
-        sprintf(devname, "host %d channel %d id %d",
-                shost->host_no, sdev->channel, sdev->id);
        /*
         * Allocate enough to hold the header (the same size as one scsi_lun)
         * plus the number of luns we are requesting.  511 was the default
@@ -1470,12 +1466,12 @@ retry:
 out_err:
        kfree(lun_data);
 out:
-        scsi_device_put(sdev);
        if (scsi_device_created(sdev))
                /*
                 * the sdev we used didn't appear in the report luns scan
                 */
                __scsi_remove_device(sdev);
+        scsi_device_put(sdev);
        return ret;
 }
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 7af5226aa55b..618422ea3a41 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4922,9 +4922,8 @@ static int sgl_map_user_pages(struct st_buffer *STbp,
        res = get_user_pages_unlocked(
                uaddr,
                nr_pages,
-                rw == READ,
+                pages,
-                0, /* don't force */
+                rw == READ ? FOLL_WRITE : 0); /* don't force */
-                pages);
        /* Errors and no page mapped should return here */
        if (res < nr_pages)
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index 4a0d3cdc607c..15ca09cd16f3 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -793,6 +793,7 @@ static int pvscsi_abort(struct scsi_cmnd *cmd)
        unsigned long flags;
        int result = SUCCESS;
        DECLARE_COMPLETION_ONSTACK(abort_cmp);
+        int done;
        scmd_printk(KERN_DEBUG, cmd, "task abort on host %u, %p\n",
                    adapter->host->host_no, cmd);
@@ -824,10 +825,10 @@ static int pvscsi_abort(struct scsi_cmnd *cmd)
        pvscsi_abort_cmd(adapter, ctx);
        spin_unlock_irqrestore(&adapter->hw_lock, flags);
        /* Wait for 2 secs for the completion. */
-        wait_for_completion_timeout(&abort_cmp, msecs_to_jiffies(2000));
+        done = wait_for_completion_timeout(&abort_cmp, msecs_to_jiffies(2000));
        spin_lock_irqsave(&adapter->hw_lock, flags);
-        if (!completion_done(&abort_cmp)) {
+        if (!done) {
                /*
                 * Failed to abort the command, unmark the fact that it
                 * was requested to be aborted.
diff --git a/drivers/scsi/vmw_pvscsi.h b/drivers/scsi/vmw_pvscsi.h
index c097d2ccbde3..d41292ef85f2 100644
--- a/drivers/scsi/vmw_pvscsi.h
+++ b/drivers/scsi/vmw_pvscsi.h
@@ -26,7 +26,7 @@
 #include <linux/types.h>
-#define PVSCSI_DRIVER_VERSION_STRING   "1.0.6.0-k"
+#define PVSCSI_DRIVER_VERSION_STRING   "1.0.7.0-k"
 #define PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT 128
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 35c0dd945668..a67b0ff6a362 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -70,6 +70,7 @@
 #define SPI_SR                  0x2c
 #define SPI_SR_EOQF             0x10000000
 #define SPI_SR_TCFQF            0x80000000
+#define SPI_SR_CLEAR            0xdaad0000
 #define SPI_RSER                0x30
 #define SPI_RSER_EOQFE          0x10000000
@@ -646,6 +647,11 @@ static const struct regmap_config dspi_regmap_config = {
        .max_register = 0x88,
 };
+static void dspi_init(struct fsl_dspi *dspi)
+{
+        regmap_write(dspi->regmap, SPI_SR, SPI_SR_CLEAR);
+}
 static int dspi_probe(struct platform_device *pdev)
 {
        struct device_node *np = pdev->dev.of_node;
@@ -709,6 +715,7 @@ static int dspi_probe(struct platform_device *pdev)
                return PTR_ERR(dspi->regmap);
        }
+        dspi_init(dspi);
        dspi->irq = platform_get_irq(pdev, 0);
        if (dspi->irq < 0) {
                dev_err(&pdev->dev, "can't get platform irq\n");
diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
index 7451585a080e..2c175b9495f7 100644
--- a/drivers/spi/spi-fsl-espi.c
+++ b/drivers/spi/spi-fsl-espi.c
@@ -458,7 +458,7 @@ static void fsl_espi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events)
                mspi->len -= rx_nr_bytes;
-                if (mspi->rx)
+                if (rx_nr_bytes && mspi->rx)
                        mspi->get_rx(rx_data, mspi);
        }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 5787b723b593..838783c3fed0 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1618,9 +1618,11 @@ static void of_register_spi_devices(struct spi_master *master)
                if (of_node_test_and_set_flag(nc, OF_POPULATED))
                        continue;
                spi = of_register_spi_device(master, nc);
-                if (IS_ERR(spi))
+                if (IS_ERR(spi)) {
                        dev_warn(&master->dev, "Failed to create SPI device for %s\n",
                                nc->full_name);
+                        of_node_clear_flag(nc, OF_POPULATED);
+                }
        }
 }
 #else
@@ -3131,6 +3133,7 @@ static int of_spi_notify(struct notifier_block *nb, unsigned long action,
                if (IS_ERR(spi)) {
                        pr_err("%s: failed to create for '%s'\n",
                                        __func__, rd->dn->full_name);
+                        of_node_clear_flag(rd->dn, OF_POPULATED);
                        return notifier_from_errno(PTR_ERR(spi));
                }
                break;
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
index 396ded52ab70..209a8f7ef02b 100644
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -1187,8 +1187,10 @@ int ion_query_heaps(struct ion_client *client, struct ion_heap_query *query)
                hdata.type = heap->type;
                hdata.heap_id = heap->id;
-                ret = copy_to_user(&buffer[cnt],
+                if (copy_to_user(&buffer[cnt], &hdata, sizeof(hdata))) {
-                                   &hdata, sizeof(hdata));
+                        ret = -EFAULT;
+                        goto out;
+                }
                cnt++;
                if (cnt >= max_cnt)
diff --git a/drivers/staging/android/ion/ion_of.c b/drivers/staging/android/ion/ion_of.c
index 15bac92b7f04..46b2bb99bfd6 100644
--- a/drivers/staging/android/ion/ion_of.c
+++ b/drivers/staging/android/ion/ion_of.c
@@ -107,7 +107,7 @@ struct ion_platform_data *ion_parse_dt(struct platform_device *pdev,
                heap_pdev = of_platform_device_create(node, heaps[i].name,
                                                      &pdev->dev);
-                if (!pdev)
+                if (!heap_pdev)
                        return ERR_PTR(-ENOMEM);
                heap_pdev->dev.platform_data = &heaps[i];
diff --git a/drivers/staging/comedi/drivers/ni_tio.c b/drivers/staging/comedi/drivers/ni_tio.c
index 7043eb0543f6..5ab49a798164 100644
--- a/drivers/staging/comedi/drivers/ni_tio.c
+++ b/drivers/staging/comedi/drivers/ni_tio.c
@@ -207,7 +207,8 @@ static int ni_tio_clock_period_ps(const struct ni_gpct *counter,
                 * clock period is specified by user with prescaling
                 * already taken into account.
                 */
-                return counter->clock_period_ps;
+                *period_ps = counter->clock_period_ps;
+                return 0;
        }
        switch (generic_clock_source & NI_GPCT_PRESCALE_MODE_CLOCK_SRC_MASK) {
diff --git a/drivers/staging/greybus/arche-platform.c b/drivers/staging/greybus/arche-platform.c
index e36ee984485b..d33d6fe078ad 100644
--- a/drivers/staging/greybus/arche-platform.c
+++ b/drivers/staging/greybus/arche-platform.c
@@ -128,6 +128,7 @@ int arche_platform_change_state(enum arche_platform_state state,
        pdev = of_find_device_by_node(np);
        if (!pdev) {
                pr_err("arche-platform device not found\n");
+                of_node_put(np);
                return -ENODEV;
        }
@@ -185,6 +186,7 @@ int arche_platform_change_state(enum arche_platform_state state,
 exit:
        spin_unlock_irqrestore(&arche_pdata->wake_lock, flags);
        mutex_unlock(&arche_pdata->platform_state_mutex);
+        put_device(&pdev->dev);
        of_node_put(np);
        return ret;
 }
diff --git a/drivers/staging/greybus/es2.c b/drivers/staging/greybus/es2.c
index 071bb1cfd3ae..baab460eeaa3 100644
--- a/drivers/staging/greybus/es2.c
+++ b/drivers/staging/greybus/es2.c
@@ -1548,7 +1548,8 @@ static int ap_probe(struct usb_interface *interface,
        INIT_LIST_HEAD(&es2->arpcs);
        spin_lock_init(&es2->arpc_lock);
-        if (es2_arpc_in_enable(es2))
+        retval = es2_arpc_in_enable(es2);
+        if (retval)
                goto error;
        retval = gb_hd_add(hd);
diff --git a/drivers/staging/greybus/gpio.c b/drivers/staging/greybus/gpio.c
index 5e06e4229e42..250caa00de5e 100644
--- a/drivers/staging/greybus/gpio.c
+++ b/drivers/staging/greybus/gpio.c
@@ -702,15 +702,13 @@ static int gb_gpio_probe(struct gbphy_device *gbphy_dev,
        ret = gb_gpio_irqchip_add(gpio, irqc, 0,
                                   handle_level_irq, IRQ_TYPE_NONE);
        if (ret) {
-                dev_err(&connection->bundle->dev,
+                dev_err(&gbphy_dev->dev, "failed to add irq chip: %d\n", ret);
-                        "failed to add irq chip: %d\n", ret);
                goto exit_line_free;
        }
        ret = gpiochip_add(gpio);
        if (ret) {
-                dev_err(&connection->bundle->dev,
+                dev_err(&gbphy_dev->dev, "failed to add gpio chip: %d\n", ret);
-                        "failed to add gpio chip: %d\n", ret);
                goto exit_gpio_irqchip_remove;
        }
diff --git a/drivers/staging/greybus/module.c b/drivers/staging/greybus/module.c
index 69f67ddbd4a3..660b4674a76f 100644
--- a/drivers/staging/greybus/module.c
+++ b/drivers/staging/greybus/module.c
@@ -127,7 +127,7 @@ struct gb_module *gb_module_create(struct gb_host_device *hd, u8 module_id,
        return module;
 err_put_interfaces:
-        for (--i; i > 0; --i)
+        for (--i; i >= 0; --i)
                gb_interface_put(module->interfaces[i]);
        put_device(&module->dev);
diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
index 5ee7954bd9f9..2633d2bfb1b4 100644
--- a/drivers/staging/greybus/uart.c
+++ b/drivers/staging/greybus/uart.c
@@ -888,7 +888,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
        minor = alloc_minor(gb_tty);
        if (minor < 0) {
                if (minor == -ENOSPC) {
-                        dev_err(&connection->bundle->dev,
+                        dev_err(&gbphy_dev->dev,
                                "no more free minor numbers\n");
                        retval = -ENODEV;
                } else {
diff --git a/drivers/staging/iio/accel/sca3000_core.c b/drivers/staging/iio/accel/sca3000_core.c
index d626125d7af9..564b36d4f648 100644
--- a/drivers/staging/iio/accel/sca3000_core.c
+++ b/drivers/staging/iio/accel/sca3000_core.c
@@ -468,6 +468,8 @@ static inline int __sca3000_get_base_freq(struct sca3000_state *st,
        case SCA3000_MEAS_MODE_OP_2:
                *base_freq = info->option_mode_2_freq;
                break;
+        default:
+                ret = -EINVAL;
        }
 error_ret:
        return ret;
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 5eecf1cb1028..3892a7470410 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -655,6 +655,7 @@ static void ad5933_work(struct work_struct *work)
        __be16 buf[2];
        int val[2];
        unsigned char status;
+        int ret;
        mutex_lock(&indio_dev->mlock);
        if (st->state == AD5933_CTRL_INIT_START_FREQ) {
@@ -662,19 +663,22 @@ static void ad5933_work(struct work_struct *work)
                ad5933_cmd(st, AD5933_CTRL_START_SWEEP);
                st->state = AD5933_CTRL_START_SWEEP;
                schedule_delayed_work(&st->work, st->poll_time_jiffies);
-                mutex_unlock(&indio_dev->mlock);
+                goto out;
-                return;
        }
-        ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status);
+        ret = ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status);
+        if (ret)
+                goto out;
        if (status & AD5933_STAT_DATA_VALID) {
                int scan_count = bitmap_weight(indio_dev->active_scan_mask,
                                               indio_dev->masklength);
-                ad5933_i2c_read(st->client,
+                ret = ad5933_i2c_read(st->client,
                                test_bit(1, indio_dev->active_scan_mask) ?
