164 files changed, 1776 insertions, 1065 deletions

diff --git a/drivers/acpi/acpica/acnamesp.h b/drivers/acpi/acpica/acnamesp.h
index 514aaf948ea9..3825df923480 100644
--- a/drivers/acpi/acpica/acnamesp.h
+++ b/drivers/acpi/acpica/acnamesp.h
@@ -56,6 +56,10 @@ acpi_status acpi_ns_initialize_objects(void);
 
 acpi_status acpi_ns_initialize_devices(u32 flags);
 
+acpi_status
+acpi_ns_init_one_package(acpi_handle obj_handle,
+                         u32 level, void *context, void **return_value);
+
 /*
  * nsload -  Namespace loading
  */
diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c
index 99d92cb32803..f85c6f3271f6 100644
--- a/drivers/acpi/acpica/exconfig.c
+++ b/drivers/acpi/acpica/exconfig.c
@@ -174,6 +174,13 @@ acpi_ex_load_table_op(struct acpi_walk_state *walk_state,
                 return_ACPI_STATUS(status);
         }
 
+        /* Complete the initialization/resolution of package objects */
+
+        status = acpi_ns_walk_namespace(ACPI_TYPE_PACKAGE, ACPI_ROOT_OBJECT,
+                                        ACPI_UINT32_MAX, 0,
+                                        acpi_ns_init_one_package, NULL, NULL,
+                                        NULL);
+
         /* Parameter Data (optional) */
 
         if (parameter_node) {
@@ -430,6 +437,13 @@ acpi_ex_load_op(union acpi_operand_object *obj_desc,
                 return_ACPI_STATUS(status);
         }
 
+        /* Complete the initialization/resolution of package objects */
+
+        status = acpi_ns_walk_namespace(ACPI_TYPE_PACKAGE, ACPI_ROOT_OBJECT,
+                                        ACPI_UINT32_MAX, 0,
+                                        acpi_ns_init_one_package, NULL, NULL,
+                                        NULL);
+
         /* Store the ddb_handle into the Target operand */
 
         status = acpi_ex_store(ddb_handle, target, walk_state);
diff --git a/drivers/acpi/acpica/nsinit.c b/drivers/acpi/acpica/nsinit.c
index 77f2b5f4948a..d77257d1c827 100644
--- a/drivers/acpi/acpica/nsinit.c
+++ b/drivers/acpi/acpica/nsinit.c
@@ -242,6 +242,58 @@ error_exit:
 
 /*******************************************************************************
  *
+ * FUNCTION:    acpi_ns_init_one_package
+ *
+ * PARAMETERS:  obj_handle      - Node
+ *              level           - Current nesting level
+ *              context         - Not used
+ *              return_value    - Not used
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Callback from acpi_walk_namespace. Invoked for every package
+ *              within the namespace. Used during dynamic load of an SSDT.
+ *
+ ******************************************************************************/
+
+acpi_status
+acpi_ns_init_one_package(acpi_handle obj_handle,
+                         u32 level, void *context, void **return_value)
+{
+        acpi_status status;
+        union acpi_operand_object *obj_desc;
+        struct acpi_namespace_node *node =
+            (struct acpi_namespace_node *)obj_handle;
+
+        obj_desc = acpi_ns_get_attached_object(node);
+        if (!obj_desc) {
+                return (AE_OK);
+        }
+
+        /* Exit if package is already initialized */
+
+        if (obj_desc->package.flags & AOPOBJ_DATA_VALID) {
+                return (AE_OK);
+        }
+
+        status = acpi_ds_get_package_arguments(obj_desc);
+        if (ACPI_FAILURE(status)) {
+                return (AE_OK);
+        }
+
+        status =
+            acpi_ut_walk_package_tree(obj_desc, NULL,
+                                      acpi_ds_init_package_element, NULL);
+        if (ACPI_FAILURE(status)) {
+                return (AE_OK);
+        }
+
+        obj_desc->package.flags |= AOPOBJ_DATA_VALID;
+        return (AE_OK);
+}
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_ns_init_one_object
  *
  * PARAMETERS:  obj_handle      - Node
@@ -360,27 +412,11 @@ acpi_ns_init_one_object(acpi_handle obj_handle,
 
         case ACPI_TYPE_PACKAGE:
 
-                info->package_init++;
-                status = acpi_ds_get_package_arguments(obj_desc);
-                if (ACPI_FAILURE(status)) {
-                        break;
-                }
-
-                ACPI_DEBUG_PRINT_RAW((ACPI_DB_PARSE,
-                                      "%s: Completing resolution of Package elements\n",
-                                      ACPI_GET_FUNCTION_NAME));
+                /* Complete the initialization/resolution of the package object */
 
-                /*
-                 * Resolve all named references in package objects (and all
-                 * sub-packages). This action has been deferred until the entire
-                 * namespace has been loaded, in order to support external and
-                 * forward references from individual package elements (05/2017).
-                 */
-                status = acpi_ut_walk_package_tree(obj_desc, NULL,
-                                                   acpi_ds_init_package_element,
-                                                   NULL);
-
-                obj_desc->package.flags |= AOPOBJ_DATA_VALID;
+                info->package_init++;
+                status =
+                    acpi_ns_init_one_package(obj_handle, level, NULL, NULL);
                 break;
 
         default:
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 3d96e4da2d98..a7c2673ffd36 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -1257,10 +1257,7 @@ int acpi_dev_pm_attach(struct device *dev, bool power_on)
         struct acpi_device *adev = ACPI_COMPANION(dev);
 
         if (!adev)
-                return -ENODEV;
-
-        if (dev->pm_domain)
-                return -EEXIST;
+                return 0;
 
         /*
          * Only attach the power domain to the first device if the
@@ -1268,7 +1265,7 @@ int acpi_dev_pm_attach(struct device *dev, bool power_on)
          * management twice.
          */
         if (!acpi_device_is_first_physical_node(adev, dev))
-                return -EBUSY;
+                return 0;
 
         acpi_add_pm_notifier(adev, dev, acpi_pm_notify_work_func);
         dev_pm_domain_set(dev, &acpi_general_pm_domain);
@@ -1278,7 +1275,7 @@ int acpi_dev_pm_attach(struct device *dev, bool power_on)
         }
 
         dev->pm_domain->detach = acpi_dev_pm_detach;
-        return 0;
+        return 1;
 }
 EXPORT_SYMBOL_GPL(acpi_dev_pm_attach);
 #endif /* CONFIG_PM */
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 4a3ac31c07d0..b0160b5c5608 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -248,7 +248,7 @@ static int amba_probe(struct device *dev)
                         break;
 
                 ret = dev_pm_domain_attach(dev, true);
-                if (ret == -EPROBE_DEFER)
+                if (ret)
                         break;
 
                 ret = amba_get_enable_pclk(pcdev);
@@ -375,7 +375,7 @@ static int amba_device_try_add(struct amba_device *dev, struct resource *parent)
         }
 
         ret = dev_pm_domain_attach(&dev->dev, true);
-        if (ret == -EPROBE_DEFER) {
+        if (ret) {
                 iounmap(tmp);
                 goto err_release;
         }
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 6389c88b3500..738fb22978dd 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -334,6 +334,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x9c07), board_ahci_mobile }, /* Lynx LP RAID */
         { PCI_VDEVICE(INTEL, 0x9c0e), board_ahci_mobile }, /* Lynx LP RAID */
         { PCI_VDEVICE(INTEL, 0x9c0f), board_ahci_mobile }, /* Lynx LP RAID */
+        { PCI_VDEVICE(INTEL, 0x9dd3), board_ahci_mobile }, /* Cannon Lake PCH-LP AHCI */
         { PCI_VDEVICE(INTEL, 0x1f22), board_ahci }, /* Avoton AHCI */
         { PCI_VDEVICE(INTEL, 0x1f23), board_ahci }, /* Avoton AHCI */
         { PCI_VDEVICE(INTEL, 0x1f24), board_ahci }, /* Avoton RAID */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 68596bd4cf06..346b163f6e89 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4493,6 +4493,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         /* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */
         { "C300-CTFDDAC128MAG", "0001",         ATA_HORKAGE_NONCQ, },
 
+        /* Some Sandisk SSDs lock up hard with NCQ enabled.  Reported on
+           SD7SN6S256G and SD8SN8U256G */
+        { "SanDisk SD[78]SN*G", NULL,           ATA_HORKAGE_NONCQ, },
+
         /* devices which puke on READ_NATIVE_MAX */
         { "HDS724040KLSA80",    "KFAOA20N",     ATA_HORKAGE_BROKEN_HPA, },
         { "WDC WD3200JD-00KLB0", "WD-WCAMR1130137", ATA_HORKAGE_BROKEN_HPA },
@@ -4549,13 +4553,16 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM |
                                                 ATA_HORKAGE_NOLPM, },
 
-        /* This specific Samsung model/firmware-rev does not handle LPM well */
+        /* These specific Samsung models/firmware-revs do not handle LPM well */
         { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
+        { "SAMSUNG SSD PM830 mSATA *",  "CXM13D1Q", ATA_HORKAGE_NOLPM, },
 
         /* Sandisk devices which are known to not handle LPM well */
         { "SanDisk SD7UB3Q*G1001",      NULL,   ATA_HORKAGE_NOLPM, },
 
         /* devices that don't properly handle queued TRIM commands */
+        { "Micron_M500IT_*",            "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "Micron_M500_*",              NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "Crucial_CT*M500*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
diff --git a/drivers/base/base.h b/drivers/base/base.h
index d800de650fa5..a75c3025fb78 100644
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -161,3 +161,6 @@ extern void device_links_driver_cleanup(struct device *dev);
 extern void device_links_no_driver(struct device *dev);
 extern bool device_links_busy(struct device *dev);
 extern void device_links_unbind_consumers(struct device *dev);
+
+/* device pm support */
+void device_pm_move_to_tail(struct device *dev);
diff --git a/drivers/base/core.c b/drivers/base/core.c
index b610816eb887..ad7b50897bcc 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -145,6 +145,26 @@ static int device_reorder_to_tail(struct device *dev, void *not_used)
 }
 
 /**
+ * device_pm_move_to_tail - Move set of devices to the end of device lists
+ * @dev: Device to move
+ *
+ * This is a device_reorder_to_tail() wrapper taking the requisite locks.
+ *
+ * It moves the @dev along with all of its children and all of its consumers
+ * to the ends of the device_kset and dpm_list, recursively.
+ */
+void device_pm_move_to_tail(struct device *dev)
+{
+        int idx;
+
+        idx = device_links_read_lock();
+        device_pm_lock();
+        device_reorder_to_tail(dev, NULL);
+        device_pm_unlock();
+        device_links_read_unlock(idx);
+}
+
+/**
  * device_link_add - Create a link between two devices.
  * @consumer: Consumer end of the link.
  * @supplier: Supplier end of the link.
diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
index 2da998baa75c..30cc9c877ebb 100644
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -534,14 +534,22 @@ ssize_t __weak cpu_show_spectre_v2(struct device *dev,
         return sprintf(buf, "Not affected\n");
 }
 
+ssize_t __weak cpu_show_spec_store_bypass(struct device *dev,
+                                          struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "Not affected\n");
+}
+
 static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
 static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
 static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
+static DEVICE_ATTR(spec_store_bypass, 0444, cpu_show_spec_store_bypass, NULL);
 
 static struct attribute *cpu_root_vulnerabilities_attrs[] = {
         &dev_attr_meltdown.attr,
         &dev_attr_spectre_v1.attr,
         &dev_attr_spectre_v2.attr,
+        &dev_attr_spec_store_bypass.attr,
         NULL
 };
 
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index c9f54089429b..a41c91bfac0e 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -122,9 +122,7 @@ static void deferred_probe_work_func(struct work_struct *work)
                  * the list is a good order for suspend but deferred
                  * probe makes that very unsafe.
                  */
-                device_pm_lock();
-                device_pm_move_last(dev);
-                device_pm_unlock();
+                device_pm_move_to_tail(dev);
 
                 dev_dbg(dev, "Retrying from deferred list\n");
                 if (initcall_debug && !initcalls_done)
@@ -582,7 +580,7 @@ int driver_probe_device(struct device_driver *drv, struct device *dev)
         pr_debug("bus: '%s': %s: matched device %s with driver %s\n",
                  drv->bus->name, __func__, dev_name(dev), drv->name);
 
-        pm_runtime_get_suppliers(dev);
+        pm_runtime_resume_suppliers(dev);
         if (dev->parent)
                 pm_runtime_get_sync(dev->parent);
 
@@ -593,7 +591,6 @@ int driver_probe_device(struct device_driver *drv, struct device *dev)
         if (dev->parent)
                 pm_runtime_put(dev->parent);
 
-        pm_runtime_put_suppliers(dev);
         return ret;
 }
 
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 7a3a580821e0..a5e821d09656 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -490,7 +490,8 @@ int unregister_mem_sect_under_nodes(struct memory_block *mem_blk,
         return 0;
 }
 
-int link_mem_sections(int nid, unsigned long start_pfn, unsigned long nr_pages)
+int link_mem_sections(int nid, unsigned long start_pfn, unsigned long nr_pages,
+                      bool check_nid)
 {
         unsigned long end_pfn = start_pfn + nr_pages;
         unsigned long pfn;
@@ -514,7 +515,7 @@ int link_mem_sections(int nid, unsigned long start_pfn, unsigned long nr_pages)
 
                 mem_blk = find_memory_block_hinted(mem_sect, mem_blk);
 
-                ret = register_mem_sect_under_node(mem_blk, nid, true);
+                ret = register_mem_sect_under_node(mem_blk, nid, check_nid);
                 if (!err)
                         err = ret;
 
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 8075ddc70a17..9460139d9b02 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -572,17 +572,16 @@ static int platform_drv_probe(struct device *_dev)
                 return ret;
 
         ret = dev_pm_domain_attach(_dev, true);
-        if (ret != -EPROBE_DEFER) {
-                if (drv->probe) {
-                        ret = drv->probe(dev);
-                        if (ret)
-                                dev_pm_domain_detach(_dev, true);
-                } else {
-                        /* don't fail if just dev_pm_domain_attach failed */
-                        ret = 0;
-                }
+        if (ret)
+                goto out;
+
+        if (drv->probe) {
+                ret = drv->probe(dev);
+                if (ret)
+                        dev_pm_domain_detach(_dev, true);
         }
 
+out:
         if (drv->prevent_deferred_probe && ret == -EPROBE_DEFER) {
                 dev_warn(_dev, "probe deferral not supported\n");
                 ret = -ENXIO;
diff --git a/drivers/base/power/common.c b/drivers/base/power/common.c
index f6a9ad52cbbf..7ae62b6355b8 100644
--- a/drivers/base/power/common.c
+++ b/drivers/base/power/common.c
@@ -98,17 +98,21 @@ EXPORT_SYMBOL_GPL(dev_pm_put_subsys_data);
  * Callers must ensure proper synchronization of this function with power
  * management callbacks.
  *
- * Returns 0 on successfully attached PM domain or negative error code.
+ * Returns 0 on successfully attached PM domain, or when it is found that the
+ * device doesn't need a PM domain, else a negative error code.
  */
 int dev_pm_domain_attach(struct device *dev, bool power_on)
 {
         int ret;
 
+        if (dev->pm_domain)
+                return 0;
+
         ret = acpi_dev_pm_attach(dev, power_on);
-        if (ret)
+        if (!ret)
                 ret = genpd_dev_pm_attach(dev);
 
-        return ret;
+        return ret < 0 ? ret : 0;
 }
 EXPORT_SYMBOL_GPL(dev_pm_domain_attach);
 
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 1ea0e2502e8e..6f403d6fccb2 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -10,6 +10,7 @@
 #include <linux/kernel.h>
 #include <linux/io.h>
 #include <linux/platform_device.h>
+#include <linux/pm_opp.h>
 #include <linux/pm_runtime.h>
 #include <linux/pm_domain.h>
 #include <linux/pm_qos.h>
@@ -1315,7 +1316,6 @@ EXPORT_SYMBOL_GPL(pm_genpd_syscore_poweron);
 #endif /* CONFIG_PM_SLEEP */
 
 static struct generic_pm_domain_data *genpd_alloc_dev_data(struct device *dev,
-                                        struct generic_pm_domain *genpd,
                                         struct gpd_timing_data *td)
 {
         struct generic_pm_domain_data *gpd_data;
@@ -1377,24 +1377,19 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
                             struct gpd_timing_data *td)
 {
         struct generic_pm_domain_data *gpd_data;
-        int ret = 0;
+        int ret;
 
         dev_dbg(dev, "%s()\n", __func__);
 
         if (IS_ERR_OR_NULL(genpd) || IS_ERR_OR_NULL(dev))
                 return -EINVAL;
 