                                AD5933_REG_REAL_DATA : AD5933_REG_IMAG_DATA,
                                scan_count * 2, (u8 *)buf);
+                if (ret)
+                        goto out;
                if (scan_count == 2) {
                        val[0] = be16_to_cpu(buf[0]);
@@ -686,8 +690,7 @@ static void ad5933_work(struct work_struct *work)
        } else {
                /* no data available - try again later */
                schedule_delayed_work(&st->work, st->poll_time_jiffies);
-                mutex_unlock(&indio_dev->mlock);
+                goto out;
-                return;
        }
        if (status & AD5933_STAT_SWEEP_DONE) {
@@ -700,7 +703,7 @@ static void ad5933_work(struct work_struct *work)
                ad5933_cmd(st, AD5933_CTRL_INC_FREQ);
                schedule_delayed_work(&st->work, st->poll_time_jiffies);
        }
+out:
        mutex_unlock(&indio_dev->mlock);
 }
diff --git a/drivers/staging/lustre/lustre/llite/lproc_llite.c b/drivers/staging/lustre/lustre/llite/lproc_llite.c
index 6eae60595905..23fda9d98bff 100644
--- a/drivers/staging/lustre/lustre/llite/lproc_llite.c
+++ b/drivers/staging/lustre/lustre/llite/lproc_llite.c
@@ -871,12 +871,10 @@ static ssize_t xattr_cache_store(struct kobject *kobj,
 }
 LUSTRE_RW_ATTR(xattr_cache);
-static ssize_t unstable_stats_show(struct kobject *kobj,
+static int ll_unstable_stats_seq_show(struct seq_file *m, void *v)
-                                   struct attribute *attr,
-                                   char *buf)
 {
-        struct ll_sb_info *sbi = container_of(kobj, struct ll_sb_info,
+        struct super_block     *sb    = m->private;
-                                              ll_kobj);
+        struct ll_sb_info      *sbi   = ll_s2sbi(sb);
        struct cl_client_cache *cache = sbi->ll_cache;
        long pages;
        int mb;
@@ -884,19 +882,21 @@ static ssize_t unstable_stats_show(struct kobject *kobj,
        pages = atomic_long_read(&cache->ccc_unstable_nr);
        mb = (pages * PAGE_SIZE) >> 20;
-        return sprintf(buf, "unstable_check:     %8d\n"
+        seq_printf(m,
-                            "unstable_pages: %12ld\n"
+                   "unstable_check:     %8d\n"
-                            "unstable_mb:        %8d\n",
+                   "unstable_pages: %12ld\n"
-                            cache->ccc_unstable_check, pages, mb);
+                   "unstable_mb:        %8d\n",
+                   cache->ccc_unstable_check, pages, mb);
+        return 0;
 }
-static ssize_t unstable_stats_store(struct kobject *kobj,
+static ssize_t ll_unstable_stats_seq_write(struct file *file,
-                                    struct attribute *attr,
+                                           const char __user *buffer,
-                                    const char *buffer,
+                                           size_t count, loff_t *off)
-                                    size_t count)
 {
-        struct ll_sb_info *sbi = container_of(kobj, struct ll_sb_info,
+        struct super_block *sb = ((struct seq_file *)file->private_data)->private;
-                                              ll_kobj);
+        struct ll_sb_info *sbi = ll_s2sbi(sb);
        char kernbuf[128];
        int val, rc;
@@ -922,7 +922,7 @@ static ssize_t unstable_stats_store(struct kobject *kobj,
        return count;
 }
-LUSTRE_RW_ATTR(unstable_stats);
+LPROC_SEQ_FOPS(ll_unstable_stats);
 static ssize_t root_squash_show(struct kobject *kobj, struct attribute *attr,
                                char *buf)
@@ -995,6 +995,7 @@ static struct lprocfs_vars lprocfs_llite_obd_vars[] = {
        /* { "filegroups",   lprocfs_rd_filegroups,  0, 0 }, */
        { "max_cached_mb",    &ll_max_cached_mb_fops, NULL },
        { "statahead_stats",  &ll_statahead_stats_fops, NULL, 0 },
+        { "unstable_stats",   &ll_unstable_stats_fops, NULL },
        { "sbi_flags",        &ll_sbi_flags_fops, NULL, 0 },
        { .name =               "nosquash_nids",
          .fops =               &ll_nosquash_nids_fops          },
@@ -1026,7 +1027,6 @@ static struct attribute *llite_attrs[] = {
        &lustre_attr_max_easize.attr,
        &lustre_attr_default_easize.attr,
        &lustre_attr_xattr_cache.attr,
-        &lustre_attr_unstable_stats.attr,
        &lustre_attr_root_squash.attr,
        NULL,
 };
diff --git a/drivers/staging/media/bcm2048/radio-bcm2048.c b/drivers/staging/media/bcm2048/radio-bcm2048.c
index ea15cc638097..4d9bd02ede47 100644
--- a/drivers/staging/media/bcm2048/radio-bcm2048.c
+++ b/drivers/staging/media/bcm2048/radio-bcm2048.c
@@ -482,6 +482,8 @@ static int bcm2048_set_rds_no_lock(struct bcm2048_device *bdev, u8 rds_on)
                                           flags);
                memset(&bdev->rds_info, 0, sizeof(bdev->rds_info));
        }
+        if (err)
+                return err;
        return bcm2048_send_command(bdev, BCM2048_I2C_FM_RDS_SYSTEM,
                                    bdev->cache_fm_rds_system);
diff --git a/drivers/staging/nvec/nvec_ps2.c b/drivers/staging/nvec/nvec_ps2.c
index a324322ee0ad..499952c8ef39 100644
--- a/drivers/staging/nvec/nvec_ps2.c
+++ b/drivers/staging/nvec/nvec_ps2.c
@@ -106,13 +106,12 @@ static int nvec_mouse_probe(struct platform_device *pdev)
 {
        struct nvec_chip *nvec = dev_get_drvdata(pdev->dev.parent);
        struct serio *ser_dev;
-        char mouse_reset[] = { NVEC_PS2, SEND_COMMAND, PSMOUSE_RST, 3 };
-        ser_dev = devm_kzalloc(&pdev->dev, sizeof(struct serio), GFP_KERNEL);
+        ser_dev = kzalloc(sizeof(struct serio), GFP_KERNEL);
        if (!ser_dev)
                return -ENOMEM;
-        ser_dev->id.type = SERIO_PS_PSTHRU;
+        ser_dev->id.type = SERIO_8042;
        ser_dev->write = ps2_sendcommand;
        ser_dev->start = ps2_startstreaming;
        ser_dev->stop = ps2_stopstreaming;
@@ -127,9 +126,6 @@ static int nvec_mouse_probe(struct platform_device *pdev)
        serio_register_port(ser_dev);
-        /* mouse reset */
-        nvec_write_async(nvec, mouse_reset, sizeof(mouse_reset));
        return 0;
 }
diff --git a/drivers/staging/sm750fb/ddk750_reg.h b/drivers/staging/sm750fb/ddk750_reg.h
index 955247979aaa..4ed6d8d7712a 100644
--- a/drivers/staging/sm750fb/ddk750_reg.h
+++ b/drivers/staging/sm750fb/ddk750_reg.h
@@ -601,13 +601,13 @@
 #define PANEL_PLANE_TL                                0x08001C
 #define PANEL_PLANE_TL_TOP_SHIFT                      16
-#define PANEL_PLANE_TL_TOP_MASK                       (0xeff << 16)
+#define PANEL_PLANE_TL_TOP_MASK                       (0x7ff << 16)
-#define PANEL_PLANE_TL_LEFT_MASK                      0xeff
+#define PANEL_PLANE_TL_LEFT_MASK                      0x7ff
 #define PANEL_PLANE_BR                                0x080020
 #define PANEL_PLANE_BR_BOTTOM_SHIFT                   16
-#define PANEL_PLANE_BR_BOTTOM_MASK                    (0xeff << 16)
+#define PANEL_PLANE_BR_BOTTOM_MASK                    (0x7ff << 16)
-#define PANEL_PLANE_BR_RIGHT_MASK                     0xeff
+#define PANEL_PLANE_BR_RIGHT_MASK                     0x7ff
 #define PANEL_HORIZONTAL_TOTAL                        0x080024
 #define PANEL_HORIZONTAL_TOTAL_TOTAL_SHIFT            16
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index c29040fdf9a7..1091b9f1dd07 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -423,8 +423,7 @@ create_pagelist(char __user *buf, size_t count, unsigned short type,
                actual_pages = get_user_pages(task, task->mm,
                                          (unsigned long)buf & ~(PAGE_SIZE - 1),
                                          num_pages,
-                                          (type == PAGELIST_READ) /*Write */ ,
+                                          (type == PAGELIST_READ) ? FOLL_WRITE : 0,
-                                          0 /*Force */ ,
                                          pages,
                                          NULL /*vmas */);
                up_read(&task->mm->mmap_sem);
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index e11c0e07471b..7b6cd4d80621 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -1477,8 +1477,7 @@ dump_phys_mem(void *virt_addr, uint32_t num_bytes)
                current->mm,              /* mm */
                (unsigned long)virt_addr, /* start */
                num_pages,                /* len */
-                0,                        /* write */
+                0,                        /* gup_flags */
-                0,                        /* force */
                pages,                    /* pages (array of page pointers) */
                NULL);                    /* vmas */
        up_read(&current->mm->mmap_sem);
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 78f5613e9467..6ab7443eabde 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -3388,7 +3388,6 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
        clients_count++;
-        destroy_workqueue(hif_workqueue);
 _fail_:
        return result;
 }
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 39b928c2849d..b7d747e92c7a 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1804,6 +1804,10 @@ int iscsit_process_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         * Otherwise, initiator is not expecting a NOPIN is response.
         * Just ignore for now.
         */
+        if (cmd)
+                iscsit_free_cmd(cmd, false);
        return 0;
 }
 EXPORT_SYMBOL(iscsit_process_nop_out);
@@ -2982,7 +2986,7 @@ iscsit_build_nopin_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
        pr_debug("Built NOPIN %s Response ITT: 0x%08x, TTT: 0x%08x,"
                " StatSN: 0x%08x, Length %u\n", (nopout_response) ?
-                "Solicitied" : "Unsolicitied", cmd->init_task_tag,
+                "Solicited" : "Unsolicited", cmd->init_task_tag,
                cmd->targ_xfer_tag, cmd->stat_sn, cmd->buf_ptr_size);
 }
 EXPORT_SYMBOL(iscsit_build_nopin_rsp);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index adf419fa4291..15f79a2ca34a 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -434,7 +434,7 @@ static int iscsi_login_zero_tsih_s2(
                /*
                 * Make MaxRecvDataSegmentLength PAGE_SIZE aligned for
-                 * Immediate Data + Unsolicitied Data-OUT if necessary..
+                 * Immediate Data + Unsolicited Data-OUT if necessary..
                 */
                param = iscsi_find_param_from_key("MaxRecvDataSegmentLength",
                                                  conn->param_list);
@@ -646,7 +646,7 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
 {
        struct iscsi_session *sess = conn->sess;
        /*
-         * FIXME: Unsolicitied NopIN support for ISER
+         * FIXME: Unsolicited NopIN support for ISER
         */
        if (conn->conn_transport->transport_type == ISCSI_INFINIBAND)
                return;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 6094a6beddde..7dfefd66df93 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -754,15 +754,7 @@ EXPORT_SYMBOL(target_complete_cmd);
 void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length)
 {
-        if (scsi_status != SAM_STAT_GOOD) {
+        if (scsi_status == SAM_STAT_GOOD && length < cmd->data_length) {
-                return;
-        }
-        /*
-         * Calculate new residual count based upon length of SCSI data
-         * transferred.
-         */
-        if (length < cmd->data_length) {
                if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
                        cmd->residual_count += cmd->data_length - length;
                } else {
@@ -771,12 +763,6 @@ void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int len
                }
                cmd->data_length = length;
-        } else if (length > cmd->data_length) {
-                cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
-                cmd->residual_count = length - cmd->data_length;
-        } else {
-                cmd->se_cmd_flags &= ~(SCF_OVERFLOW_BIT | SCF_UNDERFLOW_BIT);
-                cmd->residual_count = 0;
        }
        target_complete_cmd(cmd, scsi_status);
@@ -1706,6 +1692,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
        case TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED:
        case TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED:
        case TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED:
+        case TCM_COPY_TARGET_DEVICE_NOT_REACHABLE:
                break;
        case TCM_OUT_OF_RESOURCES:
                sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
@@ -2547,8 +2534,12 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
         * fabric acknowledgement that requires two target_put_sess_cmd()
         * invocations before se_cmd descriptor release.
         */
-        if (ack_kref)
+        if (ack_kref) {
-                kref_get(&se_cmd->cmd_kref);
+                if (!kref_get_unless_zero(&se_cmd->cmd_kref))
+                        return -EINVAL;
+                se_cmd->se_cmd_flags |= SCF_ACK_KREF;
+        }
        spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
        if (se_sess->sess_tearing_down) {
@@ -2627,7 +2618,7 @@ EXPORT_SYMBOL(target_put_sess_cmd);
 */
 void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
 {
-        struct se_cmd *se_cmd;
+        struct se_cmd *se_cmd, *tmp_cmd;
        unsigned long flags;
        int rc;
@@ -2639,14 +2630,16 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
        se_sess->sess_tearing_down = 1;
        list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list);
-        list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list) {
+        list_for_each_entry_safe(se_cmd, tmp_cmd,
+                                 &se_sess->sess_wait_list, se_cmd_list) {
                rc = kref_get_unless_zero(&se_cmd->cmd_kref);
                if (rc) {
                        se_cmd->cmd_wait_set = 1;
                        spin_lock(&se_cmd->t_state_lock);
                        se_cmd->transport_state |= CMD_T_FABRIC_STOP;
                        spin_unlock(&se_cmd->t_state_lock);
-                }
+                } else
+                        list_del_init(&se_cmd->se_cmd_list);
        }
        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
@@ -2871,6 +2864,12 @@ static const struct sense_info sense_info_table[] = {
                .ascq = 0x03, /* LOGICAL BLOCK REFERENCE TAG CHECK FAILED */
                .add_sector_info = true,
        },
+        [TCM_COPY_TARGET_DEVICE_NOT_REACHABLE] = {
+                .key = COPY_ABORTED,
+                .asc = 0x0d,
+                .ascq = 0x02, /* COPY TARGET DEVICE NOT REACHABLE */
+        },
        [TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE] = {
                /*
                 * Returning ILLEGAL REQUEST would cause immediate IO errors on
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 62bf4fe5704a..47562509b489 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -96,7 +96,7 @@ struct tcmu_dev {
        size_t dev_size;
        u32 cmdr_size;
        u32 cmdr_last_cleaned;
-        /* Offset of data ring from start of mb */
+        /* Offset of data area from start of mb */
        /* Must add data_off and mb_addr to get the address */
        size_t data_off;
        size_t data_size;
@@ -349,7 +349,7 @@ static inline size_t spc_bitmap_free(unsigned long *bitmap)
 /*
 * We can't queue a command until we have space available on the cmd ring *and*
- * space available on the data ring.
+ * space available on the data area.
 *
 * Called with ring lock held.
 */
@@ -389,7 +389,8 @@ static bool is_ring_space_avail(struct tcmu_dev *udev, size_t cmd_size, size_t d
        return true;
 }
-static int tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
+static sense_reason_t
+tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
 {
        struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
        struct se_cmd *se_cmd = tcmu_cmd->se_cmd;
@@ -405,7 +406,7 @@ static int tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
        DECLARE_BITMAP(old_bitmap, DATA_BLOCK_BITS);
        if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags))
-                return -EINVAL;
+                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
        /*
         * Must be a certain minimum size for response sense info, but
@@ -432,11 +433,14 @@ static int tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
                BUG_ON(!(se_cmd->t_bidi_data_sg && se_cmd->t_bidi_data_nents));
                data_length += se_cmd->t_bidi_data_sg->length;
        }
-        if ((command_size > (udev->cmdr_size / 2))
+        if ((command_size > (udev->cmdr_size / 2)) ||
-            || data_length > udev->data_size)
+            data_length > udev->data_size) {
-                pr_warn("TCMU: Request of size %zu/%zu may be too big for %u/%zu "
+                pr_warn("TCMU: Request of size %zu/%zu is too big for %u/%zu "
-                        "cmd/data ring buffers\n", command_size, data_length,
+                        "cmd ring/data area\n", command_size, data_length,
                        udev->cmdr_size, udev->data_size);
+                spin_unlock_irq(&udev->cmdr_lock);
+                return TCM_INVALID_CDB_FIELD;
+        }
        while (!is_ring_space_avail(udev, command_size, data_length)) {
                int ret;
@@ -450,7 +454,7 @@ static int tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
                finish_wait(&udev->wait_cmdr, &__wait);
                if (!ret) {
                        pr_warn("tcmu: command timed out\n");
-                        return -ETIMEDOUT;
+                        return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                }
                spin_lock_irq(&udev->cmdr_lock);
@@ -487,9 +491,7 @@ static int tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
        bitmap_copy(old_bitmap, udev->data_bitmap, DATA_BLOCK_BITS);
-        /*
+        /* Handle allocating space from the data area */
-         * Fix up iovecs, and handle if allocation in data ring wrapped.
-         */
        iov = &entry->req.iov[0];
        iov_cnt = 0;
        copy_to_data_area = (se_cmd->data_direction == DMA_TO_DEVICE
@@ -526,10 +528,11 @@ static int tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
        mod_timer(&udev->timeout,
                round_jiffies_up(jiffies + msecs_to_jiffies(TCMU_TIME_OUT)));
-        return 0;
+        return TCM_NO_SENSE;
 }
-static int tcmu_queue_cmd(struct se_cmd *se_cmd)
+static sense_reason_t
+tcmu_queue_cmd(struct se_cmd *se_cmd)
 {
        struct se_device *se_dev = se_cmd->se_dev;
        struct tcmu_dev *udev = TCMU_DEV(se_dev);
@@ -538,10 +541,10 @@ static int tcmu_queue_cmd(struct se_cmd *se_cmd)
        tcmu_cmd = tcmu_alloc_cmd(se_cmd);
        if (!tcmu_cmd)
-                return -ENOMEM;
+                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
        ret = tcmu_queue_cmd_ring(tcmu_cmd);
-        if (ret < 0) {
+        if (ret != TCM_NO_SENSE) {
                pr_err("TCMU: Could not queue command\n");
                spin_lock_irq(&udev->commands_lock);
                idr_remove(&udev->commands, tcmu_cmd->cmd_id);
@@ -561,7 +564,7 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
        if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
                /*
                 * cmd has been completed already from timeout, just reclaim
-                 * data ring space and free cmd
+                 * data area space and free cmd
                 */
                free_data_area(udev, cmd);
@@ -1129,20 +1132,9 @@ static sector_t tcmu_get_blocks(struct se_device *dev)
 }
 static sense_reason_t
-tcmu_pass_op(struct se_cmd *se_cmd)
-{
-        int ret = tcmu_queue_cmd(se_cmd);
-        if (ret != 0)
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-        else
-                return TCM_NO_SENSE;
-}
-static sense_reason_t
 tcmu_parse_cdb(struct se_cmd *cmd)
 {
-        return passthrough_parse_cdb(cmd, tcmu_pass_op);
+        return passthrough_parse_cdb(cmd, tcmu_queue_cmd);
 }
 static const struct target_backend_ops tcmu_ops = {
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index 75cd85426ae3..094a1440eacb 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -104,7 +104,7 @@ static int target_xcopy_locate_se_dev_e4(struct se_cmd *se_cmd, struct xcopy_op
        }
        mutex_unlock(&g_device_mutex);
-        pr_err("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
+        pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
        return -EINVAL;
 }
@@ -185,7 +185,7 @@ static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op
 static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
                                struct xcopy_op *xop, unsigned char *p,
-                                unsigned short tdll)
+                                unsigned short tdll, sense_reason_t *sense_ret)
 {
        struct se_device *local_dev = se_cmd->se_dev;
        unsigned char *desc = p;
@@ -193,6 +193,8 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
        unsigned short start = 0;
        bool src = true;
+        *sense_ret = TCM_INVALID_PARAMETER_LIST;
        if (offset != 0) {
                pr_err("XCOPY target descriptor list length is not"
                        " multiple of %d\n", XCOPY_TARGET_DESC_LEN);
@@ -243,9 +245,16 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
                rc = target_xcopy_locate_se_dev_e4(se_cmd, xop, true);
        else
                rc = target_xcopy_locate_se_dev_e4(se_cmd, xop, false);
+        /*
-        if (rc < 0)
+         * If a matching IEEE NAA 0x83 descriptor for the requested device
+         * is not located on this node, return COPY_ABORTED with ASQ/ASQC
+         * 0x0d/0x02 - COPY_TARGET_DEVICE_NOT_REACHABLE to request the
+         * initiator to fall back to normal copy method.