-        gpd_data = genpd_alloc_dev_data(dev, genpd, td);
+        gpd_data = genpd_alloc_dev_data(dev, td);
         if (IS_ERR(gpd_data))
                 return PTR_ERR(gpd_data);
 
         genpd_lock(genpd);
 
-        if (genpd->prepared_count > 0) {
-                ret = -EAGAIN;
-                goto out;
-        }
-
         ret = genpd->attach_dev ? genpd->attach_dev(genpd, dev) : 0;
         if (ret)
                 goto out;
@@ -1418,23 +1413,21 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
 }
 
 /**
- * __pm_genpd_add_device - Add a device to an I/O PM domain.
+ * pm_genpd_add_device - Add a device to an I/O PM domain.
  * @genpd: PM domain to add the device to.
  * @dev: Device to be added.
- * @td: Set of PM QoS timing parameters to attach to the device.
  */
-int __pm_genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
-                          struct gpd_timing_data *td)
+int pm_genpd_add_device(struct generic_pm_domain *genpd, struct device *dev)
 {
         int ret;
 
         mutex_lock(&gpd_list_lock);
-        ret = genpd_add_device(genpd, dev, td);
+        ret = genpd_add_device(genpd, dev, NULL);
         mutex_unlock(&gpd_list_lock);
 
         return ret;
 }
-EXPORT_SYMBOL_GPL(__pm_genpd_add_device);
+EXPORT_SYMBOL_GPL(pm_genpd_add_device);
 
 static int genpd_remove_device(struct generic_pm_domain *genpd,
                                struct device *dev)
@@ -1481,13 +1474,13 @@ static int genpd_remove_device(struct generic_pm_domain *genpd,
 
 /**
  * pm_genpd_remove_device - Remove a device from an I/O PM domain.
- * @genpd: PM domain to remove the device from.
  * @dev: Device to be removed.
  */
-int pm_genpd_remove_device(struct generic_pm_domain *genpd,
-                           struct device *dev)
+int pm_genpd_remove_device(struct device *dev)
 {
-        if (!genpd || genpd != genpd_lookup_dev(dev))
+        struct generic_pm_domain *genpd = genpd_lookup_dev(dev);
+
+        if (!genpd)
                 return -EINVAL;
 
         return genpd_remove_device(genpd, dev);
@@ -1696,6 +1689,9 @@ int pm_genpd_init(struct generic_pm_domain *genpd,
                         return ret;
         }
 
+        device_initialize(&genpd->dev);
+        dev_set_name(&genpd->dev, "%s", genpd->name);
+
         mutex_lock(&gpd_list_lock);
         list_add(&genpd->gpd_list_node, &gpd_list);
         mutex_unlock(&gpd_list_lock);
@@ -1892,14 +1888,33 @@ int of_genpd_add_provider_simple(struct device_node *np,
 
         mutex_lock(&gpd_list_lock);
 
-        if (genpd_present(genpd)) {
-                ret = genpd_add_provider(np, genpd_xlate_simple, genpd);
-                if (!ret) {
-                        genpd->provider = &np->fwnode;
-                        genpd->has_provider = true;
+        if (!genpd_present(genpd))
+                goto unlock;
+
+        genpd->dev.of_node = np;
+
+        /* Parse genpd OPP table */
+        if (genpd->set_performance_state) {
+                ret = dev_pm_opp_of_add_table(&genpd->dev);
+                if (ret) {
+                        dev_err(&genpd->dev, "Failed to add OPP table: %d\n",
+                                ret);
+                        goto unlock;
                 }
         }
 
+        ret = genpd_add_provider(np, genpd_xlate_simple, genpd);
+        if (ret) {
+                if (genpd->set_performance_state)
+                        dev_pm_opp_of_remove_table(&genpd->dev);
+
+                goto unlock;
+        }
+
+        genpd->provider = &np->fwnode;
+        genpd->has_provider = true;
+
+unlock:
         mutex_unlock(&gpd_list_lock);
 
         return ret;
@@ -1914,6 +1929,7 @@ EXPORT_SYMBOL_GPL(of_genpd_add_provider_simple);
 int of_genpd_add_provider_onecell(struct device_node *np,
                                   struct genpd_onecell_data *data)
 {
+        struct generic_pm_domain *genpd;
         unsigned int i;
         int ret = -EINVAL;
 
@@ -1926,13 +1942,27 @@ int of_genpd_add_provider_onecell(struct device_node *np,
                 data->xlate = genpd_xlate_onecell;
 
         for (i = 0; i < data->num_domains; i++) {
-                if (!data->domains[i])
+                genpd = data->domains[i];
+
+                if (!genpd)
                         continue;
-                if (!genpd_present(data->domains[i]))
+                if (!genpd_present(genpd))
                         goto error;
 
-                data->domains[i]->provider = &np->fwnode;
-                data->domains[i]->has_provider = true;
+                genpd->dev.of_node = np;
+
+                /* Parse genpd OPP table */
+                if (genpd->set_performance_state) {
+                        ret = dev_pm_opp_of_add_table_indexed(&genpd->dev, i);
+                        if (ret) {
+                                dev_err(&genpd->dev, "Failed to add OPP table for index %d: %d\n",
+                                        i, ret);
+                                goto error;
+                        }
+                }
+
+                genpd->provider = &np->fwnode;
+                genpd->has_provider = true;
         }
 
         ret = genpd_add_provider(np, data->xlate, data);
@@ -1945,10 +1975,16 @@ int of_genpd_add_provider_onecell(struct device_node *np,
 
 error:
         while (i--) {
-                if (!data->domains[i])
+                genpd = data->domains[i];
+
+                if (!genpd)
                         continue;
-                data->domains[i]->provider = NULL;
-                data->domains[i]->has_provider = false;
+
+                genpd->provider = NULL;
+                genpd->has_provider = false;
+
+                if (genpd->set_performance_state)
+                        dev_pm_opp_of_remove_table(&genpd->dev);
         }
 
         mutex_unlock(&gpd_list_lock);
@@ -1975,10 +2011,17 @@ void of_genpd_del_provider(struct device_node *np)
                          * provider, set the 'has_provider' to false
                          * so that the PM domain can be safely removed.
                          */
-                        list_for_each_entry(gpd, &gpd_list, gpd_list_node)
-                                if (gpd->provider == &np->fwnode)
+                        list_for_each_entry(gpd, &gpd_list, gpd_list_node) {
+                                if (gpd->provider == &np->fwnode) {
                                         gpd->has_provider = false;
 
+                                        if (!gpd->set_performance_state)
+                                                continue;
+
+                                        dev_pm_opp_of_remove_table(&gpd->dev);
+                                }
+                        }
+
                         list_del(&cp->link);
                         of_node_put(cp->node);
                         kfree(cp);
@@ -2185,31 +2228,25 @@ static void genpd_dev_pm_sync(struct device *dev)
  * Parse device's OF node to find a PM domain specifier. If such is found,
  * attaches the device to retrieved pm_domain ops.
  *
- * Both generic and legacy Samsung-specific DT bindings are supported to keep
- * backwards compatibility with existing DTBs.
- *
- * Returns 0 on successfully attached PM domain or negative error code. Note
- * that if a power-domain exists for the device, but it cannot be found or
- * turned on, then return -EPROBE_DEFER to ensure that the device is not
- * probed and to re-try again later.
+ * Returns 1 on successfully attached PM domain, 0 when the device don't need a
+ * PM domain or a negative error code in case of failures. Note that if a
+ * power-domain exists for the device, but it cannot be found or turned on,
+ * then return -EPROBE_DEFER to ensure that the device is not probed and to
+ * re-try again later.
  */
 int genpd_dev_pm_attach(struct device *dev)
 {
         struct of_phandle_args pd_args;
         struct generic_pm_domain *pd;
-        unsigned int i;
         int ret;
 
         if (!dev->of_node)
-                return -ENODEV;
-
-        if (dev->pm_domain)
-                return -EEXIST;
+                return 0;
 
         ret = of_parse_phandle_with_args(dev->of_node, "power-domains",
                                         "#power-domain-cells", 0, &pd_args);
         if (ret < 0)
-                return ret;
+                return 0;
 
         mutex_lock(&gpd_list_lock);
         pd = genpd_get_from_provider(&pd_args);
@@ -2223,21 +2260,14 @@ int genpd_dev_pm_attach(struct device *dev)
 
         dev_dbg(dev, "adding to PM domain %s\n", pd->name);
 