+         */
+        if (rc < 0) {
+                *sense_ret = TCM_COPY_TARGET_DEVICE_NOT_REACHABLE;
                goto out;
+        }
        pr_debug("XCOPY TGT desc: Source dev: %p NAA IEEE WWN: 0x%16phN\n",
                 xop->src_dev, &xop->src_tid_wwn[0]);
@@ -653,6 +662,7 @@ static int target_xcopy_read_source(
        rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, src_dev, &cdb[0],
                                remote_port, true);
        if (rc < 0) {
+                ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
                transport_generic_free_cmd(se_cmd, 0);
                return rc;
        }
@@ -664,6 +674,7 @@ static int target_xcopy_read_source(
        rc = target_xcopy_issue_pt_cmd(xpt_cmd);
        if (rc < 0) {
+                ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
                transport_generic_free_cmd(se_cmd, 0);
                return rc;
        }
@@ -714,6 +725,7 @@ static int target_xcopy_write_destination(
                                remote_port, false);
        if (rc < 0) {
                struct se_cmd *src_cmd = &xop->src_pt_cmd->se_cmd;
+                ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
                /*
                 * If the failure happened before the t_mem_list hand-off in
                 * target_xcopy_setup_pt_cmd(), Reset memory + clear flag so that
@@ -729,6 +741,7 @@ static int target_xcopy_write_destination(
        rc = target_xcopy_issue_pt_cmd(xpt_cmd);
        if (rc < 0) {
+                ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
                se_cmd->se_cmd_flags &= ~SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC;
                transport_generic_free_cmd(se_cmd, 0);
                return rc;
@@ -815,9 +828,14 @@ static void target_xcopy_do_work(struct work_struct *work)
 out:
        xcopy_pt_undepend_remotedev(xop);
        kfree(xop);
+        /*
-        pr_warn("target_xcopy_do_work: Setting X-COPY CHECK_CONDITION -> sending response\n");
+         * Don't override an error scsi status if it has already been set
-        ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+         */
+        if (ec_cmd->scsi_status == SAM_STAT_GOOD) {
+                pr_warn_ratelimited("target_xcopy_do_work: rc: %d, Setting X-COPY"
+                        " CHECK_CONDITION -> sending response\n", rc);
+                ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+        }
        target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION);
 }
@@ -875,7 +893,7 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
                " tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
                tdll, sdll, inline_dl);
-        rc = target_xcopy_parse_target_descriptors(se_cmd, xop, &p[16], tdll);
+        rc = target_xcopy_parse_target_descriptors(se_cmd, xop, &p[16], tdll, &ret);
        if (rc <= 0)
                goto out;
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 216e18cc9133..ff5de9a96643 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -572,10 +572,10 @@ static void ft_send_work(struct work_struct *work)
        if (target_submit_cmd(&cmd->se_cmd, cmd->sess->se_sess, fcp->fc_cdb,
                              &cmd->ft_sense_buffer[0], scsilun_to_int(&fcp->fc_lun),
                              ntohl(fcp->fc_dl), task_attr, data_dir,
-                              TARGET_SCF_ACK_KREF))
+                              TARGET_SCF_ACK_KREF | TARGET_SCF_USE_CPUID))
                goto err;
-        pr_debug("r_ctl %x alloc target_submit_cmd\n", fh->fh_r_ctl);
+        pr_debug("r_ctl %x target_submit_cmd %p\n", fh->fh_r_ctl, cmd);
        return;
 err:
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index 6ffbb603d912..fd5c3de79470 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -39,6 +39,11 @@
 #include "tcm_fc.h"
+#define TFC_SESS_DBG(lport, fmt, args...) \
+        pr_debug("host%u: rport %6.6x: " fmt,      \
+                 (lport)->host->host_no,           \
+                 (lport)->port_id, ##args )
 static void ft_sess_delete_all(struct ft_tport *);
 /*
@@ -167,24 +172,29 @@ static struct ft_sess *ft_sess_get(struct fc_lport *lport, u32 port_id)
        struct ft_tport *tport;
        struct hlist_head *head;
        struct ft_sess *sess;
+        char *reason = "no session created";
        rcu_read_lock();
        tport = rcu_dereference(lport->prov[FC_TYPE_FCP]);
-        if (!tport)
+        if (!tport) {
+                reason = "not an FCP port";
                goto out;
+        }
        head = &tport->hash[ft_sess_hash(port_id)];
        hlist_for_each_entry_rcu(sess, head, hash) {
                if (sess->port_id == port_id) {
                        kref_get(&sess->kref);
                        rcu_read_unlock();
-                        pr_debug("port_id %x found %p\n", port_id, sess);
+                        TFC_SESS_DBG(lport, "port_id %x found %p\n",
+                                     port_id, sess);
                        return sess;
                }
        }
 out:
        rcu_read_unlock();
-        pr_debug("port_id %x not found\n", port_id);
+        TFC_SESS_DBG(lport, "port_id %x not found, %s\n",
+                     port_id, reason);
        return NULL;
 }
@@ -195,7 +205,7 @@ static int ft_sess_alloc_cb(struct se_portal_group *se_tpg,
        struct ft_tport *tport = sess->tport;
        struct hlist_head *head = &tport->hash[ft_sess_hash(sess->port_id)];
-        pr_debug("port_id %x sess %p\n", sess->port_id, sess);
+        TFC_SESS_DBG(tport->lport, "port_id %x sess %p\n", sess->port_id, sess);
        hlist_add_head_rcu(&sess->hash, head);
        tport->sess_count++;
@@ -223,7 +233,7 @@ static struct ft_sess *ft_sess_create(struct ft_tport *tport, u32 port_id,
        sess = kzalloc(sizeof(*sess), GFP_KERNEL);
        if (!sess)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        kref_init(&sess->kref); /* ref for table entry */
        sess->tport = tport;
@@ -234,8 +244,9 @@ static struct ft_sess *ft_sess_create(struct ft_tport *tport, u32 port_id,
                                             TARGET_PROT_NORMAL, &initiatorname[0],
                                             sess, ft_sess_alloc_cb);
        if (IS_ERR(sess->se_sess)) {
+                int rc = PTR_ERR(sess->se_sess);
                kfree(sess);
-                return NULL;
+                sess = ERR_PTR(rc);
        }
        return sess;
 }
@@ -319,7 +330,7 @@ void ft_sess_close(struct se_session *se_sess)
                mutex_unlock(&ft_lport_lock);
                return;
        }
-        pr_debug("port_id %x\n", port_id);
+        TFC_SESS_DBG(sess->tport->lport, "port_id %x close session\n", port_id);
        ft_sess_unhash(sess);
        mutex_unlock(&ft_lport_lock);
        ft_close_sess(sess);
@@ -379,8 +390,13 @@ static int ft_prli_locked(struct fc_rport_priv *rdata, u32 spp_len,
                if (!(fcp_parm & FCP_SPPF_INIT_FCN))
                        return FC_SPP_RESP_CONF;
                sess = ft_sess_create(tport, rdata->ids.port_id, rdata);
-                if (!sess)
+                if (IS_ERR(sess)) {
-                        return FC_SPP_RESP_RES;
+                        if (PTR_ERR(sess) == -EACCES) {
+                                spp->spp_flags &= ~FC_SPP_EST_IMG_PAIR;
+                                return FC_SPP_RESP_CONF;
+                        } else
+                                return FC_SPP_RESP_RES;
+                }
                if (!sess->params)
                        rdata->prli_count++;
                sess->params = fcp_parm;
@@ -423,8 +439,8 @@ static int ft_prli(struct fc_rport_priv *rdata, u32 spp_len,
        mutex_lock(&ft_lport_lock);
        ret = ft_prli_locked(rdata, spp_len, rspp, spp);
        mutex_unlock(&ft_lport_lock);
-        pr_debug("port_id %x flags %x ret %x\n",
+        TFC_SESS_DBG(rdata->local_port, "port_id %x flags %x ret %x\n",
-               rdata->ids.port_id, rspp ? rspp->spp_flags : 0, ret);
+                     rdata->ids.port_id, rspp ? rspp->spp_flags : 0, ret);
        return ret;
 }
@@ -477,11 +493,11 @@ static void ft_recv(struct fc_lport *lport, struct fc_frame *fp)
        struct ft_sess *sess;
        u32 sid = fc_frame_sid(fp);
-        pr_debug("sid %x\n", sid);
+        TFC_SESS_DBG(lport, "recv sid %x\n", sid);
        sess = ft_sess_get(lport, sid);
        if (!sess) {
-                pr_debug("sid %x sess lookup failed\n", sid);
+                TFC_SESS_DBG(lport, "sid %x sess lookup failed\n", sid);
                /* TBD XXX - if FCP_CMND, send PRLO */
                fc_frame_free(fp);
                return;
diff --git a/drivers/thermal/intel_pch_thermal.c b/drivers/thermal/intel_pch_thermal.c
index 9b4815e81b0d..19bf2028e508 100644
--- a/drivers/thermal/intel_pch_thermal.c
+++ b/drivers/thermal/intel_pch_thermal.c
@@ -20,10 +20,13 @@
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/acpi.h>
 #include <linux/thermal.h>
 #include <linux/pm.h>
 /* Intel PCH thermal Device IDs */
+#define PCH_THERMAL_DID_HSW_1   0x9C24 /* Haswell PCH */
+#define PCH_THERMAL_DID_HSW_2   0x8C24 /* Haswell PCH */
 #define PCH_THERMAL_DID_WPT     0x9CA4 /* Wildcat Point */
 #define PCH_THERMAL_DID_SKL     0x9D31 /* Skylake PCH */
@@ -66,9 +69,53 @@ struct pch_thermal_device {
        unsigned long crt_temp;
        int hot_trip_id;
        unsigned long hot_temp;
+        int psv_trip_id;
+        unsigned long psv_temp;
        bool bios_enabled;
 };
+#ifdef CONFIG_ACPI
+/*
+ * On some platforms, there is a companion ACPI device, which adds
+ * passive trip temperature using _PSV method. There is no specific
+ * passive temperature setting in MMIO interface of this PCI device.
+ */
+static void pch_wpt_add_acpi_psv_trip(struct pch_thermal_device *ptd,
+                                      int *nr_trips)
+{
+        struct acpi_device *adev;
+        ptd->psv_trip_id = -1;
+        adev = ACPI_COMPANION(&ptd->pdev->dev);
+        if (adev) {
+                unsigned long long r;
+                acpi_status status;
+                status = acpi_evaluate_integer(adev->handle, "_PSV", NULL,
+                                               &r);
+                if (ACPI_SUCCESS(status)) {
+                        unsigned long trip_temp;
+                        trip_temp = DECI_KELVIN_TO_MILLICELSIUS(r);
+                        if (trip_temp) {
+                                ptd->psv_temp = trip_temp;
+                                ptd->psv_trip_id = *nr_trips;
+                                ++(*nr_trips);
+                        }
+                }
+        }
+}
+#else
+static void pch_wpt_add_acpi_psv_trip(struct pch_thermal_device *ptd,
+                                      int *nr_trips)
+{
+        ptd->psv_trip_id = -1;
+}
+#endif
 static int pch_wpt_init(struct pch_thermal_device *ptd, int *nr_trips)
 {
        u8 tsel;
@@ -119,6 +166,8 @@ read_trips:
                ++(*nr_trips);
        }
+        pch_wpt_add_acpi_psv_trip(ptd, nr_trips);
        return 0;
 }
@@ -194,6 +243,8 @@ static int pch_get_trip_type(struct thermal_zone_device *tzd, int trip,
                *type = THERMAL_TRIP_CRITICAL;
        else if (ptd->hot_trip_id == trip)
                *type = THERMAL_TRIP_HOT;
+        else if (ptd->psv_trip_id == trip)
+                *type = THERMAL_TRIP_PASSIVE;
        else
                return -EINVAL;
@@ -208,6 +259,8 @@ static int pch_get_trip_temp(struct thermal_zone_device *tzd, int trip, int *tem
                *temp = ptd->crt_temp;
        else if (ptd->hot_trip_id == trip)
                *temp = ptd->hot_temp;
+        else if (ptd->psv_trip_id == trip)
+                *temp = ptd->psv_temp;
        else
                return -EINVAL;
@@ -242,6 +295,11 @@ static int intel_pch_thermal_probe(struct pci_dev *pdev,
                ptd->ops = &pch_dev_ops_wpt;
                dev_name = "pch_skylake";
                break;
+        case PCH_THERMAL_DID_HSW_1:
+        case PCH_THERMAL_DID_HSW_2:
+                ptd->ops = &pch_dev_ops_wpt;
+                dev_name = "pch_haswell";
+                break;
        default:
                dev_err(&pdev->dev, "unknown pch thermal device\n");
                return -ENODEV;
@@ -324,6 +382,8 @@ static int intel_pch_thermal_resume(struct device *device)
 static struct pci_device_id intel_pch_thermal_id[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_WPT) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_SKL) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_HSW_1) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_HSW_2) },
        { 0, },
 };
 MODULE_DEVICE_TABLE(pci, intel_pch_thermal_id);
diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
index 0e4dc0afcfd2..afada655f861 100644
--- a/drivers/thermal/intel_powerclamp.c
+++ b/drivers/thermal/intel_powerclamp.c
@@ -669,20 +669,17 @@ static struct thermal_cooling_device_ops powerclamp_cooling_ops = {
        .set_cur_state = powerclamp_set_cur_state,
 };
-static const struct x86_cpu_id intel_powerclamp_ids[] __initconst = {
+static const struct x86_cpu_id __initconst intel_powerclamp_ids[] = {
        { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_MWAIT },
-        { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_ARAT },
-        { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_NONSTOP_TSC },
-        { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_CONSTANT_TSC},
        {}
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_powerclamp_ids);
 static int __init powerclamp_probe(void)
 {
        if (!x86_match_cpu(intel_powerclamp_ids)) {
-                pr_err("Intel powerclamp does not run on family %d model %d\n",
+                pr_err("CPU does not support MWAIT");
-                                boot_cpu_data.x86, boot_cpu_data.x86_model);
                return -ENODEV;
        }
diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c
index 886fcf37f291..b9923464599f 100644
--- a/drivers/tty/serial/8250/8250_lpss.c
+++ b/drivers/tty/serial/8250/8250_lpss.c
@@ -213,7 +213,7 @@ static int qrk_serial_setup(struct lpss8250 *lpss, struct uart_port *port)
        struct pci_dev *pdev = to_pci_dev(port->dev);
        int ret;
-        ret = pci_alloc_irq_vectors(pdev, 1, 1, 0);
+        ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
        if (ret < 0)
                return ret;
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 1bfb6fdbaa20..1731b98d2471 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -83,7 +83,8 @@ static const struct serial8250_config uart_config[] = {
                .name           = "16550A",
                .fifo_size      = 16,
                .tx_loadsz      = 16,
-                .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
+                .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10 |
+                                  UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT,
                .rxtrig_bytes   = {1, 4, 8, 14},
                .flags          = UART_CAP_FIFO,
        },
diff --git a/drivers/tty/serial/8250/8250_uniphier.c b/drivers/tty/serial/8250/8250_uniphier.c
index b8d9c8c9d02a..417d9e7038e1 100644
--- a/drivers/tty/serial/8250/8250_uniphier.c
+++ b/drivers/tty/serial/8250/8250_uniphier.c
@@ -99,7 +99,7 @@ static void uniphier_serial_out(struct uart_port *p, int offset, int value)
        case UART_LCR:
                valshift = UNIPHIER_UART_LCR_SHIFT;
                /* Divisor latch access bit does not exist. */
-                value &= ~(UART_LCR_DLAB << valshift);
+                value &= ~UART_LCR_DLAB;
                /* fall through */
        case UART_MCR:
                offset = UNIPHIER_UART_LCR_MCR;
@@ -199,7 +199,7 @@ static int uniphier_uart_probe(struct platform_device *pdev)
        regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!regs) {
-                dev_err(dev, "failed to get memory resource");
+                dev_err(dev, "failed to get memory resource\n");
                return -EINVAL;
        }
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index c7831407a882..25c1d7bc0100 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1625,6 +1625,7 @@ config SERIAL_SPRD_CONSOLE
 config SERIAL_STM32
        tristate "STMicroelectronics STM32 serial port support"
        select SERIAL_CORE
+        depends on HAS_DMA
        depends on ARM || COMPILE_TEST
        help
          This driver is for the on-chip Serial Controller on
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index fd8aa1f4ba78..168b10cad47b 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -2132,11 +2132,29 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
                mode |= ATMEL_US_USMODE_RS485;
        } else if (termios->c_cflag & CRTSCTS) {
                /* RS232 with hardware handshake (RTS/CTS) */
-                if (atmel_use_dma_rx(port) && !atmel_use_fifo(port)) {
+                if (atmel_use_fifo(port) &&
-                        dev_info(port->dev, "not enabling hardware flow control because DMA is used");
+                    !mctrl_gpio_to_gpiod(atmel_port->gpios, UART_GPIO_CTS)) {
-                        termios->c_cflag &= ~CRTSCTS;
+                        /*
-                } else {
+                         * with ATMEL_US_USMODE_HWHS set, the controller will
+                         * be able to drive the RTS pin high/low when the RX
+                         * FIFO is above RXFTHRES/below RXFTHRES2.
+                         * It will also disable the transmitter when the CTS
+                         * pin is high.
+                         * This mode is not activated if CTS pin is a GPIO
+                         * because in this case, the transmitter is always
+                         * disabled (there must be an internal pull-up
+                         * responsible for this behaviour).
+                         * If the RTS pin is a GPIO, the controller won't be
+                         * able to drive it according to the FIFO thresholds,
+                         * but it will be handled by the driver.
+                         */
                        mode |= ATMEL_US_USMODE_HWHS;
+                } else {
+                        /*
+                         * For platforms without FIFO, the flow control is
+                         * handled by the driver.
+                         */
+                        mode |= ATMEL_US_USMODE_NORMAL;
                }
        } else {
                /* RS232 without hadware handshake */
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index de9d5107c00a..76103f2c4a80 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -328,7 +328,7 @@ static void lpuart_dma_tx(struct lpuart_port *sport)
        sport->dma_tx_bytes = uart_circ_chars_pending(xmit);
-        if (xmit->tail < xmit->head) {
+        if (xmit->tail < xmit->head || xmit->head == 0) {
                sport->dma_tx_nents = 1;
                sg_init_one(sgl, xmit->buf + xmit->tail, sport->dma_tx_bytes);
        } else {
@@ -359,7 +359,6 @@ static void lpuart_dma_tx(struct lpuart_port *sport)
        sport->dma_tx_in_progress = true;
        sport->dma_tx_cookie = dmaengine_submit(sport->dma_tx_desc);
        dma_async_issue_pending(sport->dma_tx_chan);
 }
 static void lpuart_dma_tx_complete(void *arg)
diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
index d391650b82e7..42caccb5e87e 100644
--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -419,6 +419,7 @@ static struct dmi_system_id pch_uart_dmi_table[] = {
                },
                (void *)MINNOW_UARTCLK,
        },
+        { }
 };
 /* Return UART clock, checking for board specific clocks. */
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 2675792a8f59..fb0672554123 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -1130,9 +1130,13 @@ static int sc16is7xx_gpio_direction_output(struct gpio_chip *chip,
 {
        struct sc16is7xx_port *s = gpiochip_get_data(chip);
        struct uart_port *port = &s->p[0].port;
+        u8 state = sc16is7xx_port_read(port, SC16IS7XX_IOSTATE_REG);
-        sc16is7xx_port_update(port, SC16IS7XX_IOSTATE_REG, BIT(offset),
+        if (val)
-                              val ? BIT(offset) : 0);
+                state |= BIT(offset);
+        else
+                state &= ~BIT(offset);
+        sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
        sc16is7xx_port_update(port, SC16IS7XX_IODIR_REG, BIT(offset),
                              BIT(offset));
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 6e4f63627479..f2303f390345 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -111,7 +111,7 @@ void uart_write_wakeup(struct uart_port *port)
         * closed.  No cookie for you.
         */
        BUG_ON(!state);
-        tty_wakeup(state->port.tty);
+        tty_port_tty_wakeup(&state->port);
 }
 static void uart_stop(struct tty_struct *tty)
@@ -632,7 +632,7 @@ static void uart_flush_buffer(struct tty_struct *tty)
        if (port->ops->flush_buffer)
                port->ops->flush_buffer(port);
        uart_port_unlock(port, flags);
-        tty_wakeup(tty);
+        tty_port_tty_wakeup(&state->port);
 }
 /*
@@ -2746,8 +2746,6 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport)
        uport->cons = drv->cons;
        uport->minor = drv->tty_driver->minor_start + uport->line;
-        port->console = uart_console(uport);
        /*
         * If this port is a console, then the spinlock is already
         * initialised.
@@ -2761,6 +2759,8 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport)
        uart_configure_port(drv, state, uport);
+        port->console = uart_console(uport);
        num_groups = 2;
        if (uport->attr_group)
                num_groups++;
diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
index 41d974923102..cd97ceb76e4f 100644
--- a/drivers/tty/serial/stm32-usart.h
+++ b/drivers/tty/serial/stm32-usart.h
@@ -31,7 +31,7 @@ struct stm32_usart_info {
        struct stm32_usart_config cfg;
 };
-#define UNDEF_REG ~0
+#define UNDEF_REG 0xff
 /* Register offsets */
 struct stm32_usart_info stm32f4_info = {
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index f37edaa5ac75..dd4c02fa4820 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -1200,6 +1200,7 @@ static int __init cdns_early_console_setup(struct earlycon_device *device,
 OF_EARLYCON_DECLARE(cdns, "xlnx,xuartps", cdns_early_console_setup);
 OF_EARLYCON_DECLARE(cdns, "cdns,uart-r1p8", cdns_early_console_setup);
 OF_EARLYCON_DECLARE(cdns, "cdns,uart-r1p12", cdns_early_console_setup);
+OF_EARLYCON_DECLARE(cdns, "xlnx,zynqmp-uart", cdns_early_console_setup);
 /**
 * cdns_uart_console_write - perform write operation
@@ -1438,6 +1439,7 @@ static const struct of_device_id cdns_uart_of_match[] = {
        { .compatible = "xlnx,xuartps", },
        { .compatible = "cdns,uart-r1p8", },
        { .compatible = "cdns,uart-r1p12", .data = &zynqmp_uart_def },
+        { .compatible = "xlnx,zynqmp-uart", .data = &zynqmp_uart_def },
        {}
 };
 MODULE_DEVICE_TABLE(of, cdns_uart_of_match);
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 06fb39c1d6dd..8c3bf3d613c0 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -870,10 +870,15 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
        if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
                return 0;
+        if (new_screen_size > (4 << 20))
+                return -EINVAL;
        newscreen = kmalloc(new_screen_size, GFP_USER);
        if (!newscreen)
                return -ENOMEM;
+        if (vc == sel_cons)
+                clear_selection();
        old_rows = vc->vc_rows;
        old_row_size = vc->vc_size_row;
@@ -1176,7 +1181,7 @@ static void csi_J(struct vc_data *vc, int vpar)
                        break;
                case 3: /* erase scroll-back buffer (and whole display) */
                        scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char,
-                                    vc->vc_screenbuf_size >> 1);
+                                    vc->vc_screenbuf_size);
                        set_origin(vc);
                        if (con_is_visible(vc))
                                update_screen(vc);
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 69426e644d17..3dbb4a21ab44 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -914,6 +914,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
        if (!ci)
                return -ENOMEM;
+        spin_lock_init(&ci->lock);
        ci->dev = dev;
        ci->platdata = dev_get_platdata(dev);
        ci->imx28_write_fix = !!(ci->platdata->flags &
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 96ae69502c86..111b0e0b8698 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -188,6 +188,8 @@ static void host_stop(struct ci_hdrc *ci)
        if (hcd) {
                usb_remove_hcd(hcd);
+                ci->role = CI_ROLE_END;
+                synchronize_irq(ci->irq);
                usb_put_hcd(hcd);
                if (ci->platdata->reg_vbus && !ci_otg_is_fsm_mode(ci) &&
                        (ci->platdata->flags & CI_HDRC_TURN_VBUS_EARLY_ON))
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 661f43fe0f9e..c9e80ad48fdc 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1889,8 +1889,6 @@ static int udc_start(struct ci_hdrc *ci)
        struct usb_otg_caps *otg_caps = &ci->platdata->ci_otg_caps;
        int retval = 0;
-        spin_lock_init(&ci->lock);
        ci->gadget.ops          = &usb_gadget_ops;
        ci->gadget.speed        = USB_SPEED_UNKNOWN;
        ci->gadget.max_speed    = USB_SPEED_HIGH;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 78f0f85bebdc..fada988512a1 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -932,8 +932,6 @@ static int wait_serial_change(struct acm *acm, unsigned long arg)
        DECLARE_WAITQUEUE(wait, current);
        struct async_icount old, new;
-        if (arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD))
-                return -EINVAL;
        do {
                spin_lock_irq(&acm->read_lock);
                old = acm->oldcount;
@@ -1161,6 +1159,8 @@ static int acm_probe(struct usb_interface *intf,
        if (quirks == IGNORE_DEVICE)
                return -ENODEV;
+        memset(&h, 0x00, sizeof(struct usb_cdc_parsed_header));
        num_rx_buf = (quirks == SINGLE_RX_URB) ? 1 : ACM_NR;
        /* handle quirks deadly to normal probing*/
diff --git a/drivers/usb/dwc2/core.c b/drivers/usb/dwc2/core.c
index fa9b26b91507..4c0fa0b17353 100644
--- a/drivers/usb/dwc2/core.c
+++ b/drivers/usb/dwc2/core.c
@@ -463,9 +463,18 @@ static void dwc2_clear_force_mode(struct dwc2_hsotg *hsotg)
 */
 void dwc2_force_dr_mode(struct dwc2_hsotg *hsotg)
 {
+        bool ret;
        switch (hsotg->dr_mode) {
        case USB_DR_MODE_HOST:
-                dwc2_force_mode(hsotg, true);
+                ret = dwc2_force_mode(hsotg, true);
+                /*
+                 * NOTE: This is required for some rockchip soc based
+                 * platforms on their host-only dwc2.
+                 */
+                if (!ret)
+                        msleep(50);
                break;
        case USB_DR_MODE_PERIPHERAL:
                dwc2_force_mode(hsotg, false);
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index aad4107ef927..2a21a0414b1d 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -259,6 +259,13 @@ enum dwc2_lx_state {
        DWC2_L3,        /* Off state */
 };
+/*
+ * Gadget periodic tx fifo sizes as used by legacy driver
+ * EP0 is not included
+ */
+#define DWC2_G_P_LEGACY_TX_FIFO_SIZE {256, 256, 256, 256, 768, 768, 768, \
+                                           768, 0, 0, 0, 0, 0, 0, 0}
 /* Gadget ep0 states */
 enum dwc2_ep0_state {
        DWC2_EP0_SETUP,
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 4cd6403a7566..24fbebc9b409 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -186,10 +186,9 @@ static void dwc2_hsotg_ctrl_epint(struct dwc2_hsotg *hsotg,
 */
 static void dwc2_hsotg_init_fifo(struct dwc2_hsotg *hsotg)
 {
-        unsigned int fifo;
+        unsigned int ep;
        unsigned int addr;
        int timeout;
-        u32 dptxfsizn;
        u32 val;
        /* Reset fifo map if not correctly cleared during previous session */
@@ -217,16 +216,16 @@ static void dwc2_hsotg_init_fifo(struct dwc2_hsotg *hsotg)
         * them to endpoints dynamically according to maxpacket size value of
         * given endpoint.
         */
-        for (fifo = 1; fifo < MAX_EPS_CHANNELS; fifo++) {
+        for (ep = 1; ep < MAX_EPS_CHANNELS; ep++) {
-                dptxfsizn = dwc2_readl(hsotg->regs + DPTXFSIZN(fifo));
+                if (!hsotg->g_tx_fifo_sz[ep])
+                        continue;
-                val = (dptxfsizn & FIFOSIZE_DEPTH_MASK) | addr;
+                val = addr;
-                addr += dptxfsizn >> FIFOSIZE_DEPTH_SHIFT;
+                val |= hsotg->g_tx_fifo_sz[ep] << FIFOSIZE_DEPTH_SHIFT;
+                WARN_ONCE(addr + hsotg->g_tx_fifo_sz[ep] > hsotg->fifo_mem,
-                if (addr > hsotg->fifo_mem)
+                          "insufficient fifo memory");
-                        break;
+                addr += hsotg->g_tx_fifo_sz[ep];
-                dwc2_writel(val, hsotg->regs + DPTXFSIZN(fifo));
+                dwc2_writel(val, hsotg->regs + DPTXFSIZN(ep));
        }
        /*
@@ -3807,10 +3806,36 @@ static void dwc2_hsotg_dump(struct dwc2_hsotg *hsotg)
 static void dwc2_hsotg_of_probe(struct dwc2_hsotg *hsotg)
 {
        struct device_node *np = hsotg->dev->of_node;
+        u32 len = 0;
+        u32 i = 0;
        /* Enable dma if requested in device tree */
        hsotg->g_using_dma = of_property_read_bool(np, "g-use-dma");
+        /*
+        * Register TX periodic fifo size per endpoint.
+        * EP0 is excluded since it has no fifo configuration.
+        */
+        if (!of_find_property(np, "g-tx-fifo-size", &len))
+                goto rx_fifo;
+        len /= sizeof(u32);
+        /* Read tx fifo sizes other than ep0 */
+        if (of_property_read_u32_array(np, "g-tx-fifo-size",
+                                                &hsotg->g_tx_fifo_sz[1], len))
+                goto rx_fifo;
+        /* Add ep0 */
+        len++;
+        /* Make remaining TX fifos unavailable */
+        if (len < MAX_EPS_CHANNELS) {
+                for (i = len; i < MAX_EPS_CHANNELS; i++)
+                        hsotg->g_tx_fifo_sz[i] = 0;
+        }
+rx_fifo:
        /* Register RX fifo size */
        of_property_read_u32(np, "g-rx-fifo-size", &hsotg->g_rx_fifo_sz);
@@ -3832,10 +3857,13 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq)
        struct device *dev = hsotg->dev;
        int epnum;
        int ret;
+        int i;
+        u32 p_tx_fifo[] = DWC2_G_P_LEGACY_TX_FIFO_SIZE;
        /* Initialize to legacy fifo configuration values */
        hsotg->g_rx_fifo_sz = 2048;
        hsotg->g_np_g_tx_fifo_sz = 1024;
+        memcpy(&hsotg->g_tx_fifo_sz[1], p_tx_fifo, sizeof(p_tx_fifo));
        /* Device tree specific probe */
        dwc2_hsotg_of_probe(hsotg);
@@ -3853,6 +3881,9 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq)
        dev_dbg(dev, "NonPeriodic TXFIFO size: %d\n",
                                                hsotg->g_np_g_tx_fifo_sz);
        dev_dbg(dev, "RXFIFO size: %d\n", hsotg->g_rx_fifo_sz);
+        for (i = 0; i < MAX_EPS_CHANNELS; i++)
+                dev_dbg(dev, "Periodic TXFIFO%2d size: %d\n", i,
+                                                hsotg->g_tx_fifo_sz[i]);
        hsotg->gadget.max_speed = USB_SPEED_HIGH;
        hsotg->gadget.ops = &dwc2_hsotg_gadget_ops;
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 7287a763cd0c..fea446900cad 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -769,15 +769,14 @@ static int dwc3_core_init(struct dwc3 *dwc)
        return 0;
 err4:
-        phy_power_off(dwc->usb2_generic_phy);
+        phy_power_off(dwc->usb3_generic_phy);
 err3:
-        phy_power_off(dwc->usb3_generic_phy);
+        phy_power_off(dwc->usb2_generic_phy);
 err2:
        usb_phy_set_suspend(dwc->usb2_phy, 1);
        usb_phy_set_suspend(dwc->usb3_phy, 1);
-        dwc3_core_exit(dwc);
 err1:
        usb_phy_shutdown(dwc->usb2_phy);
diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c
index 89a2f712fdfe..aaaf256f71dd 100644
--- a/drivers/usb/dwc3/dwc3-st.c
+++ b/drivers/usb/dwc3/dwc3-st.c
@@ -31,6 +31,7 @@
 #include <linux/slab.h>
 #include <linux/regmap.h>
 #include <linux/reset.h>
+#include <linux/pinctrl/consumer.h>
 #include <linux/usb/of.h>
 #include "core.h"
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 07cc8929f271..1dfa56a5f1c5 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -783,6 +783,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
                req->trb = trb;
                req->trb_dma = dwc3_trb_dma_offset(dep, trb);
                req->first_trb_index = dep->trb_enqueue;
+                dep->queued_requests++;
        }
        dwc3_ep_inc_enq(dep);
@@ -833,8 +834,6 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
        trb->ctrl |= DWC3_TRB_CTRL_HWO;
-        dep->queued_requests++;
        trace_dwc3_prepare_trb(dep, trb);
 }
@@ -1074,9 +1073,17 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
        list_add_tail(&req->list, &dep->pending_list);
-        if (usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
+        /*
-                        dep->flags & DWC3_EP_PENDING_REQUEST) {
+         * NOTICE: Isochronous endpoints should NEVER be prestarted. We must
-                if (list_empty(&dep->started_list)) {
+         * wait for a XferNotReady event so we will know what's the current
+         * (micro-)frame number.
+         *
+         * Without this trick, we are very, very likely gonna get Bus Expiry
+         * errors which will force us issue EndTransfer command.
+         */
+        if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
+                if ((dep->flags & DWC3_EP_PENDING_REQUEST) &&
+                                list_empty(&dep->started_list)) {
                        dwc3_stop_active_transfer(dwc, dep->number, true);
                        dep->flags = DWC3_EP_ENABLED;
                }
@@ -1861,8 +1868,11 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
        unsigned int            s_pkt = 0;
        unsigned int            trb_status;
-        dep->queued_requests--;
        dwc3_ep_inc_deq(dep);
+        if (req->trb == trb)
+                dep->queued_requests--;
        trace_dwc3_complete_trb(dep, trb);
        /*
@@ -2980,7 +2990,7 @@ err3:
        kfree(dwc->setup_buf);
 err2:
-        dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb),
+        dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb) * 2,
                        dwc->ep0_trb, dwc->ep0_trb_addr);
 err1:
@@ -3005,7 +3015,7 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
        kfree(dwc->setup_buf);
        kfree(dwc->zlp_buf);
-        dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb),
+        dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb) * 2,
                        dwc->ep0_trb, dwc->ep0_trb_addr);
        dma_free_coherent(dwc->dev, sizeof(*dwc->ctrl_req),
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 54ad100af35b..17989b72cdae 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -136,8 +136,60 @@ struct ffs_epfile {
        /*
         * Buffer for holding data from partial reads which may happen since
         * we’re rounding user read requests to a multiple of a max packet size.