-        for (i = 1; i < GENPD_RETRY_MAX_MS; i <<= 1) {
-                ret = genpd_add_device(pd, dev, NULL);
-                if (ret != -EAGAIN)
-                        break;
-
-                mdelay(i);
-                cond_resched();
-        }
+        ret = genpd_add_device(pd, dev, NULL);
         mutex_unlock(&gpd_list_lock);
 
         if (ret < 0) {
                 if (ret != -EPROBE_DEFER)
                         dev_err(dev, "failed to add to PM domain %s: %d",
                                 pd->name, ret);
-                goto out;
+                return ret;
         }
 
         dev->pm_domain->detach = genpd_dev_pm_detach;
@@ -2246,8 +2276,11 @@ int genpd_dev_pm_attach(struct device *dev)
         genpd_lock(pd);
         ret = genpd_power_on(pd, 0);
         genpd_unlock(pd);
-out:
-        return ret ? -EPROBE_DEFER : 0;
+
+        if (ret)
+                genpd_remove_device(pd, dev);
+
+        return ret ? -EPROBE_DEFER : 1;
 }
 EXPORT_SYMBOL_GPL(genpd_dev_pm_attach);
 
@@ -2361,6 +2394,55 @@ int of_genpd_parse_idle_states(struct device_node *dn,
 }
 EXPORT_SYMBOL_GPL(of_genpd_parse_idle_states);
 
+/**
+ * of_genpd_opp_to_performance_state- Gets performance state of device's
+ * power domain corresponding to a DT node's "required-opps" property.
+ *
+ * @dev: Device for which the performance-state needs to be found.
+ * @opp_node: DT node where the "required-opps" property is present. This can be
+ *      the device node itself (if it doesn't have an OPP table) or a node
+ *      within the OPP table of a device (if device has an OPP table).
+ * @state: Pointer to return performance state.
+ *
+ * Returns performance state corresponding to the "required-opps" property of
+ * a DT node. This calls platform specific genpd->opp_to_performance_state()
+ * callback to translate power domain OPP to performance state.
+ *
+ * Returns performance state on success and 0 on failure.
+ */
+unsigned int of_genpd_opp_to_performance_state(struct device *dev,
+                                               struct device_node *opp_node)
+{
+        struct generic_pm_domain *genpd;
+        struct dev_pm_opp *opp;
+        int state = 0;
+
+        genpd = dev_to_genpd(dev);
+        if (IS_ERR(genpd))
+                return 0;
+
+        if (unlikely(!genpd->set_performance_state))
+                return 0;
+
+        genpd_lock(genpd);
+
+        opp = of_dev_pm_opp_find_required_opp(&genpd->dev, opp_node);
+        if (IS_ERR(opp)) {
+                dev_err(dev, "Failed to find required OPP: %ld\n",
+                        PTR_ERR(opp));
+                goto unlock;
+        }
+
+        state = genpd->opp_to_performance_state(genpd, opp);
+        dev_pm_opp_put(opp);
+
+unlock:
+        genpd_unlock(genpd);
+
+        return state;
+}
+EXPORT_SYMBOL_GPL(of_genpd_opp_to_performance_state);
+
 #endif /* CONFIG_PM_GENERIC_DOMAINS_OF */
 
 
@@ -2628,6 +2710,19 @@ static int genpd_devices_show(struct seq_file *s, void *data)
         return ret;
 }
 
+static int genpd_perf_state_show(struct seq_file *s, void *data)
+{
+        struct generic_pm_domain *genpd = s->private;
+
+        if (genpd_lock_interruptible(genpd))
+                return -ERESTARTSYS;
+
+        seq_printf(s, "%u\n", genpd->performance_state);
+
+        genpd_unlock(genpd);
+        return 0;
+}
+
 #define define_genpd_open_function(name) \
 static int genpd_##name##_open(struct inode *inode, struct file *file) \
 { \
@@ -2641,6 +2736,7 @@ define_genpd_open_function(idle_states);
 define_genpd_open_function(active_time);
 define_genpd_open_function(total_idle_time);
 define_genpd_open_function(devices);
+define_genpd_open_function(perf_state);
 
 #define define_genpd_debugfs_fops(name) \
 static const struct file_operations genpd_##name##_fops = { \
@@ -2657,6 +2753,7 @@ define_genpd_debugfs_fops(idle_states);
 define_genpd_debugfs_fops(active_time);
 define_genpd_debugfs_fops(total_idle_time);
 define_genpd_debugfs_fops(devices);
+define_genpd_debugfs_fops(perf_state);
 
 static int __init genpd_debug_init(void)
 {
@@ -2690,6 +2787,9 @@ static int __init genpd_debug_init(void)
                                 d, genpd, &genpd_total_idle_time_fops);
                 debugfs_create_file("devices", 0444,
                                 d, genpd, &genpd_devices_fops);
+                if (genpd->set_performance_state)
+                        debugfs_create_file("perf_state", 0444,
+                                            d, genpd, &genpd_perf_state_fops);
         }
 
         return 0;
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 02a497e7c785..3f68e2919dc5 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -192,34 +192,31 @@ void device_pm_move_last(struct device *dev)
         list_move_tail(&dev->power.entry, &dpm_list);
 }
 
-static ktime_t initcall_debug_start(struct device *dev)
+static ktime_t initcall_debug_start(struct device *dev, void *cb)
 {
-        ktime_t calltime = 0;
-
-        if (pm_print_times_enabled) {
-                pr_info("calling  %s+ @ %i, parent: %s\n",
-                        dev_name(dev), task_pid_nr(current),
-                        dev->parent ? dev_name(dev->parent) : "none");
-                calltime = ktime_get();
-        }
+        if (!pm_print_times_enabled)
+                return 0;
 
-        return calltime;
+        dev_info(dev, "calling %pF @ %i, parent: %s\n", cb,
+                 task_pid_nr(current),
+                 dev->parent ? dev_name(dev->parent) : "none");
+        return ktime_get();
 }
 
 static void initcall_debug_report(struct device *dev, ktime_t calltime,
-                                  int error, pm_message_t state,
-                                  const char *info)
+                                  void *cb, int error)
 {
         ktime_t rettime;
         s64 nsecs;
 
+        if (!pm_print_times_enabled)
+                return;
+
         rettime = ktime_get();
         nsecs = (s64) ktime_to_ns(ktime_sub(rettime, calltime));
 
-        if (pm_print_times_enabled) {
-                pr_info("call %s+ returned %d after %Ld usecs\n", dev_name(dev),
-                        error, (unsigned long long)nsecs >> 10);
-        }
+        dev_info(dev, "%pF returned %d after %Ld usecs\n", cb, error,
+                 (unsigned long long)nsecs >> 10);
 }
 
 /**
@@ -446,7 +443,7 @@ static int dpm_run_callback(pm_callback_t cb, struct device *dev,
         if (!cb)
                 return 0;
 
-        calltime = initcall_debug_start(dev);
+        calltime = initcall_debug_start(dev, cb);
 
         pm_dev_dbg(dev, state, info);
         trace_device_pm_callback_start(dev, info, state.event);
@@ -454,7 +451,7 @@ static int dpm_run_callback(pm_callback_t cb, struct device *dev,
         trace_device_pm_callback_end(dev, error);
         suspend_report_result(cb, error);
 
-        initcall_debug_report(dev, calltime, error, state, info);
+        initcall_debug_report(dev, calltime, cb, error);
 
         return error;
 }
@@ -1664,14 +1661,14 @@ static int legacy_suspend(struct device *dev, pm_message_t state,
         int error;
         ktime_t calltime;
 