+         *
+         * The pointer is initialised with NULL value and may be set by
+         * __ffs_epfile_read_data function to point to a temporary buffer.
+         *
+         * In normal operation, calls to __ffs_epfile_read_buffered will consume
+         * data from said buffer and eventually free it.  Importantly, while the
+         * function is using the buffer, it sets the pointer to NULL.  This is
+         * all right since __ffs_epfile_read_data and __ffs_epfile_read_buffered
+         * can never run concurrently (they are synchronised by epfile->mutex)
+         * so the latter will not assign a new value to the pointer.
+         *
+         * Meanwhile ffs_func_eps_disable frees the buffer (if the pointer is
+         * valid) and sets the pointer to READ_BUFFER_DROP value.  This special
+         * value is crux of the synchronisation between ffs_func_eps_disable and
+         * __ffs_epfile_read_data.
+         *
+         * Once __ffs_epfile_read_data is about to finish it will try to set the
+         * pointer back to its old value (as described above), but seeing as the
+         * pointer is not-NULL (namely READ_BUFFER_DROP) it will instead free
+         * the buffer.
+         *
+         * == State transitions ==
+         *
+         * • ptr == NULL:  (initial state)
+         *   ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP
+         *   ◦ __ffs_epfile_read_buffered:    nop
+         *   ◦ __ffs_epfile_read_data allocates temp buffer: go to ptr == buf
+         *   ◦ reading finishes:              n/a, not in ‘and reading’ state
+         * • ptr == DROP:
+         *   ◦ __ffs_epfile_read_buffer_free: nop
+         *   ◦ __ffs_epfile_read_buffered:    go to ptr == NULL
+         *   ◦ __ffs_epfile_read_data allocates temp buffer: free buf, nop
+         *   ◦ reading finishes:              n/a, not in ‘and reading’ state
+         * • ptr == buf:
+         *   ◦ __ffs_epfile_read_buffer_free: free buf, go to ptr == DROP
+         *   ◦ __ffs_epfile_read_buffered:    go to ptr == NULL and reading
+         *   ◦ __ffs_epfile_read_data:        n/a, __ffs_epfile_read_buffered
+         *                                    is always called first
+         *   ◦ reading finishes:              n/a, not in ‘and reading’ state
+         * • ptr == NULL and reading:
+         *   ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP and reading
+         *   ◦ __ffs_epfile_read_buffered:    n/a, mutex is held
+         *   ◦ __ffs_epfile_read_data:        n/a, mutex is held
+         *   ◦ reading finishes and …
+         *     … all data read:               free buf, go to ptr == NULL
+         *     … otherwise:                   go to ptr == buf and reading
+         * • ptr == DROP and reading:
+         *   ◦ __ffs_epfile_read_buffer_free: nop
+         *   ◦ __ffs_epfile_read_buffered:    n/a, mutex is held
+         *   ◦ __ffs_epfile_read_data:        n/a, mutex is held
+         *   ◦ reading finishes:              free buf, go to ptr == DROP
         */
-        struct ffs_buffer               *read_buffer;   /* P: epfile->mutex */
+        struct ffs_buffer               *read_buffer;
+#define READ_BUFFER_DROP ((struct ffs_buffer *)ERR_PTR(-ESHUTDOWN))
        char                            name[5];
@@ -736,25 +788,47 @@ static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
        schedule_work(&io_data->work);
 }
+static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
+{
+        /*
+         * See comment in struct ffs_epfile for full read_buffer pointer
+         * synchronisation story.
+         */
+        struct ffs_buffer *buf = xchg(&epfile->read_buffer, READ_BUFFER_DROP);
+        if (buf && buf != READ_BUFFER_DROP)
+                kfree(buf);
+}
 /* Assumes epfile->mutex is held. */
 static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile,
                                          struct iov_iter *iter)
 {
-        struct ffs_buffer *buf = epfile->read_buffer;
+        /*
+         * Null out epfile->read_buffer so ffs_func_eps_disable does not free
+         * the buffer while we are using it.  See comment in struct ffs_epfile
+         * for full read_buffer pointer synchronisation story.
+         */
+        struct ffs_buffer *buf = xchg(&epfile->read_buffer, NULL);
        ssize_t ret;
-        if (!buf)
+        if (!buf || buf == READ_BUFFER_DROP)
                return 0;
        ret = copy_to_iter(buf->data, buf->length, iter);
        if (buf->length == ret) {
                kfree(buf);
-                epfile->read_buffer = NULL;
+                return ret;
-        } else if (unlikely(iov_iter_count(iter))) {
+        }
+        if (unlikely(iov_iter_count(iter))) {
                ret = -EFAULT;
        } else {
                buf->length -= ret;
                buf->data += ret;
        }
+        if (cmpxchg(&epfile->read_buffer, NULL, buf))
+                kfree(buf);
        return ret;
 }
@@ -783,7 +857,15 @@ static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
        buf->length = data_len;
        buf->data = buf->storage;
        memcpy(buf->storage, data + ret, data_len);
-        epfile->read_buffer = buf;
+        /*
+         * At this point read_buffer is NULL or READ_BUFFER_DROP (if
+         * ffs_func_eps_disable has been called in the meanwhile).  See comment
+         * in struct ffs_epfile for full read_buffer pointer synchronisation
+         * story.
+         */
+        if (unlikely(cmpxchg(&epfile->read_buffer, NULL, buf)))
+                kfree(buf);
        return ret;
 }
@@ -1097,8 +1179,7 @@ ffs_epfile_release(struct inode *inode, struct file *file)
        ENTER();
-        kfree(epfile->read_buffer);
+        __ffs_epfile_read_buffer_free(epfile);
-        epfile->read_buffer = NULL;
        ffs_data_closed(epfile->ffs);
        return 0;
@@ -1724,24 +1805,20 @@ static void ffs_func_eps_disable(struct ffs_function *func)
        unsigned count            = func->ffs->eps_count;
        unsigned long flags;
+        spin_lock_irqsave(&func->ffs->eps_lock, flags);
        do {
-                if (epfile)
-                        mutex_lock(&epfile->mutex);
-                spin_lock_irqsave(&func->ffs->eps_lock, flags);
                /* pending requests get nuked */
                if (likely(ep->ep))
                        usb_ep_disable(ep->ep);
                ++ep;
-                spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
                if (epfile) {
                        epfile->ep = NULL;
-                        kfree(epfile->read_buffer);
+                        __ffs_epfile_read_buffer_free(epfile);
-                        epfile->read_buffer = NULL;
-                        mutex_unlock(&epfile->mutex);
                        ++epfile;
                }
        } while (--count);
+        spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
 }
 static int ffs_func_eps_enable(struct ffs_function *func)
@@ -3148,11 +3225,11 @@ static bool ffs_func_req_match(struct usb_function *f,
        switch (creq->bRequestType & USB_RECIP_MASK) {
        case USB_RECIP_INTERFACE:
-                return ffs_func_revmap_intf(func,
+                return (ffs_func_revmap_intf(func,
-                                            le16_to_cpu(creq->wIndex) >= 0);
+                                             le16_to_cpu(creq->wIndex)) >= 0);
        case USB_RECIP_ENDPOINT:
-                return ffs_func_revmap_ep(func,
+                return (ffs_func_revmap_ep(func,
-                                          le16_to_cpu(creq->wIndex) >= 0);
+                                           le16_to_cpu(creq->wIndex)) >= 0);
        default:
                return (bool) (func->ffs->user_flags &
                               FUNCTIONFS_ALL_CTRL_RECIP);
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 9c8c9ed1dc9e..5d1bd13a56c1 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -588,13 +588,6 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
        req->length = length;
-        /* throttle high/super speed IRQ rate back slightly */
-        if (gadget_is_dualspeed(dev->gadget))
-                req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH ||
-                                     dev->gadget->speed == USB_SPEED_SUPER)
-                        ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0)
-                        : 0;
        retval = usb_ep_queue(in, req, GFP_ATOMIC);
        switch (retval) {
        default:
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index bb1f6c8f0f01..45bc997d0711 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -1978,7 +1978,7 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev,
                        dev_err(&pdev->dev, "of_probe: name error(%d)\n", ret);
                        goto err;
                }
-                ep->ep.name = name;
+                ep->ep.name = kasprintf(GFP_KERNEL, "ep%d", ep->index);
                ep->ep_regs = udc->regs + USBA_EPT_BASE(i);
                ep->dma_regs = udc->regs + USBA_DMA_BASE(i);
diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
index 876dca4fc216..a268d9e8d6cf 100644
--- a/drivers/usb/host/ehci-platform.c
+++ b/drivers/usb/host/ehci-platform.c
@@ -39,7 +39,7 @@
 #define DRIVER_DESC "EHCI generic platform driver"
 #define EHCI_MAX_CLKS 4
-#define EHCI_MAX_RSTS 3
+#define EHCI_MAX_RSTS 4
 #define hcd_to_ehci_priv(h) ((struct ehci_platform_priv *)hcd_to_ehci(h)->priv)
 struct ehci_platform_priv {
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 5b5880c0ae19..b38a228134df 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -221,6 +221,12 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
        ohci->num_ports = board->ports;
        at91_start_hc(pdev);
+        /*
+         * The RemoteWakeupConnected bit has to be set explicitly
+         * before calling ohci_run. The reset value of this bit is 0.
+         */
+        ohci->hc_control = OHCI_CTRL_RWC;
        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
        if (retval == 0) {
                device_wakeup_enable(hcd->self.controller);
@@ -677,9 +683,6 @@ ohci_hcd_at91_drv_suspend(struct device *dev)
         * REVISIT: some boards will be able to turn VBUS off...
         */
        if (!ohci_at91->wakeup) {
-                ohci->hc_control = ohci_readl(ohci, &ohci->regs->control);
-                ohci->hc_control &= OHCI_CTRL_RWC;
-                ohci_writel(ohci, ohci->hc_control, &ohci->regs->control);
                ohci->rh_state = OHCI_RH_HALTED;
                /* flush the writes */
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 1700908b84ef..86612ac3fda2 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -72,7 +72,7 @@
 static const char       hcd_name [] = "ohci_hcd";
 #define STATECHANGE_DELAY       msecs_to_jiffies(300)
-#define IO_WATCHDOG_DELAY       msecs_to_jiffies(250)
+#define IO_WATCHDOG_DELAY       msecs_to_jiffies(275)
 #include "ohci.h"
 #include "pci-quirks.h"
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index d793f548dfe2..a9a1e4c40480 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -995,6 +995,14 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
        }
        val = readl(base + ext_cap_offset);
+        /* Auto handoff never worked for these devices. Force it and continue */
+        if ((pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241) ||
+                        (pdev->vendor == PCI_VENDOR_ID_RENESAS
+                         && pdev->device == 0x0014)) {
+                val = (val | XHCI_HC_OS_OWNED) & ~XHCI_HC_BIOS_OWNED;
+                writel(val, base + ext_cap_offset);
+        }
        /* If the BIOS owns the HC, signal that the OS wants it, and wait */
        if (val & XHCI_HC_BIOS_OWNED) {
                writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 730b9fd26685..0ef16900efed 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1166,7 +1166,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                xhci_set_link_state(xhci, port_array, wIndex,
                                                        XDEV_RESUME);
                                spin_unlock_irqrestore(&xhci->lock, flags);
-                                msleep(20);
+                                msleep(USB_RESUME_TIMEOUT);
                                spin_lock_irqsave(&xhci->lock, flags);
                                xhci_set_link_state(xhci, port_array, wIndex,
                                                        XDEV_U0);
@@ -1355,6 +1355,35 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
        return 0;
 }
+/*
+ * Workaround for missing Cold Attach Status (CAS) if device re-plugged in S3.
+ * warm reset a USB3 device stuck in polling or compliance mode after resume.
+ * See Intel 100/c230 series PCH specification update Doc #332692-006 Errata #8
+ */
+static bool xhci_port_missing_cas_quirk(int port_index,
+                                             __le32 __iomem **port_array)
+{
+        u32 portsc;
+        portsc = readl(port_array[port_index]);
+        /* if any of these are set we are not stuck */
+        if (portsc & (PORT_CONNECT | PORT_CAS))
+                return false;
+        if (((portsc & PORT_PLS_MASK) != XDEV_POLLING) &&
+            ((portsc & PORT_PLS_MASK) != XDEV_COMP_MODE))
+                return false;
+        /* clear wakeup/change bits, and do a warm port reset */
+        portsc &= ~(PORT_RWC_BITS | PORT_CEC | PORT_WAKE_BITS);
+        portsc |= PORT_WR;
+        writel(portsc, port_array[port_index]);
+        /* flush write */
+        readl(port_array[port_index]);
+        return true;
+}
 int xhci_bus_resume(struct usb_hcd *hcd)
 {
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
@@ -1392,6 +1421,14 @@ int xhci_bus_resume(struct usb_hcd *hcd)
                u32 temp;
                temp = readl(port_array[port_index]);
+                /* warm reset CAS limited ports stuck in polling/compliance */
+                if ((xhci->quirks & XHCI_MISSING_CAS) &&
+                    (hcd->speed >= HCD_USB3) &&
+                    xhci_port_missing_cas_quirk(port_index, port_array)) {
+                        xhci_dbg(xhci, "reset stuck port %d\n", port_index);
+                        continue;
+                }
                if (DEV_SUPERSPEED_ANY(temp))
                        temp &= ~(PORT_RWC_BITS | PORT_CEC | PORT_WAKE_BITS);
                else
@@ -1410,7 +1447,7 @@ int xhci_bus_resume(struct usb_hcd *hcd)
        if (need_usb2_u3_exit) {
                spin_unlock_irqrestore(&xhci->lock, flags);
-                msleep(20);
+                msleep(USB_RESUME_TIMEOUT);
                spin_lock_irqsave(&xhci->lock, flags);
        }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index d7b0f97abbad..e96ae80d107e 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -45,11 +45,13 @@
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI      0x8c31
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI   0x9c31
+#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI        0x9cb1
 #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI             0x22b5
 #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI         0xa12f
 #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI        0x9d2f
 #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI              0x0aa8
 #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI              0x1aa8
+#define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
 static const char hcd_name[] = "xhci_hcd";
@@ -153,7 +155,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
        }
        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
-                pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
+                (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI ||
+                 pdev->device == PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI)) {
                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
                xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
        }
@@ -169,6 +172,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) {
                xhci->quirks |= XHCI_SSIC_PORT_UNUSED;
        }
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+            (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
+             pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+                xhci->quirks |= XHCI_MISSING_CAS;
        if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                        pdev->device == PCI_DEVICE_ID_EJ168) {
                xhci->quirks |= XHCI_RESET_ON_RESUME;
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index b2c1dc5dc0f3..f945380035d0 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -314,6 +314,8 @@ struct xhci_op_regs {
 #define XDEV_U2         (0x2 << 5)
 #define XDEV_U3         (0x3 << 5)
 #define XDEV_INACTIVE   (0x6 << 5)
+#define XDEV_POLLING    (0x7 << 5)
+#define XDEV_COMP_MODE  (0xa << 5)
 #define XDEV_RESUME     (0xf << 5)
 /* true: port has power (see HCC_PPC) */
 #define PORT_POWER      (1 << 9)
@@ -1653,6 +1655,7 @@ struct xhci_hcd {
 #define XHCI_MTK_HOST           (1 << 21)
 #define XHCI_SSIC_PORT_UNUSED   (1 << 22)
 #define XHCI_NO_64BIT_SUPPORT   (1 << 23)
+#define XHCI_MISSING_CAS        (1 << 24)
        unsigned int            num_active_eps;
        unsigned int            limit_active_eps;
        /* There are two roothubs to keep track of bus suspend info for */
diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c
index 210b7e43a6fd..2440f88e07a3 100644
--- a/drivers/usb/musb/da8xx.c
+++ b/drivers/usb/musb/da8xx.c
@@ -479,7 +479,8 @@ static int da8xx_probe(struct platform_device *pdev)
        glue->phy = devm_phy_get(&pdev->dev, "usb-phy");
        if (IS_ERR(glue->phy)) {
-                dev_err(&pdev->dev, "failed to get phy\n");
+                if (PTR_ERR(glue->phy) != -EPROBE_DEFER)
+                        dev_err(&pdev->dev, "failed to get phy\n");
                return PTR_ERR(glue->phy);
        }
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 27dadc0d9114..c3e172e15ec3 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -986,7 +986,7 @@ b_host:
        }
 #endif
-        schedule_work(&musb->irq_work);
+        schedule_delayed_work(&musb->irq_work, 0);
        return handled;
 }
@@ -1855,14 +1855,23 @@ static void musb_pm_runtime_check_session(struct musb *musb)
                MUSB_DEVCTL_HR;
        switch (devctl & ~s) {
        case MUSB_QUIRK_B_INVALID_VBUS_91:
-                if (!musb->session && !musb->quirk_invalid_vbus) {
+                if (musb->quirk_retries--) {
-                        musb->quirk_invalid_vbus = true;
                        musb_dbg(musb,
-                                 "First invalid vbus, assume no session");
+                                 "Poll devctl on invalid vbus, assume no session");
+                        schedule_delayed_work(&musb->irq_work,
+                                              msecs_to_jiffies(1000));
                        return;
                }
-                break;
        case MUSB_QUIRK_A_DISCONNECT_19:
+                if (musb->quirk_retries--) {
+                        musb_dbg(musb,
+                                 "Poll devctl on possible host mode disconnect");
+                        schedule_delayed_work(&musb->irq_work,
+                                              msecs_to_jiffies(1000));
+                        return;
+                }
                if (!musb->session)
                        break;
                musb_dbg(musb, "Allow PM on possible host mode disconnect");
@@ -1886,9 +1895,9 @@ static void musb_pm_runtime_check_session(struct musb *musb)
                if (error < 0)
                        dev_err(musb->controller, "Could not enable: %i\n",
                                error);
+                musb->quirk_retries = 3;
        } else {
                musb_dbg(musb, "Allow PM with no session: %02x", devctl);
-                musb->quirk_invalid_vbus = false;
                pm_runtime_mark_last_busy(musb->controller);
                pm_runtime_put_autosuspend(musb->controller);
        }
@@ -1899,7 +1908,7 @@ static void musb_pm_runtime_check_session(struct musb *musb)
 /* Only used to provide driver mode change events */
 static void musb_irq_work(struct work_struct *data)
 {
-        struct musb *musb = container_of(data, struct musb, irq_work);
+        struct musb *musb = container_of(data, struct musb, irq_work.work);
        musb_pm_runtime_check_session(musb);
@@ -1969,6 +1978,7 @@ static struct musb *allocate_instance(struct device *dev,
        INIT_LIST_HEAD(&musb->control);
        INIT_LIST_HEAD(&musb->in_bulk);
        INIT_LIST_HEAD(&musb->out_bulk);
+        INIT_LIST_HEAD(&musb->pending_list);
        musb->vbuserr_retry = VBUSERR_RETRY_COUNT;
        musb->a_wait_bcon = OTG_TIME_A_WAIT_BCON;
@@ -2018,6 +2028,84 @@ static void musb_free(struct musb *musb)
        musb_host_free(musb);
 }
+struct musb_pending_work {
+        int (*callback)(struct musb *musb, void *data);
+        void *data;
+        struct list_head node;
+};
+/*
+ * Called from musb_runtime_resume(), musb_resume(), and
+ * musb_queue_resume_work(). Callers must take musb->lock.