-        calltime = initcall_debug_start(dev);
+        calltime = initcall_debug_start(dev, cb);
 
         trace_device_pm_callback_start(dev, info, state.event);
         error = cb(dev, state);
         trace_device_pm_callback_end(dev, error);
         suspend_report_result(cb, error);
 
-        initcall_debug_report(dev, calltime, error, state, info);
+        initcall_debug_report(dev, calltime, cb, error);
 
         return error;
 }
@@ -1923,10 +1920,8 @@ static int device_prepare(struct device *dev, pm_message_t state)
 
         dev->power.wakeup_path = false;
 
-        if (dev->power.no_pm_callbacks) {
-                ret = 1;        /* Let device go direct_complete */
+        if (dev->power.no_pm_callbacks)
                 goto unlock;
-        }
 
         if (dev->pm_domain)
                 callback = dev->pm_domain->ops.prepare;
@@ -1960,7 +1955,8 @@ unlock:
          */
         spin_lock_irq(&dev->power.lock);
         dev->power.direct_complete = state.event == PM_EVENT_SUSPEND &&
-                pm_runtime_suspended(dev) && ret > 0 &&
+                ((pm_runtime_suspended(dev) && ret > 0) ||
+                 dev->power.no_pm_callbacks) &&
                 !dev_pm_test_driver_flags(dev, DPM_FLAG_NEVER_SKIP);
         spin_unlock_irq(&dev->power.lock);
         return 0;
diff --git a/drivers/base/power/power.h b/drivers/base/power/power.h
index 86e67e70b509..c511def48b48 100644
--- a/drivers/base/power/power.h
+++ b/drivers/base/power/power.h
@@ -56,14 +56,6 @@ static inline void device_wakeup_detach_irq(struct device *dev)
 {
 }
 
-static inline void device_wakeup_arm_wake_irqs(void)
-{
-}
-
-static inline void device_wakeup_disarm_wake_irqs(void)
-{
-}
-
 #endif /* CONFIG_PM_SLEEP */
 
 /*
@@ -95,28 +87,6 @@ static inline void pm_runtime_remove(struct device *dev) {}
 
 static inline int dpm_sysfs_add(struct device *dev) { return 0; }
 static inline void dpm_sysfs_remove(struct device *dev) {}
-static inline void rpm_sysfs_remove(struct device *dev) {}
-static inline int wakeup_sysfs_add(struct device *dev) { return 0; }
-static inline void wakeup_sysfs_remove(struct device *dev) {}
-static inline int pm_qos_sysfs_add(struct device *dev) { return 0; }
-static inline void pm_qos_sysfs_remove(struct device *dev) {}
-
-static inline void dev_pm_arm_wake_irq(struct wake_irq *wirq)
-{
-}
-
-static inline void dev_pm_disarm_wake_irq(struct wake_irq *wirq)
-{
-}
-
-static inline void dev_pm_enable_wake_irq_check(struct device *dev,
-                                                bool can_change_status)
-{
-}
-
-static inline void dev_pm_disable_wake_irq_check(struct device *dev)
-{
-}
 
 #endif
 
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 8bef3cb2424d..c6030f100c08 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -1563,37 +1563,16 @@ void pm_runtime_clean_up_links(struct device *dev)
 }
 
 /**
- * pm_runtime_get_suppliers - Resume and reference-count supplier devices.
+ * pm_runtime_resume_suppliers - Resume supplier devices.
  * @dev: Consumer device.
  */
-void pm_runtime_get_suppliers(struct device *dev)
+void pm_runtime_resume_suppliers(struct device *dev)
 {
-        struct device_link *link;
-        int idx;
-
-        idx = device_links_read_lock();
-
-        list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
-                if (link->flags & DL_FLAG_PM_RUNTIME)
-                        pm_runtime_get_sync(link->supplier);
-
-        device_links_read_unlock(idx);
-}
-
-/**
- * pm_runtime_put_suppliers - Drop references to supplier devices.
- * @dev: Consumer device.
- */
-void pm_runtime_put_suppliers(struct device *dev)
-{
-        struct device_link *link;
         int idx;
 
         idx = device_links_read_lock();
 
-        list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
-                if (link->flags & DL_FLAG_PM_RUNTIME)
-                        pm_runtime_put(link->supplier);
+        rpm_get_suppliers(dev);
 
         device_links_read_unlock(idx);
 }
@@ -1607,6 +1586,8 @@ void pm_runtime_new_link(struct device *dev)
 
 void pm_runtime_drop_link(struct device *dev)
 {
+        rpm_put_suppliers(dev);
+
         spin_lock_irq(&dev->power.lock);
         WARN_ON(dev->power.links_count == 0);
         dev->power.links_count--;
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index ea01621ed769..e1322788eaee 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -183,7 +183,6 @@ void wakeup_source_add(struct wakeup_source *ws)
         spin_lock_init(&ws->lock);
         timer_setup(&ws->timer, pm_wakeup_timer_fn, 0);
         ws->active = false;
-        ws->last_time = ktime_get();
 
         spin_lock_irqsave(&events_lock, flags);
         list_add_rcu(&ws->entry, &wakeup_sources);
@@ -854,7 +853,7 @@ bool pm_wakeup_pending(void)
         spin_unlock_irqrestore(&events_lock, flags);
 
         if (ret) {
-                pr_info("PM: Wakeup pending, aborting suspend\n");
+                pr_debug("PM: Wakeup pending, aborting suspend\n");
                 pm_print_active_wakeup_sources();
         }
 
@@ -1029,32 +1028,75 @@ static int print_wakeup_source_stats(struct seq_file *m,
         return 0;
 }
 
-/**
- * wakeup_sources_stats_show - Print wakeup sources statistics information.
- * @m: seq_file to print the statistics into.
- */
-static int wakeup_sources_stats_show(struct seq_file *m, void *unused)
+static void *wakeup_sources_stats_seq_start(struct seq_file *m,
+                                        loff_t *pos)
 {
         struct wakeup_source *ws;
-        int srcuidx;
+        loff_t n = *pos;
+        int *srcuidx = m->private;
 
-        seq_puts(m, "name\t\tactive_count\tevent_count\twakeup_count\t"
-                "expire_count\tactive_since\ttotal_time\tmax_time\t"
-                "last_change\tprevent_suspend_time\n");
+        if (n == 0) {
+                seq_puts(m, "name\t\tactive_count\tevent_count\twakeup_count\t"
+                        "expire_count\tactive_since\ttotal_time\tmax_time\t"
+                        "last_change\tprevent_suspend_time\n");
+        }
 
-        srcuidx = srcu_read_lock(&wakeup_srcu);
-        list_for_each_entry_rcu(ws, &wakeup_sources, entry)
-                print_wakeup_source_stats(m, ws);
-        srcu_read_unlock(&wakeup_srcu, srcuidx);
+        *srcuidx = srcu_read_lock(&wakeup_srcu);
+        list_for_each_entry_rcu(ws, &wakeup_sources, entry) {
+                if (n-- <= 0)
+                        return ws;
+        }
+
+        return NULL;
+}
+
+static void *wakeup_sources_stats_seq_next(struct seq_file *m,
+                                        void *v, loff_t *pos)
+{
+        struct wakeup_source *ws = v;
+        struct wakeup_source *next_ws = NULL;
 
-        print_wakeup_source_stats(m, &deleted_ws);
+        ++(*pos);
+
+        list_for_each_entry_continue_rcu(ws, &wakeup_sources, entry) {
+                next_ws = ws;
+                break;
+        }
+
+        return next_ws;
+}
+
+static void wakeup_sources_stats_seq_stop(struct seq_file *m, void *v)
+{
+        int *srcuidx = m->private;
+
+        srcu_read_unlock(&wakeup_srcu, *srcuidx);
+}
+
+/**
+ * wakeup_sources_stats_seq_show - Print wakeup sources statistics information.
+ * @m: seq_file to print the statistics into.
+ * @v: wakeup_source of each iteration
+ */
+static int wakeup_sources_stats_seq_show(struct seq_file *m, void *v)
+{
+        struct wakeup_source *ws = v;
+
+        print_wakeup_source_stats(m, ws);
 
         return 0;
 }
 
+static const struct seq_operations wakeup_sources_stats_seq_ops = {
+        .start = wakeup_sources_stats_seq_start,
+        .next  = wakeup_sources_stats_seq_next,
+        .stop  = wakeup_sources_stats_seq_stop,
+        .show  = wakeup_sources_stats_seq_show,
+};
+
 static int wakeup_sources_stats_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, wakeup_sources_stats_show, NULL);
+        return seq_open_private(file, &wakeup_sources_stats_seq_ops, sizeof(int));
 }
 
 static const struct file_operations wakeup_sources_stats_fops = {
@@ -1062,7 +1104,7 @@ static const struct file_operations wakeup_sources_stats_fops = {
         .open = wakeup_sources_stats_open,
         .read = seq_read,
         .llseek = seq_lseek,
-        .release = single_release,
+        .release = seq_release_private,
 };
 
 static int __init wakeup_sources_debugfs_init(void)
diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
index f040aba48d50..27e9686b6d3a 100644
--- a/drivers/bcma/driver_mips.c
+++ b/drivers/bcma/driver_mips.c
@@ -184,7 +184,7 @@ static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq)
 {
         int i;
         static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"};
-        char interrupts[20];
+        char interrupts[25];
         char *ints = interrupts;
 
         for (i = 0; i < ARRAY_SIZE(irq_name); i++)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 5d4e31655d96..55cf554bc914 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1068,6 +1068,7 @@ static int loop_clr_fd(struct loop_device *lo)
         if (bdev) {
                 bdput(bdev);
                 invalidate_bdev(bdev);
+                bdev->bd_inode->i_mapping->wb_err = 0;
         }
         set_capacity(lo->lo_disk, 0);
         loop_sysfs_exit(lo);
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index 41492e980ef4..34968a381d0f 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -266,15 +266,13 @@ config COMMON_CLK_STM32MP157
           Support for stm32mp157 SoC family clocks
 
 config COMMON_CLK_STM32F
-        bool "Clock driver for stm32f4 and stm32f7 SoC families"
-        depends on MACH_STM32F429 || MACH_STM32F469 || MACH_STM32F746
+        def_bool COMMON_CLK && (MACH_STM32F429 || MACH_STM32F469 || MACH_STM32F746)
         help
         ---help---
           Support for stm32f4 and stm32f7 SoC families clocks
 
 config COMMON_CLK_STM32H7
-        bool "Clock driver for stm32h7 SoC family"
-        depends on MACH_STM32H743
+        def_bool COMMON_CLK && MACH_STM32H743
         help
         ---help---
           Support for stm32h7 SoC family clocks
diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c
index 114ecbb94ec5..12320118f8de 100644
--- a/drivers/clk/imx/clk-imx6ul.c
+++ b/drivers/clk/imx/clk-imx6ul.c
@@ -464,7 +464,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node)
         clk_set_rate(clks[IMX6UL_CLK_AHB], 99000000);
 
         /* Change periph_pre clock to pll2_bus to adjust AXI rate to 264MHz */
-        clk_set_parent(clks[IMX6UL_CLK_PERIPH_CLK2_SEL], clks[IMX6UL_CLK_PLL3_USB_OTG]);
+        clk_set_parent(clks[IMX6UL_CLK_PERIPH_CLK2_SEL], clks[IMX6UL_CLK_OSC]);
         clk_set_parent(clks[IMX6UL_CLK_PERIPH], clks[IMX6UL_CLK_PERIPH_CLK2]);
         clk_set_parent(clks[IMX6UL_CLK_PERIPH_PRE], clks[IMX6UL_CLK_PLL2_BUS]);
         clk_set_parent(clks[IMX6UL_CLK_PERIPH], clks[IMX6UL_CLK_PERIPH_PRE]);
diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
index d4a81be0d7d2..b6be62025325 100644
--- a/drivers/crypto/inside-secure/safexcel.c
+++ b/drivers/crypto/inside-secure/safexcel.c
@@ -152,8 +152,8 @@ static int eip197_load_firmwares(struct safexcel_crypto_priv *priv)
                EIP197_PE_ICE_SCRATCH_CTRL_CHANGE_ACCESS;
         writel(val, EIP197_PE(priv) + EIP197_PE_ICE_SCRATCH_CTRL);
 
-        memset(EIP197_PE(priv) + EIP197_PE_ICE_SCRATCH_RAM, 0,
-               EIP197_NUM_OF_SCRATCH_BLOCKS * sizeof(u32));
+        memset_io(EIP197_PE(priv) + EIP197_PE_ICE_SCRATCH_RAM, 0,
+                  EIP197_NUM_OF_SCRATCH_BLOCKS * sizeof(u32));
 
         eip197_write_firmware(priv, fw[FW_IFPP], EIP197_PE_ICE_FPP_CTRL,
                               EIP197_PE_ICE_RAM_CTRL_FPP_PROG_EN);
diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
index d29275b97e84..4a828c18099a 100644
--- a/drivers/dma/qcom/bam_dma.c
+++ b/drivers/dma/qcom/bam_dma.c
@@ -524,6 +524,14 @@ static int bam_alloc_chan(struct dma_chan *chan)
         return 0;
 }
 
+static int bam_pm_runtime_get_sync(struct device *dev)
+{
+        if (pm_runtime_enabled(dev))
+                return pm_runtime_get_sync(dev);
+
+        return 0;
+}
+
 /**
  * bam_free_chan - Frees dma resources associated with specific channel
  * @chan: specified channel
@@ -539,7 +547,7 @@ static void bam_free_chan(struct dma_chan *chan)
         unsigned long flags;
         int ret;
 
-        ret = pm_runtime_get_sync(bdev->dev);
+        ret = bam_pm_runtime_get_sync(bdev->dev);
         if (ret < 0)
                 return;
 
@@ -720,7 +728,7 @@ static int bam_pause(struct dma_chan *chan)
         unsigned long flag;
         int ret;
 
-        ret = pm_runtime_get_sync(bdev->dev);
+        ret = bam_pm_runtime_get_sync(bdev->dev);
         if (ret < 0)
                 return ret;
 
@@ -746,7 +754,7 @@ static int bam_resume(struct dma_chan *chan)
         unsigned long flag;
         int ret;
 
-        ret = pm_runtime_get_sync(bdev->dev);
+        ret = bam_pm_runtime_get_sync(bdev->dev);
         if (ret < 0)
                 return ret;
 
@@ -852,7 +860,7 @@ static irqreturn_t bam_dma_irq(int irq, void *data)
         if (srcs & P_IRQ)
                 tasklet_schedule(&bdev->task);
 
-        ret = pm_runtime_get_sync(bdev->dev);
+        ret = bam_pm_runtime_get_sync(bdev->dev);
         if (ret < 0)
                 return ret;
 
@@ -969,7 +977,7 @@ static void bam_start_dma(struct bam_chan *bchan)
         if (!vd)
                 return;
 
-        ret = pm_runtime_get_sync(bdev->dev);
+        ret = bam_pm_runtime_get_sync(bdev->dev);
         if (ret < 0)
                 return;
 
diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index 14b147135a0c..2455be8cbc4f 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -778,6 +778,7 @@ scmi_create_protocol_device(struct device_node *np, struct scmi_info *info,
         if (scmi_mbox_chan_setup(info, &sdev->dev, prot_id)) {
                 dev_err(&sdev->dev, "failed to setup transport\n");
                 scmi_device_destroy(sdev);
+                return;
         }
 
         /* setup handle now as the transport is ready */
diff --git a/drivers/firmware/efi/libstub/arm64-stub.c b/drivers/firmware/efi/libstub/arm64-stub.c
index b9bd827caa22..1b4d465cc5d9 100644
--- a/drivers/firmware/efi/libstub/arm64-stub.c
+++ b/drivers/firmware/efi/libstub/arm64-stub.c
@@ -98,6 +98,16 @@ efi_status_t handle_kernel_image(efi_system_table_t *sys_table_arg,
                              (phys_seed >> 32) & mask : TEXT_OFFSET;
 