+ */
+static int musb_run_resume_work(struct musb *musb)
+{
+        struct musb_pending_work *w, *_w;
+        unsigned long flags;
+        int error = 0;
+        spin_lock_irqsave(&musb->list_lock, flags);
+        list_for_each_entry_safe(w, _w, &musb->pending_list, node) {
+                if (w->callback) {
+                        error = w->callback(musb, w->data);
+                        if (error < 0) {
+                                dev_err(musb->controller,
+                                        "resume callback %p failed: %i\n",
+                                        w->callback, error);
+                        }
+                }
+                list_del(&w->node);
+                devm_kfree(musb->controller, w);
+        }
+        spin_unlock_irqrestore(&musb->list_lock, flags);
+        return error;
+}
+/*
+ * Called to run work if device is active or else queue the work to happen
+ * on resume. Caller must take musb->lock and must hold an RPM reference.
+ *
+ * Note that we cowardly refuse queuing work after musb PM runtime
+ * resume is done calling musb_run_resume_work() and return -EINPROGRESS
+ * instead.
+ */
+int musb_queue_resume_work(struct musb *musb,
+                           int (*callback)(struct musb *musb, void *data),
+                           void *data)
+{
+        struct musb_pending_work *w;
+        unsigned long flags;
+        int error;
+        if (WARN_ON(!callback))
+                return -EINVAL;
+        if (pm_runtime_active(musb->controller))
+                return callback(musb, data);
+        w = devm_kzalloc(musb->controller, sizeof(*w), GFP_ATOMIC);
+        if (!w)
+                return -ENOMEM;
+        w->callback = callback;
+        w->data = data;
+        spin_lock_irqsave(&musb->list_lock, flags);
+        if (musb->is_runtime_suspended) {
+                list_add_tail(&w->node, &musb->pending_list);
+                error = 0;
+        } else {
+                dev_err(musb->controller, "could not add resume work %p\n",
+                        callback);
+                devm_kfree(musb->controller, w);
+                error = -EINPROGRESS;
+        }
+        spin_unlock_irqrestore(&musb->list_lock, flags);
+        return error;
+}
+EXPORT_SYMBOL_GPL(musb_queue_resume_work);
 static void musb_deassert_reset(struct work_struct *work)
 {
        struct musb *musb;
@@ -2065,6 +2153,7 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
        }
        spin_lock_init(&musb->lock);
+        spin_lock_init(&musb->list_lock);
        musb->board_set_power = plat->set_power;
        musb->min_power = plat->min_power;
        musb->ops = plat->platform_ops;
@@ -2114,11 +2203,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
                musb->io.ep_offset = musb_flat_ep_offset;
                musb->io.ep_select = musb_flat_ep_select;
        }
-        /* And override them with platform specific ops if specified. */
-        if (musb->ops->ep_offset)
-                musb->io.ep_offset = musb->ops->ep_offset;
-        if (musb->ops->ep_select)
-                musb->io.ep_select = musb->ops->ep_select;
        /* At least tusb6010 has its own offsets */
        if (musb->ops->ep_offset)
@@ -2213,7 +2297,7 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
        musb_generic_disable(musb);
        /* Init IRQ workqueue before request_irq */
-        INIT_WORK(&musb->irq_work, musb_irq_work);
+        INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work);
        INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset);
        INIT_DELAYED_WORK(&musb->finish_resume_work, musb_host_finish_resume);
@@ -2296,6 +2380,7 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
        if (status)
                goto fail5;
+        musb->is_initialized = 1;
        pm_runtime_mark_last_busy(musb->controller);
        pm_runtime_put_autosuspend(musb->controller);
@@ -2309,7 +2394,7 @@ fail4:
        musb_host_cleanup(musb);
 fail3:
-        cancel_work_sync(&musb->irq_work);
+        cancel_delayed_work_sync(&musb->irq_work);
        cancel_delayed_work_sync(&musb->finish_resume_work);
        cancel_delayed_work_sync(&musb->deassert_reset_work);
        if (musb->dma_controller)
@@ -2376,7 +2461,7 @@ static int musb_remove(struct platform_device *pdev)
         */
        musb_exit_debugfs(musb);
-        cancel_work_sync(&musb->irq_work);
+        cancel_delayed_work_sync(&musb->irq_work);
        cancel_delayed_work_sync(&musb->finish_resume_work);
        cancel_delayed_work_sync(&musb->deassert_reset_work);
        pm_runtime_get_sync(musb->controller);
@@ -2562,6 +2647,7 @@ static int musb_suspend(struct device *dev)
        musb_platform_disable(musb);
        musb_generic_disable(musb);
+        WARN_ON(!list_empty(&musb->pending_list));
        spin_lock_irqsave(&musb->lock, flags);
@@ -2583,9 +2669,11 @@ static int musb_suspend(struct device *dev)
 static int musb_resume(struct device *dev)
 {
-        struct musb     *musb = dev_to_musb(dev);
+        struct musb *musb = dev_to_musb(dev);
-        u8              devctl;
+        unsigned long flags;
-        u8              mask;
+        int error;
+        u8 devctl;
+        u8 mask;
        /*
         * For static cmos like DaVinci, register values were preserved
@@ -2619,6 +2707,13 @@ static int musb_resume(struct device *dev)
        musb_start(musb);
+        spin_lock_irqsave(&musb->lock, flags);
+        error = musb_run_resume_work(musb);
+        if (error)
+                dev_err(musb->controller, "resume work failed with %i\n",
+                        error);
+        spin_unlock_irqrestore(&musb->lock, flags);
        return 0;
 }
@@ -2627,14 +2722,16 @@ static int musb_runtime_suspend(struct device *dev)
        struct musb     *musb = dev_to_musb(dev);
        musb_save_context(musb);
+        musb->is_runtime_suspended = 1;
        return 0;
 }
 static int musb_runtime_resume(struct device *dev)
 {
-        struct musb     *musb = dev_to_musb(dev);
+        struct musb *musb = dev_to_musb(dev);
-        static int      first = 1;
+        unsigned long flags;
+        int error;
        /*
         * When pm_runtime_get_sync called for the first time in driver
@@ -2645,9 +2742,10 @@ static int musb_runtime_resume(struct device *dev)
         * Also context restore without save does not make
         * any sense
         */
-        if (!first)
+        if (!musb->is_initialized)
-                musb_restore_context(musb);
+                return 0;
-        first = 0;
+        musb_restore_context(musb);
        if (musb->need_finish_resume) {
                musb->need_finish_resume = 0;
@@ -2655,6 +2753,14 @@ static int musb_runtime_resume(struct device *dev)
                                msecs_to_jiffies(USB_RESUME_TIMEOUT));
        }
+        spin_lock_irqsave(&musb->lock, flags);
+        error = musb_run_resume_work(musb);
+        if (error)
+                dev_err(musb->controller, "resume work failed with %i\n",
+                        error);
+        musb->is_runtime_suspended = 0;
+        spin_unlock_irqrestore(&musb->lock, flags);
        return 0;
 }
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 2cb88a498f8a..91817d77d59c 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -303,13 +303,14 @@ struct musb_context_registers {
 struct musb {
        /* device lock */
        spinlock_t              lock;
+        spinlock_t              list_lock;      /* resume work list lock */
        struct musb_io          io;
        const struct musb_platform_ops *ops;
        struct musb_context_registers context;
        irqreturn_t             (*isr)(int, void *);
-        struct work_struct      irq_work;
+        struct delayed_work     irq_work;
        struct delayed_work     deassert_reset_work;
        struct delayed_work     finish_resume_work;
        struct delayed_work     gadget_work;
@@ -337,6 +338,7 @@ struct musb {
        struct list_head        control;        /* of musb_qh */
        struct list_head        in_bulk;        /* of musb_qh */
        struct list_head        out_bulk;       /* of musb_qh */
+        struct list_head        pending_list;   /* pending work list */
        struct timer_list       otg_timer;
        struct notifier_block   nb;
@@ -379,12 +381,15 @@ struct musb {
        int                     port_mode;      /* MUSB_PORT_MODE_* */
        bool                    session;
-        bool                    quirk_invalid_vbus;
+        unsigned long           quirk_retries;
        bool                    is_host;
        int                     a_wait_bcon;    /* VBUS timeout in msecs */
        unsigned long           idle_timeout;   /* Next timeout in jiffies */
+        unsigned                is_initialized:1;
+        unsigned                is_runtime_suspended:1;
        /* active means connected and not suspended */
        unsigned                is_active:1;
@@ -540,6 +545,10 @@ extern irqreturn_t musb_interrupt(struct musb *);
 extern void musb_hnp_stop(struct musb *musb);
+int musb_queue_resume_work(struct musb *musb,
+                           int (*callback)(struct musb *musb, void *data),
+                           void *data);
 static inline void musb_platform_set_vbus(struct musb *musb, int is_on)
 {
        if (musb->ops->set_vbus)
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 0f17d2140db6..feae1561b9ab 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -185,24 +185,19 @@ static void dsps_musb_disable(struct musb *musb)
        musb_writel(reg_base, wrp->coreintr_clear, wrp->usb_bitmap);
        musb_writel(reg_base, wrp->epintr_clear,
                         wrp->txep_bitmap | wrp->rxep_bitmap);
+        del_timer_sync(&glue->timer);
        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
 }
-static void otg_timer(unsigned long _musb)
+/* Caller must take musb->lock */
+static int dsps_check_status(struct musb *musb, void *unused)
 {
-        struct musb *musb = (void *)_musb;
        void __iomem *mregs = musb->mregs;
        struct device *dev = musb->controller;
        struct dsps_glue *glue = dev_get_drvdata(dev->parent);
        const struct dsps_musb_wrapper *wrp = glue->wrp;
        u8 devctl;
-        unsigned long flags;
        int skip_session = 0;
-        int err;
-        err = pm_runtime_get_sync(dev);
-        if (err < 0)
-                dev_err(dev, "Poll could not pm_runtime_get: %i\n", err);
        /*
         * We poll because DSPS IP's won't expose several OTG-critical
@@ -212,7 +207,6 @@ static void otg_timer(unsigned long _musb)
        dev_dbg(musb->controller, "Poll devctl %02x (%s)\n", devctl,
                                usb_otg_state_string(musb->xceiv->otg->state));
-        spin_lock_irqsave(&musb->lock, flags);
        switch (musb->xceiv->otg->state) {
        case OTG_STATE_A_WAIT_VRISE:
                mod_timer(&glue->timer, jiffies +
@@ -245,8 +239,30 @@ static void otg_timer(unsigned long _musb)
        default:
                break;
        }
-        spin_unlock_irqrestore(&musb->lock, flags);
+        return 0;
+}
+static void otg_timer(unsigned long _musb)
+{
+        struct musb *musb = (void *)_musb;
+        struct device *dev = musb->controller;
+        unsigned long flags;
+        int err;
+        err = pm_runtime_get(dev);
+        if ((err != -EINPROGRESS) && err < 0) {
+                dev_err(dev, "Poll could not pm_runtime_get: %i\n", err);
+                pm_runtime_put_noidle(dev);
+                return;
+        }
+        spin_lock_irqsave(&musb->lock, flags);
+        err = musb_queue_resume_work(musb, dsps_check_status, NULL);
+        if (err < 0)
+                dev_err(dev, "%s resume work: %i\n", __func__, err);
+        spin_unlock_irqrestore(&musb->lock, flags);
        pm_runtime_mark_last_busy(dev);
        pm_runtime_put_autosuspend(dev);
 }
@@ -767,28 +783,13 @@ static int dsps_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, glue);
        pm_runtime_enable(&pdev->dev);
-        pm_runtime_use_autosuspend(&pdev->dev);
-        pm_runtime_set_autosuspend_delay(&pdev->dev, 200);
-        ret = pm_runtime_get_sync(&pdev->dev);
-        if (ret < 0) {
-                dev_err(&pdev->dev, "pm_runtime_get_sync FAILED");
-                goto err2;
-        }
        ret = dsps_create_musb_pdev(glue, pdev);
        if (ret)
-                goto err3;
+                goto err;
-        pm_runtime_mark_last_busy(&pdev->dev);
-        pm_runtime_put_autosuspend(&pdev->dev);
        return 0;
-err3:
+err:
-        pm_runtime_put_sync(&pdev->dev);
-err2:
-        pm_runtime_dont_use_autosuspend(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
        return ret;
 }
@@ -799,9 +800,6 @@ static int dsps_remove(struct platform_device *pdev)
        platform_device_unregister(glue->musb);
-        /* disable usbss clocks */
-        pm_runtime_dont_use_autosuspend(&pdev->dev);
-        pm_runtime_put_sync(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
        return 0;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index bff4869a57cd..a55173c9e564 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1114,7 +1114,7 @@ static int musb_gadget_enable(struct usb_ep *ep,
                        musb_ep->dma ? "dma, " : "",
                        musb_ep->packet_sz);
-        schedule_work(&musb->irq_work);
+        schedule_delayed_work(&musb->irq_work, 0);
 fail:
        spin_unlock_irqrestore(&musb->lock, flags);
@@ -1158,7 +1158,7 @@ static int musb_gadget_disable(struct usb_ep *ep)
        musb_ep->desc = NULL;
        musb_ep->end_point.desc = NULL;
-        schedule_work(&musb->irq_work);
+        schedule_delayed_work(&musb->irq_work, 0);
        spin_unlock_irqrestore(&(musb->lock), flags);
@@ -1222,13 +1222,22 @@ void musb_ep_restart(struct musb *musb, struct musb_request *req)
                rxstate(musb, req);
 }
+static int musb_ep_restart_resume_work(struct musb *musb, void *data)
+{
+        struct musb_request *req = data;
+        musb_ep_restart(musb, req);
+        return 0;
+}
 static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
                        gfp_t gfp_flags)
 {
        struct musb_ep          *musb_ep;
        struct musb_request     *request;
        struct musb             *musb;
-        int                     status = 0;
+        int                     status;
        unsigned long           lockflags;
        if (!ep || !req)
@@ -1245,6 +1254,17 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
        if (request->ep != musb_ep)
                return -EINVAL;
+        status = pm_runtime_get(musb->controller);
+        if ((status != -EINPROGRESS) && status < 0) {
+                dev_err(musb->controller,
+                        "pm runtime get failed in %s\n",
+                        __func__);
+                pm_runtime_put_noidle(musb->controller);
+                return status;
+        }
+        status = 0;
        trace_musb_req_enq(request);
        /* request is mine now... */
@@ -1270,11 +1290,20 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
        list_add_tail(&request->list, &musb_ep->req_list);
        /* it this is the head of the queue, start i/o ... */
-        if (!musb_ep->busy && &request->list == musb_ep->req_list.next)
+        if (!musb_ep->busy && &request->list == musb_ep->req_list.next) {
-                musb_ep_restart(musb, request);
+                status = musb_queue_resume_work(musb,
+                                                musb_ep_restart_resume_work,
+                                                request);
+                if (status < 0)
+                        dev_err(musb->controller, "%s resume work: %i\n",
+                                __func__, status);
+        }
 unlock:
        spin_unlock_irqrestore(&musb->lock, lockflags);
+        pm_runtime_mark_last_busy(musb->controller);
+        pm_runtime_put_autosuspend(musb->controller);
        return status;
 }
@@ -1965,7 +1994,7 @@ static int musb_gadget_stop(struct usb_gadget *g)
         */
        /* Force check of devctl register for PM runtime */
-        schedule_work(&musb->irq_work);
+        schedule_delayed_work(&musb->irq_work, 0);
        pm_runtime_mark_last_busy(musb->controller);
        pm_runtime_put_autosuspend(musb->controller);
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 1ab6973d4f61..e8be8e39ab8f 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -287,6 +287,7 @@ static int omap2430_musb_init(struct musb *musb)
        }
        musb->isr = omap2430_musb_interrupt;
        phy_init(musb->phy);
+        phy_power_on(musb->phy);
        l = musb_readl(musb->mregs, OTG_INTERFSEL);
@@ -323,8 +324,6 @@ static void omap2430_musb_enable(struct musb *musb)
        struct musb_hdrc_platform_data *pdata = dev_get_platdata(dev);
        struct omap_musb_board_data *data = pdata->board_data;
-        if (!WARN_ON(!musb->phy))
-                phy_power_on(musb->phy);
        switch (glue->status) {
@@ -361,9 +360,6 @@ static void omap2430_musb_disable(struct musb *musb)
        struct device *dev = musb->controller;
        struct omap2430_glue *glue = dev_get_drvdata(dev->parent);
-        if (!WARN_ON(!musb->phy))
-                phy_power_off(musb->phy);
        if (glue->status != MUSB_UNKNOWN)
                omap_control_usb_set_mode(glue->control_otghs,
                        USB_MODE_DISCONNECT);
@@ -375,6 +371,7 @@ static int omap2430_musb_exit(struct musb *musb)
        struct omap2430_glue *glue = dev_get_drvdata(dev->parent);
        omap2430_low_level_exit(musb);
+        phy_power_off(musb->phy);
        phy_exit(musb->phy);
        musb->phy = NULL;
        cancel_work_sync(&glue->omap_musb_mailbox_work);
@@ -516,17 +513,18 @@ static int omap2430_probe(struct platform_device *pdev)
        }
        pm_runtime_enable(glue->dev);
-        pm_runtime_use_autosuspend(glue->dev);
-        pm_runtime_set_autosuspend_delay(glue->dev, 100);
        ret = platform_device_add(musb);
        if (ret) {
                dev_err(&pdev->dev, "failed to register musb device\n");
-                goto err2;
+                goto err3;
        }
        return 0;
+err3:
+        pm_runtime_disable(glue->dev);
 err2:
        platform_device_put(musb);
@@ -538,10 +536,7 @@ static int omap2430_remove(struct platform_device *pdev)
 {
        struct omap2430_glue *glue = platform_get_drvdata(pdev);
-        pm_runtime_get_sync(glue->dev);
        platform_device_unregister(glue->musb);
-        pm_runtime_put_sync(glue->dev);
-        pm_runtime_dont_use_autosuspend(glue->dev);
        pm_runtime_disable(glue->dev);
        return 0;
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index df7c9f46be54..e85cc8e4e7a9 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -724,7 +724,7 @@ tusb_otg_ints(struct musb *musb, u32 int_src, void __iomem *tbase)
                        dev_dbg(musb->controller, "vbus change, %s, otg %03x\n",
                                usb_otg_state_string(musb->xceiv->otg->state), otg_stat);
                        idle_timeout = jiffies + (1 * HZ);
-                        schedule_work(&musb->irq_work);
+                        schedule_delayed_work(&musb->irq_work, 0);
                } else /* A-dev state machine */ {
                        dev_dbg(musb->controller, "vbus change, %s, otg %03x\n",
@@ -814,7 +814,7 @@ tusb_otg_ints(struct musb *musb, u32 int_src, void __iomem *tbase)
                        break;
                }
        }
-        schedule_work(&musb->irq_work);
+        schedule_delayed_work(&musb->irq_work, 0);
        return idle_timeout;
 }
@@ -864,7 +864,7 @@ static irqreturn_t tusb_musb_interrupt(int irq, void *__hci)
                musb_writel(tbase, TUSB_PRCM_WAKEUP_CLEAR, reg);
                if (reg & ~TUSB_PRCM_WNORCS) {
                        musb->is_active = 1;
-                        schedule_work(&musb->irq_work);
+                        schedule_delayed_work(&musb->irq_work, 0);
                }
                dev_dbg(musb->controller, "wake %sactive %02x\n",
                                musb->is_active ? "" : "in", reg);
diff --git a/drivers/usb/renesas_usbhs/rcar3.c b/drivers/usb/renesas_usbhs/rcar3.c
index 1d70add926f0..d544b331c9f2 100644
--- a/drivers/usb/renesas_usbhs/rcar3.c
+++ b/drivers/usb/renesas_usbhs/rcar3.c
@@ -9,6 +9,7 @@
 *
 */
+#include <linux/delay.h>
 #include <linux/io.h>
 #include "common.h"
 #include "rcar3.h"
@@ -35,10 +36,13 @@ static int usbhs_rcar3_power_ctrl(struct platform_device *pdev,
        usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG);
-        if (enable)
+        if (enable) {
                usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM);
-        else
+                /* The controller on R-Car Gen3 needs to wait up to 45 usec */
+                udelay(45);
+        } else {
                usbhs_bset(priv, LPSTS, LPSTS_SUSPM, 0);
+        }
        return 0;
 }
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 54a4de0efdba..243ac5ebe46a 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -131,6 +131,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
        { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
        { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+        { USB_DEVICE(0x10C4, 0x8962) }, /* Brim Brothers charging dock */
        { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
        { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
        { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
@@ -1077,7 +1078,9 @@ static int cp210x_tiocmget(struct tty_struct *tty)
        u8 control;
        int result;
-        cp210x_read_u8_reg(port, CP210X_GET_MDMSTS, &control);
+        result = cp210x_read_u8_reg(port, CP210X_GET_MDMSTS, &control);
+        if (result)
+                return result;
        result = ((control & CONTROL_DTR) ? TIOCM_DTR : 0)
                |((control & CONTROL_RTS) ? TIOCM_RTS : 0)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index b2d767e743fc..6e9fc8bcc285 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -986,7 +986,8 @@ static const struct usb_device_id id_table_combined[] = {
        /* ekey Devices */
        { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
        /* Infineon Devices */
-        { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC1798_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC2X7_PID, 1) },
        /* GE Healthcare devices */
        { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
        /* Active Research (Actisense) devices */
@@ -1011,6 +1012,8 @@ static const struct usb_device_id id_table_combined[] = {
        { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
        { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
        { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
+        { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
        { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index f87a938cf005..48ee04c94a75 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -596,6 +596,12 @@
 #define STK541_PID              0x2109 /* Zigbee Controller */
 /*
+ * Texas Instruments
+ */
+#define TI_VID                  0x0451
+#define TI_CC3200_LAUNCHPAD_PID 0xC32A /* SimpleLink Wi-Fi CC3200 LaunchPad */
+/*
 * Blackfin gnICE JTAG
 * http://docs.blackfin.uclinux.org/doku.php?id=hw:jtag:gnice
 */
@@ -626,8 +632,9 @@
 /*
 * Infineon Technologies
 */
-#define INFINEON_VID            0x058b
+#define INFINEON_VID                    0x058b
-#define INFINEON_TRIBOARD_PID   0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
+#define INFINEON_TRIBOARD_TC1798_PID    0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
+#define INFINEON_TRIBOARD_TC2X7_PID     0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */
 /*
 * Acton Research Corp.
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index d213cf44a7e4..4a037b4a79cf 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1078,7 +1078,8 @@ static int usb_serial_probe(struct usb_interface *interface,
        serial->disconnected = 0;
-        usb_serial_console_init(serial->port[0]->minor);
+        if (num_ports > 0)
+                usb_serial_console_init(serial->port[0]->minor);
 exit:
        module_put(type->driver.owner);
        return 0;
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index ffd086733421..1a59f335b063 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -954,10 +954,15 @@ int usb_stor_CB_transport(struct scsi_cmnd *srb, struct us_data *us)
        /* COMMAND STAGE */
        /* let's send the command via the control pipe */
+        /*
+         * Command is sometime (f.e. after scsi_eh_prep_cmnd) on the stack.
+         * Stack may be vmallocated.  So no DMA for us.  Make a copy.
+         */
+        memcpy(us->iobuf, srb->cmnd, srb->cmd_len);
        result = usb_stor_ctrl_transfer(us, us->send_ctrl_pipe,
                                      US_CBI_ADSC, 
                                      USB_TYPE_CLASS | USB_RECIP_INTERFACE, 0, 
-                                      us->ifnum, srb->cmnd, srb->cmd_len);
+                                      us->ifnum, us->iobuf, srb->cmd_len);
        /* check the return code for the command */
        usb_stor_dbg(us, "Call to usb_stor_ctrl_transfer() returned %d\n",
diff --git a/drivers/usb/wusbcore/crypto.c b/drivers/usb/wusbcore/crypto.c
index 79b2b628066d..79451f7ef1b7 100644
--- a/drivers/usb/wusbcore/crypto.c
+++ b/drivers/usb/wusbcore/crypto.c
@@ -133,6 +133,13 @@ static void bytewise_xor(void *_bo, const void *_bi1, const void *_bi2,
                bo[itr] = bi1[itr] ^ bi2[itr];
 }
+/* Scratch space for MAC calculations. */
+struct wusb_mac_scratch {
+        struct aes_ccm_b0 b0;
+        struct aes_ccm_b1 b1;
+        struct aes_ccm_a ax;
+};
 /*
 * CC-MAC function WUSB1.0[6.5]
 *
@@ -197,16 +204,15 @@ static void bytewise_xor(void *_bo, const void *_bi1, const void *_bi2,
 *       what sg[4] is for. Maybe there is a smarter way to do this.
 */
 static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc,
-                        struct crypto_cipher *tfm_aes, void *mic,
+                        struct crypto_cipher *tfm_aes,
+                        struct wusb_mac_scratch *scratch,
+                        void *mic,
                        const struct aes_ccm_nonce *n,
                        const struct aes_ccm_label *a, const void *b,
                        size_t blen)
 {
        int result = 0;
        SKCIPHER_REQUEST_ON_STACK(req, tfm_cbc);
-        struct aes_ccm_b0 b0;
-        struct aes_ccm_b1 b1;
-        struct aes_ccm_a ax;
        struct scatterlist sg[4], sg_dst;
        void *dst_buf;
        size_t dst_size;
@@ -218,16 +224,17 @@ static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc,
         * These checks should be compile time optimized out
         * ensure @a fills b1's mac_header and following fields
         */
-        WARN_ON(sizeof(*a) != sizeof(b1) - sizeof(b1.la));
+        WARN_ON(sizeof(*a) != sizeof(scratch->b1) - sizeof(scratch->b1.la));
-        WARN_ON(sizeof(b0) != sizeof(struct aes_ccm_block));
+        WARN_ON(sizeof(scratch->b0) != sizeof(struct aes_ccm_block));
-        WARN_ON(sizeof(b1) != sizeof(struct aes_ccm_block));
+        WARN_ON(sizeof(scratch->b1) != sizeof(struct aes_ccm_block));
-        WARN_ON(sizeof(ax) != sizeof(struct aes_ccm_block));
+        WARN_ON(sizeof(scratch->ax) != sizeof(struct aes_ccm_block));
        result = -ENOMEM;
        zero_padding = blen % sizeof(struct aes_ccm_block);
        if (zero_padding)
                zero_padding = sizeof(struct aes_ccm_block) - zero_padding;
-        dst_size = blen + sizeof(b0) + sizeof(b1) + zero_padding;
+        dst_size = blen + sizeof(scratch->b0) + sizeof(scratch->b1) +
+                zero_padding;
        dst_buf = kzalloc(dst_size, GFP_KERNEL);
        if (!dst_buf)
                goto error_dst_buf;
@@ -235,9 +242,9 @@ static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc,
        memset(iv, 0, sizeof(iv));
        /* Setup B0 */
-        b0.flags = 0x59;        /* Format B0 */
+        scratch->b0.flags = 0x59;       /* Format B0 */
-        b0.ccm_nonce = *n;
+        scratch->b0.ccm_nonce = *n;
-        b0.lm = cpu_to_be16(0); /* WUSB1.0[6.5] sez l(m) is 0 */
+        scratch->b0.lm = cpu_to_be16(0);        /* WUSB1.0[6.5] sez l(m) is 0 */
        /* Setup B1
         *
@@ -246,12 +253,12 @@ static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc,
         * 14'--after clarification, it means to use A's contents
         * for MAC Header, EO, sec reserved and padding.
         */
-        b1.la = cpu_to_be16(blen + 14);
+        scratch->b1.la = cpu_to_be16(blen + 14);
-        memcpy(&b1.mac_header, a, sizeof(*a));
+        memcpy(&scratch->b1.mac_header, a, sizeof(*a));
        sg_init_table(sg, ARRAY_SIZE(sg));
-        sg_set_buf(&sg[0], &b0, sizeof(b0));
+        sg_set_buf(&sg[0], &scratch->b0, sizeof(scratch->b0));
-        sg_set_buf(&sg[1], &b1, sizeof(b1));
+        sg_set_buf(&sg[1], &scratch->b1, sizeof(scratch->b1));
        sg_set_buf(&sg[2], b, blen);
        /* 0 if well behaved :) */
        sg_set_buf(&sg[3], bzero, zero_padding);
@@ -276,11 +283,12 @@ static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc,
         * POS Crypto API: size is assumed to be AES's block size.