                 /*
+                 * With CONFIG_RANDOMIZE_TEXT_OFFSET=y, TEXT_OFFSET may not
+                 * be a multiple of EFI_KIMG_ALIGN, and we must ensure that
+                 * we preserve the misalignment of 'offset' relative to
+                 * EFI_KIMG_ALIGN so that statically allocated objects whose
+                 * alignment exceeds PAGE_SIZE appear correctly aligned in
+                 * memory.
+                 */
+                offset |= TEXT_OFFSET % EFI_KIMG_ALIGN;
+
+                /*
                  * If KASLR is enabled, and we have some randomness available,
                  * locate the kernel at a randomized offset in physical memory.
                  */
diff --git a/drivers/firmware/qcom_scm-32.c b/drivers/firmware/qcom_scm-32.c
index dfbd894d5bb7..4e24e591ae74 100644
--- a/drivers/firmware/qcom_scm-32.c
+++ b/drivers/firmware/qcom_scm-32.c
@@ -147,7 +147,7 @@ static u32 smc(u32 cmd_addr)
                         "smc    #0      @ switch to secure world\n"
                         : "=r" (r0)
                         : "r" (r0), "r" (r1), "r" (r2)
-                        : "r3");
+                        : "r3", "r12");
         } while (r0 == QCOM_SCM_INTERRUPTED);
 
         return r0;
@@ -263,7 +263,7 @@ static s32 qcom_scm_call_atomic1(u32 svc, u32 cmd, u32 arg1)
                         "smc    #0      @ switch to secure world\n"
                         : "=r" (r0)
                         : "r" (r0), "r" (r1), "r" (r2)
-                        : "r3");
+                        : "r3", "r12");
         return r0;
 }
 
@@ -298,7 +298,7 @@ static s32 qcom_scm_call_atomic2(u32 svc, u32 cmd, u32 arg1, u32 arg2)
                         "smc    #0      @ switch to secure world\n"
                         : "=r" (r0)
                         : "r" (r0), "r" (r1), "r" (r2), "r" (r3)
-                        );
+                        : "r12");
         return r0;
 }
 
@@ -328,7 +328,7 @@ u32 qcom_scm_get_version(void)
                         "smc    #0      @ switch to secure world\n"
                         : "=r" (r0), "=r" (r1)
                         : "r" (r0), "r" (r1)
-                        : "r2", "r3");
+                        : "r2", "r3", "r12");
         } while (r0 == QCOM_SCM_INTERRUPTED);
 
         version = r1;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
index a29362f9ef41..12558044acd4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
@@ -513,7 +513,7 @@ static int acp_hw_fini(void *handle)
         if (adev->acp.acp_genpd) {
                 for (i = 0; i < ACP_DEVS ; i++) {
                         dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i);
-                        ret = pm_genpd_remove_device(&adev->acp.acp_genpd->gpd, dev);
+                        ret = pm_genpd_remove_device(dev);
                         /* If removal fails, dont giveup and try rest */
                         if (ret)
                                 dev_err(dev, "remove dev from genpd failed\n");
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index a1b9338736e3..c2c21d839727 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -716,7 +716,7 @@ static void remove_compat_control_link(struct drm_device *dev)
         if (!minor)
                 return;
 
-        name = kasprintf(GFP_KERNEL, "controlD%d", minor->index);
+        name = kasprintf(GFP_KERNEL, "controlD%d", minor->index + 64);
         if (!name)
                 return;
 
diff --git a/drivers/gpu/drm/drm_dumb_buffers.c b/drivers/gpu/drm/drm_dumb_buffers.c
index 39ac15ce4702..9e2ae02f31e0 100644
--- a/drivers/gpu/drm/drm_dumb_buffers.c
+++ b/drivers/gpu/drm/drm_dumb_buffers.c
@@ -65,12 +65,13 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev,
                 return -EINVAL;
 
         /* overflow checks for 32bit size calculations */
-        /* NOTE: DIV_ROUND_UP() can overflow */
+        if (args->bpp > U32_MAX - 8)
+                return -EINVAL;
         cpp = DIV_ROUND_UP(args->bpp, 8);
-        if (!cpp || cpp > 0xffffffffU / args->width)
+        if (cpp > U32_MAX / args->width)
                 return -EINVAL;
         stride = cpp * args->width;
-        if (args->height > 0xffffffffU / stride)
+        if (args->height > U32_MAX / stride)
                 return -EINVAL;
 
         /* test for wrap-around */
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index e394799979a6..6d9b9453707c 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -212,6 +212,7 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor)
                 return -ENOMEM;
 
         filp->private_data = priv;
+        filp->f_mode |= FMODE_UNSIGNED_OFFSET;
         priv->filp = filp;
         priv->pid = get_pid(task_pid(current));
         priv->minor = minor;
diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
index d596a8302ca3..854bd51b9478 100644
--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
@@ -778,6 +778,9 @@ i915_gem_userptr_ioctl(struct drm_device *dev,
                             I915_USERPTR_UNSYNCHRONIZED))
                 return -EINVAL;
 
+        if (!args->user_size)
+                return -EINVAL;
+
         if (offset_in_page(args->user_ptr | args->user_size))
                 return -EINVAL;
 
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index e6a8c0ee7df1..8a69a9275e28 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -7326,6 +7326,9 @@ enum {
 #define SLICE_ECO_CHICKEN0                      _MMIO(0x7308)
 #define   PIXEL_MASK_CAMMING_DISABLE            (1 << 14)
 
+#define GEN9_WM_CHICKEN3                        _MMIO(0x5588)
+#define   GEN9_FACTOR_IN_CLR_VAL_HIZ            (1 << 9)
+
 /* WaCatErrorRejectionIssue */
 #define GEN7_SQ_CHICKEN_MBCUNIT_CONFIG          _MMIO(0x9030)
 #define  GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB       (1<<11)
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 4ba139c27fba..f7c25828d3bb 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1149,6 +1149,10 @@ static int gen9_init_workarounds(struct intel_engine_cs *engine)
         WA_SET_FIELD_MASKED(GEN8_CS_CHICKEN1, GEN9_PREEMPT_GPGPU_LEVEL_MASK,
                             GEN9_PREEMPT_GPGPU_COMMAND_LEVEL);
 
+        /* WaClearHIZ_WM_CHICKEN3:bxt,glk */
+        if (IS_GEN9_LP(dev_priv))
+                WA_SET_BIT_MASKED(GEN9_WM_CHICKEN3, GEN9_FACTOR_IN_CLR_VAL_HIZ);
+
         /* WaVFEStateAfterPipeControlwithMediaStateClear:skl,bxt,glk,cfl */
         ret = wa_ring_whitelist_reg(engine, GEN9_CTX_PREEMPT_REG);
         if (ret)
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index e3a5f673ff67..8704f7f8d072 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -884,6 +884,7 @@ static void execlists_submission_tasklet(unsigned long data)
 
                         head = execlists->csb_head;
                         tail = READ_ONCE(buf[write_idx]);
+                        rmb(); /* Hopefully paired with a wmb() in HW */
                 }
                 GEM_TRACE("%s cs-irq head=%d [%d%s], tail=%d [%d%s]\n",
                           engine->name,
diff --git a/drivers/gpu/drm/rcar-du/rcar_lvds.c b/drivers/gpu/drm/rcar-du/rcar_lvds.c
index 3d2d3bbd1342..155ad840f3c5 100644
--- a/drivers/gpu/drm/rcar-du/rcar_lvds.c
+++ b/drivers/gpu/drm/rcar-du/rcar_lvds.c
@@ -88,6 +88,9 @@ static int rcar_lvds_connector_atomic_check(struct drm_connector *connector,
         const struct drm_display_mode *panel_mode;
         struct drm_crtc_state *crtc_state;
 
+        if (!state->crtc)
+                return 0;
+
         if (list_empty(&connector->modes)) {
                 dev_dbg(lvds->dev, "connector: empty modes list\n");
                 return -EINVAL;
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 94b99c90425a..7c95ed5c5cac 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -130,6 +130,7 @@ static void vc4_close(struct drm_device *dev, struct drm_file *file)
         struct vc4_file *vc4file = file->driver_priv;
 
         vc4_perfmon_close_file(vc4file);
+        kfree(vc4file);
 }
 
 static const struct vm_operations_struct vc4_vm_ops = {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 70e1a8820a7c..8b770a8e02cd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -1278,8 +1278,6 @@ static void vmw_master_drop(struct drm_device *dev,
         dev_priv->active_master = &dev_priv->fbdev_master;
         ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
         ttm_vt_unlock(&dev_priv->fbdev_master.lock);
-
-        vmw_fb_refresh(dev_priv);
 }
 