         * Thanks for documenting it -- tip taken from airo.c
         */
-        ax.flags = 0x01;                /* as per WUSB 1.0 spec */
+        scratch->ax.flags = 0x01;               /* as per WUSB 1.0 spec */
-        ax.ccm_nonce = *n;
+        scratch->ax.ccm_nonce = *n;
-        ax.counter = 0;
+        scratch->ax.counter = 0;
-        crypto_cipher_encrypt_one(tfm_aes, (void *)&ax, (void *)&ax);
+        crypto_cipher_encrypt_one(tfm_aes, (void *)&scratch->ax,
-        bytewise_xor(mic, &ax, iv, 8);
+                                  (void *)&scratch->ax);
+        bytewise_xor(mic, &scratch->ax, iv, 8);
        result = 8;
 error_cbc_crypt:
        kfree(dst_buf);
@@ -303,6 +311,7 @@ ssize_t wusb_prf(void *out, size_t out_size,
        struct aes_ccm_nonce n = *_n;
        struct crypto_skcipher *tfm_cbc;
        struct crypto_cipher *tfm_aes;
+        struct wusb_mac_scratch *scratch;
        u64 sfn = 0;
        __le64 sfn_le;
@@ -329,17 +338,25 @@ ssize_t wusb_prf(void *out, size_t out_size,
                printk(KERN_ERR "E: can't set AES key: %d\n", (int)result);
                goto error_setkey_aes;
        }
+        scratch = kmalloc(sizeof(*scratch), GFP_KERNEL);
+        if (!scratch) {
+                result = -ENOMEM;
+                goto error_alloc_scratch;
+        }
        for (bitr = 0; bitr < (len + 63) / 64; bitr++) {
                sfn_le = cpu_to_le64(sfn++);
                memcpy(&n.sfn, &sfn_le, sizeof(n.sfn)); /* n.sfn++... */
-                result = wusb_ccm_mac(tfm_cbc, tfm_aes, out + bytes,
+                result = wusb_ccm_mac(tfm_cbc, tfm_aes, scratch, out + bytes,
                                      &n, a, b, blen);
                if (result < 0)
                        goto error_ccm_mac;
                bytes += result;
        }
        result = bytes;
+        kfree(scratch);
+error_alloc_scratch:
 error_ccm_mac:
 error_setkey_aes:
        crypto_free_cipher(tfm_aes);
diff --git a/drivers/uwb/lc-rc.c b/drivers/uwb/lc-rc.c
index d059ad4d0dbd..97ee1b46db69 100644
--- a/drivers/uwb/lc-rc.c
+++ b/drivers/uwb/lc-rc.c
@@ -56,8 +56,11 @@ static struct uwb_rc *uwb_rc_find_by_index(int index)
        struct uwb_rc *rc = NULL;
        dev = class_find_device(&uwb_rc_class, NULL, &index, uwb_rc_index_match);
-        if (dev)
+        if (dev) {
                rc = dev_get_drvdata(dev);
+                put_device(dev);
+        }
        return rc;
 }
@@ -467,7 +470,9 @@ struct uwb_rc *__uwb_rc_try_get(struct uwb_rc *target_rc)
        if (dev) {
                rc = dev_get_drvdata(dev);
                __uwb_rc_get(rc);
+                put_device(dev);
        }
        return rc;
 }
 EXPORT_SYMBOL_GPL(__uwb_rc_try_get);
@@ -520,8 +525,11 @@ struct uwb_rc *uwb_rc_get_by_grandpa(const struct device *grandpa_dev)
        dev = class_find_device(&uwb_rc_class, NULL, grandpa_dev,
                                find_rc_grandpa);
-        if (dev)
+        if (dev) {
                rc = dev_get_drvdata(dev);
+                put_device(dev);
+        }
        return rc;
 }
 EXPORT_SYMBOL_GPL(uwb_rc_get_by_grandpa);
@@ -553,8 +561,10 @@ struct uwb_rc *uwb_rc_get_by_dev(const struct uwb_dev_addr *addr)
        struct uwb_rc *rc = NULL;
        dev = class_find_device(&uwb_rc_class, NULL, addr, find_rc_dev);
-        if (dev)
+        if (dev) {
                rc = dev_get_drvdata(dev);
+                put_device(dev);
+        }
        return rc;
 }
diff --git a/drivers/uwb/pal.c b/drivers/uwb/pal.c
index c1304b8d4985..678e93741ae1 100644
--- a/drivers/uwb/pal.c
+++ b/drivers/uwb/pal.c
@@ -97,6 +97,8 @@ static bool uwb_rc_class_device_exists(struct uwb_rc *target_rc)
        dev = class_find_device(&uwb_rc_class, NULL, target_rc, find_rc);
+        put_device(dev);
        return (dev != NULL);
 }
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index d624a527777f..031bc08d000d 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -829,8 +829,9 @@ static long vfio_pci_ioctl(void *device_data,
        } else if (cmd == VFIO_DEVICE_SET_IRQS) {
                struct vfio_irq_set hdr;
+                size_t size;
                u8 *data = NULL;
-                int ret = 0;
+                int max, ret = 0;
                minsz = offsetofend(struct vfio_irq_set, count);
@@ -838,23 +839,31 @@ static long vfio_pci_ioctl(void *device_data,
                        return -EFAULT;
                if (hdr.argsz < minsz || hdr.index >= VFIO_PCI_NUM_IRQS ||
+                    hdr.count >= (U32_MAX - hdr.start) ||
                    hdr.flags & ~(VFIO_IRQ_SET_DATA_TYPE_MASK |
                                  VFIO_IRQ_SET_ACTION_TYPE_MASK))
                        return -EINVAL;
-                if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
+                max = vfio_pci_get_irq_count(vdev, hdr.index);
-                        size_t size;
+                if (hdr.start >= max || hdr.start + hdr.count > max)
-                        int max = vfio_pci_get_irq_count(vdev, hdr.index);
+                        return -EINVAL;
-                        if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
+                switch (hdr.flags & VFIO_IRQ_SET_DATA_TYPE_MASK) {
-                                size = sizeof(uint8_t);
+                case VFIO_IRQ_SET_DATA_NONE:
-                        else if (hdr.flags & VFIO_IRQ_SET_DATA_EVENTFD)
+                        size = 0;
-                                size = sizeof(int32_t);
+                        break;
-                        else
+                case VFIO_IRQ_SET_DATA_BOOL:
-                                return -EINVAL;
+                        size = sizeof(uint8_t);
+                        break;
+                case VFIO_IRQ_SET_DATA_EVENTFD:
+                        size = sizeof(int32_t);
+                        break;
+                default:
+                        return -EINVAL;
+                }
-                        if (hdr.argsz - minsz < hdr.count * size ||
+                if (size) {
-                            hdr.start >= max || hdr.start + hdr.count > max)
+                        if (hdr.argsz - minsz < hdr.count * size)
                                return -EINVAL;
                        data = memdup_user((void __user *)(arg + minsz),
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index c2e60893cd09..1c46045b0e7f 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -256,7 +256,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix)
        if (!is_irq_none(vdev))
                return -EINVAL;
-        vdev->ctx = kzalloc(nvec * sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL);
+        vdev->ctx = kcalloc(nvec, sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL);
        if (!vdev->ctx)
                return -ENOMEM;
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index e3b30ea9ece5..a504e2e003da 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -506,7 +506,7 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
         * executing.
         */
-        if (!vhost_vsock_get(vsk->local_addr.svm_cid)) {
+        if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) {
                sock_set_flag(sk, SOCK_DONE);
                vsk->peer_shutdown = SHUTDOWN_MASK;
                sk->sk_state = SS_UNCONNECTED;
diff --git a/drivers/video/fbdev/amba-clcd-versatile.c b/drivers/video/fbdev/amba-clcd-versatile.c
index 19ad8645d93c..e5d9bfc1703a 100644
--- a/drivers/video/fbdev/amba-clcd-versatile.c
+++ b/drivers/video/fbdev/amba-clcd-versatile.c
@@ -526,8 +526,8 @@ int versatile_clcd_init_panel(struct clcd_fb *fb,
        np = of_find_matching_node_and_match(NULL, versatile_clcd_of_match,
                                             &clcd_id);
        if (!np) {
-                dev_err(dev, "no Versatile syscon node\n");
+                /* Vexpress does not have this */
-                return -ENODEV;
+                return 0;
        }
        versatile_clcd_type = (enum versatile_clcd)clcd_id->data;
diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c
index 3b1ca4411073..a2564ab91e62 100644
--- a/drivers/video/fbdev/pvr2fb.c
+++ b/drivers/video/fbdev/pvr2fb.c
@@ -686,8 +686,8 @@ static ssize_t pvr2fb_write(struct fb_info *info, const char *buf,
        if (!pages)
                return -ENOMEM;
-        ret = get_user_pages_unlocked((unsigned long)buf, nr_pages, WRITE,
+        ret = get_user_pages_unlocked((unsigned long)buf, nr_pages, pages,
-                        0, pages);
+                        FOLL_WRITE);
        if (ret < nr_pages) {
                nr_pages = ret;
diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
index 60bdad3a689b..150ce2abf6c8 100644
--- a/drivers/virt/fsl_hypervisor.c
+++ b/drivers/virt/fsl_hypervisor.c
@@ -245,8 +245,8 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
        /* Get the physical addresses of the source buffer */
        down_read(&current->mm->mmap_sem);
        num_pinned = get_user_pages(param.local_vaddr - lb_offset,
-                num_pages, (param.source == -1) ? READ : WRITE,
+                num_pages, (param.source == -1) ? 0 : FOLL_WRITE,
-                0, pages, NULL);
+                pages, NULL);
        up_read(&current->mm->mmap_sem);
        if (num_pinned != num_pages) {
diff --git a/drivers/virtio/config.c b/drivers/virtio/config.c
deleted file mode 100644
index f70bcd2ff98f..000000000000
--- a/drivers/virtio/config.c
+++ /dev/null
@@ -1,12 +0,0 @@
-/* Configuration space parsing helpers for virtio.
- *
- * The configuration is [type][len][... len bytes ...] fields.
- *
- * Copyright 2007 Rusty Russell, IBM Corporation.
- * GPL v2 or later.
- */
-#include <linux/err.h>
-#include <linux/virtio.h>
-#include <linux/virtio_config.h>
-#include <linux/bug.h>
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 4e7003db12c4..181793f07852 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -577,6 +577,8 @@ static int virtballoon_probe(struct virtio_device *vdev)
        virtio_device_ready(vdev);
+        if (towards_target(vb))
+                virtballoon_changed(vdev);
        return 0;
 out_del_vqs:
diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
index 8c4e61783441..6d9e5173d5fa 100644
--- a/drivers/virtio/virtio_pci_legacy.c
+++ b/drivers/virtio/virtio_pci_legacy.c
@@ -212,10 +212,18 @@ int virtio_pci_legacy_probe(struct virtio_pci_device *vp_dev)
                return -ENODEV;
        }
-        rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(64));
+        rc = dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(64));
-        if (rc)
+        if (rc) {
-                rc = dma_set_mask_and_coherent(&pci_dev->dev,
+                rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(32));
-                                                DMA_BIT_MASK(32));
+        } else {
+                /*
+                 * The virtio ring base address is expressed as a 32-bit PFN,
+                 * with a page size of 1 << VIRTIO_PCI_QUEUE_ADDR_SHIFT.
+                 */
+                dma_set_coherent_mask(&pci_dev->dev,
+                                DMA_BIT_MASK(32 + VIRTIO_PCI_QUEUE_ADDR_SHIFT));
+        }
        if (rc)
                dev_warn(&pci_dev->dev, "Failed to enable 64-bit or 32-bit DMA.  Trying to continue, but this might not work.\n");
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index ed9c9eeedfe5..489bfc61cf30 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -167,7 +167,7 @@ static bool vring_use_dma_api(struct virtio_device *vdev)
 * making all of the arch DMA ops work on the vring device itself
 * is a mess.  For now, we use the parent device for DMA ops.
 */
-static struct device *vring_dma_dev(const struct vring_virtqueue *vq)
+static inline struct device *vring_dma_dev(const struct vring_virtqueue *vq)
 {
        return vq->vq.vdev->dev.parent;
 }
@@ -732,7 +732,8 @@ void virtqueue_disable_cb(struct virtqueue *_vq)
        if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
                vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
-                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+                if (!vq->event)
+                        vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
        }
 }
@@ -764,7 +765,8 @@ unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
         * entry. Always do both to keep code simple. */
        if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
                vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
-                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+                if (!vq->event)
+                        vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
        }
        vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
        END_USE(vq);
@@ -832,10 +834,11 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)
         * more to do. */
        /* Depending on the VIRTIO_RING_F_USED_EVENT_IDX feature, we need to
         * either clear the flags bit or point the event index at the next
-         * entry. Always do both to keep code simple. */
+         * entry. Always update the event index to keep code simple. */
        if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
                vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
-                vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
+                if (!vq->event)
+                        vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
        }
        /* TODO: tune this threshold */
        bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
@@ -953,7 +956,8 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
        /* No callback?  Tell other side not to bother us. */
        if (!callback) {
                vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
-                vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
+                if (!vq->event)
+                        vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
        }
        /* Put everything in free lists. */
diff --git a/drivers/vme/vme.c b/drivers/vme/vme.c
index 15b64076bc26..bdbadaa47ef3 100644
--- a/drivers/vme/vme.c
+++ b/drivers/vme/vme.c
@@ -156,12 +156,16 @@ size_t vme_get_size(struct vme_resource *resource)
        case VME_MASTER:
                retval = vme_master_get(resource, &enabled, &base, &size,
                        &aspace, &cycle, &dwidth);
+                if (retval)
+                        return 0;
                return size;
                break;
        case VME_SLAVE:
                retval = vme_slave_get(resource, &enabled, &base, &size,
                        &buf_base, &aspace, &cycle);
+                if (retval)
+                        return 0;
                return size;
                break;
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index fdd3228e0678..3eb58cb51e56 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -155,6 +155,7 @@ config TANGOX_WATCHDOG
 config WDAT_WDT
        tristate "ACPI Watchdog Action Table (WDAT)"
        depends on ACPI
+        select WATCHDOG_CORE
        select ACPI_WATCHDOG
        help
          This driver adds support for systems with ACPI Watchdog Action
diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
index e473e3b23720..6d1fbda0f461 100644
--- a/drivers/watchdog/wdat_wdt.c
+++ b/drivers/watchdog/wdat_wdt.c
@@ -499,6 +499,10 @@ static int wdat_wdt_resume_noirq(struct device *dev)
                ret = wdat_wdt_enable_reboot(wdat);
                if (ret)
                        return ret;
+                ret = wdat_wdt_ping(&wdat->wdd);
+                if (ret)
+                        return ret;
        }
        return wdat_wdt_start(&wdat->wdd);
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index e12bd3635f83..26e5e8507f03 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -168,7 +168,9 @@ out:
 #endif  /* CONFIG_HIBERNATE_CALLBACKS */
 struct shutdown_handler {
-        const char *command;
+#define SHUTDOWN_CMD_SIZE 11
+        const char command[SHUTDOWN_CMD_SIZE];
+        bool flag;
        void (*cb)(void);
 };
@@ -206,22 +208,22 @@ static void do_reboot(void)
        ctrl_alt_del();
 }
+static struct shutdown_handler shutdown_handlers[] = {
+        { "poweroff",   true,   do_poweroff },
+        { "halt",       false,  do_poweroff },
+        { "reboot",     true,   do_reboot   },
+#ifdef CONFIG_HIBERNATE_CALLBACKS
+        { "suspend",    true,   do_suspend  },
+#endif
+};
 static void shutdown_handler(struct xenbus_watch *watch,
                             const char **vec, unsigned int len)
 {
        char *str;
        struct xenbus_transaction xbt;
        int err;
-        static struct shutdown_handler handlers[] = {
+        int idx;
-                { "poweroff",   do_poweroff },
-                { "halt",       do_poweroff },
-                { "reboot",     do_reboot   },
-#ifdef CONFIG_HIBERNATE_CALLBACKS
-                { "suspend",    do_suspend  },
-#endif
-                {NULL, NULL},
-        };
-        static struct shutdown_handler *handler;
        if (shutting_down != SHUTDOWN_INVALID)
                return;
@@ -238,13 +240,13 @@ static void shutdown_handler(struct xenbus_watch *watch,
                return;
        }
-        for (handler = &handlers[0]; handler->command; handler++) {
+        for (idx = 0; idx < ARRAY_SIZE(shutdown_handlers); idx++) {
-                if (strcmp(str, handler->command) == 0)
+                if (strcmp(str, shutdown_handlers[idx].command) == 0)
                        break;
        }
        /* Only acknowledge commands which we are prepared to handle. */
-        if (handler->cb)
+        if (idx < ARRAY_SIZE(shutdown_handlers))
                xenbus_write(xbt, "control", "shutdown", "");
        err = xenbus_transaction_end(xbt, 0);
@@ -253,8 +255,8 @@ static void shutdown_handler(struct xenbus_watch *watch,
                goto again;
        }
-        if (handler->cb) {
+        if (idx < ARRAY_SIZE(shutdown_handlers)) {
-                handler->cb();
+                shutdown_handlers[idx].cb();
        } else {
                pr_info("Ignoring shutdown request: %s\n", str);
                shutting_down = SHUTDOWN_INVALID;
@@ -310,6 +312,9 @@ static struct notifier_block xen_reboot_nb = {
 static int setup_shutdown_watcher(void)
 {
        int err;
+        int idx;
+#define FEATURE_PATH_SIZE (SHUTDOWN_CMD_SIZE + sizeof("feature-"))
+        char node[FEATURE_PATH_SIZE];
        err = register_xenbus_watch(&shutdown_watch);
        if (err) {
@@ -326,6 +331,14 @@ static int setup_shutdown_watcher(void)
        }
 #endif
+        for (idx = 0; idx < ARRAY_SIZE(shutdown_handlers); idx++) {
+                if (!shutdown_handlers[idx].flag)
+                        continue;
+                snprintf(node, FEATURE_PATH_SIZE, "feature-%s",
+                         shutdown_handlers[idx].command);
+                xenbus_printf(XBT_NIL, "control", node, "%u", 1);
+        }
        return 0;
 }
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index c1010f018bd8..1e8be12ebb55 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -364,7 +364,7 @@ out:
 static int xenbus_write_watch(unsigned msg_type, struct xenbus_file_priv *u)
 {
-        struct watch_adapter *watch, *tmp_watch;
+        struct watch_adapter *watch;
        char *path, *token;
        int err, rc;
        LIST_HEAD(staging_q);
@@ -399,7 +399,7 @@ static int xenbus_write_watch(unsigned msg_type, struct xenbus_file_priv *u)
                }
                list_add(&watch->list, &u->watches);
        } else {
-                list_for_each_entry_safe(watch, tmp_watch, &u->watches, list) {
+                list_for_each_entry(watch, &u->watches, list) {
                        if (!strcmp(watch->token, token) &&
                            !strcmp(watch->watch.node, path)) {
                                unregister_xenbus_watch(&watch->watch);
diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
index 611a23119675..6d40a972ffb2 100644
--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
@@ -335,7 +335,9 @@ static int backend_state;
 static void xenbus_reset_backend_state_changed(struct xenbus_watch *w,
                                        const char **v, unsigned int l)
 {
-        xenbus_scanf(XBT_NIL, v[XS_WATCH_PATH], "", "%i", &backend_state);
+        if (xenbus_scanf(XBT_NIL, v[XS_WATCH_PATH], "", "%i",
+                         &backend_state) != 1)
+                backend_state = XenbusStateUnknown;
        printk(KERN_DEBUG "XENBUS: backend %s %s\n",
                        v[XS_WATCH_PATH], xenbus_strstate(backend_state));
        wake_up(&backend_state_wq);