 /**
@@ -1483,7 +1481,6 @@ static int vmw_pm_freeze(struct device *kdev)
                         vmw_kms_resume(dev);
                 if (dev_priv->enable_fb)
                         vmw_fb_on(dev_priv);
-                vmw_fb_refresh(dev_priv);
                 return -EBUSY;
         }
 
@@ -1523,8 +1520,6 @@ static int vmw_pm_restore(struct device *kdev)
         if (dev_priv->enable_fb)
                 vmw_fb_on(dev_priv);
 
-        vmw_fb_refresh(dev_priv);
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index f34f368c1a2e..5fcbe1620d50 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -910,7 +910,6 @@ int vmw_fb_init(struct vmw_private *vmw_priv);
 int vmw_fb_close(struct vmw_private *dev_priv);
 int vmw_fb_off(struct vmw_private *vmw_priv);
 int vmw_fb_on(struct vmw_private *vmw_priv);
-void vmw_fb_refresh(struct vmw_private *vmw_priv);
 
 /**
  * Kernel modesetting - vmwgfx_kms.c
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index ba0cdb743c3e..54e300365a5c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -866,21 +866,13 @@ int vmw_fb_on(struct vmw_private *vmw_priv)
         spin_lock_irqsave(&par->dirty.lock, flags);
         par->dirty.active = true;
         spin_unlock_irqrestore(&par->dirty.lock, flags);
- 
-        return 0;
-}
 
-/**
- * vmw_fb_refresh - Refresh fb display
- *
- * @vmw_priv: Pointer to device private
- *
- * Call into kms to show the fbdev display(s).
- */
-void vmw_fb_refresh(struct vmw_private *vmw_priv)
-{
-        if (!vmw_priv->fb_info)
-                return;
+        /*
+         * Need to reschedule a dirty update, because otherwise that's
+         * only done in dirty_mark() if the previous coalesced
+         * dirty region was empty.
+         */
+        schedule_delayed_work(&par->local_work, 0);
 
-        vmw_fb_set_par(vmw_priv->fb_info);
+        return 0;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
index cdff99211602..21d746bdc922 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -329,8 +329,6 @@ int vmw_host_get_guestinfo(const char *guest_info_param,
         struct rpc_channel channel;
         char *msg, *reply = NULL;
         size_t reply_len = 0;
-        int ret = 0;
-
 
         if (!vmw_msg_enabled)
                 return -ENODEV;
@@ -344,15 +342,14 @@ int vmw_host_get_guestinfo(const char *guest_info_param,
                 return -ENOMEM;
         }
 
-        if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM) ||
-            vmw_send_msg(&channel, msg) ||
-            vmw_recv_msg(&channel, (void *) &reply, &reply_len) ||
-            vmw_close_channel(&channel)) {
-                DRM_ERROR("Failed to get %s", guest_info_param);
+        if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM))
+                goto out_open;
 
-                ret = -EINVAL;
-        }
+        if (vmw_send_msg(&channel, msg) ||
+            vmw_recv_msg(&channel, (void *) &reply, &reply_len))
+                goto out_msg;
 
+        vmw_close_channel(&channel);
         if (buffer && reply && reply_len > 0) {
                 /* Remove reply code, which are the first 2 characters of
                  * the reply
@@ -369,7 +366,17 @@ int vmw_host_get_guestinfo(const char *guest_info_param,
         kfree(reply);
         kfree(msg);
 
-        return ret;
+        return 0;
+
+out_msg:
+        vmw_close_channel(&channel);
+        kfree(reply);
+out_open:
+        *length = 0;
+        kfree(msg);
+        DRM_ERROR("Failed to get %s", guest_info_param);
+
+        return -EINVAL;
 }
 
 
@@ -400,15 +407,22 @@ int vmw_host_log(const char *log)
                 return -ENOMEM;
         }
 
-        if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM) ||
-            vmw_send_msg(&channel, msg) ||
-            vmw_close_channel(&channel)) {
-                DRM_ERROR("Failed to send log\n");
+        if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM))
+                goto out_open;
 
-                ret = -EINVAL;
-        }
+        if (vmw_send_msg(&channel, msg))
+                goto out_msg;
 
+        vmw_close_channel(&channel);
         kfree(msg);
 
-        return ret;
+        return 0;
+
+out_msg:
+        vmw_close_channel(&channel);
+out_open:
+        kfree(msg);
+        DRM_ERROR("Failed to send log\n");
+
+        return -EINVAL;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h
index 557a033fb610..8545488aa0cf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h
@@ -135,17 +135,24 @@
 
 #else
 
-/* In the 32-bit version of this macro, we use "m" because there is no
- * more register left for bp
+/*
+ * In the 32-bit version of this macro, we store bp in a memory location
+ * because we've ran out of registers.
+ * Now we can't reference that memory location while we've modified
+ * %esp or %ebp, so we first push it on the stack, just before we push
+ * %ebp, and then when we need it we read it from the stack where we
+ * just pushed it.
  */
 #define VMW_PORT_HB_OUT(cmd, in_ecx, in_si, in_di,      \
                         port_num, magic, bp,            \
                         eax, ebx, ecx, edx, si, di)     \
 ({                                                      \
-        asm volatile ("push %%ebp;"                     \
-                "mov %12, %%ebp;"                       \
+        asm volatile ("push %12;"                       \
+                "push %%ebp;"                           \
+                "mov 0x04(%%esp), %%ebp;"               \
                 "rep outsb;"                            \
-                "pop %%ebp;" :                          \
+                "pop %%ebp;"                            \
+                "add $0x04, %%esp;" :                   \
                 "=a"(eax),                              \
                 "=b"(ebx),                              \
                 "=c"(ecx),                              \
@@ -167,10 +174,12 @@
                        port_num, magic, bp,             \
                        eax, ebx, ecx, edx, si, di)      \
 ({                                                      \
-        asm volatile ("push %%ebp;"                     \
-                "mov %12, %%ebp;"                       \
+        asm volatile ("push %12;"                       \
+                "push %%ebp;"                           \
+                "mov 0x04(%%esp), %%ebp;"               \
                 "rep insb;"                             \
-                "pop %%ebp" :                           \
+                "pop %%ebp;"                            \
+                "add $0x04, %%esp;" :                   \
                 "=a"(eax),                              \
                 "=b"(ebx),                              \
                 "=c"(ecx),                              \
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index 648f8127f65a..3d667e903beb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -482,6 +482,8 @@ vmw_sou_primary_plane_prepare_fb(struct drm_plane *plane,
                 return ret;
         }
 
+        vps->dmabuf_size = size;
+
         /*
          * TTM already thinks the buffer is pinned, but make sure the
          * pin_count is upped.
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index f249a4428458..6ec307c93ece 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -272,7 +272,7 @@ config SENSORS_K8TEMP
 
 config SENSORS_K10TEMP
         tristate "AMD Family 10h+ temperature sensor"
-        depends on X86 && PCI
+        depends on X86 && PCI && AMD_NB
         help
           If you say yes here you get support for the temperature
           sensor(s) inside your CPU. Supported are later revisions of
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index d2cc55e21374..3b73dee6fdc6 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <asm/amd_nb.h>
 #include <asm/processor.h>
 
 MODULE_DESCRIPTION("AMD Family 10h+ CPU core temperature monitor");
@@ -40,8 +41,8 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
 #define PCI_DEVICE_ID_AMD_17H_DF_F3     0x1463
 #endif
 
-#ifndef PCI_DEVICE_ID_AMD_17H_RR_NB
-#define PCI_DEVICE_ID_AMD_17H_RR_NB     0x15d0
+#ifndef PCI_DEVICE_ID_AMD_17H_M10H_DF_F3
+#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F3        0x15eb
 #endif
 
 /* CPUID function 0x80000001, ebx */
@@ -63,10 +64,12 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
 #define  NB_CAP_HTC                     0x00000400
 
 /*
- * For F15h M60h, functionality of REG_REPORTED_TEMPERATURE
- * has been moved to D0F0xBC_xD820_0CA4 [Reported Temperature
- * Control]
+ * For F15h M60h and M70h, REG_HARDWARE_THERMAL_CONTROL
+ * and REG_REPORTED_TEMPERATURE have been moved to
+ * D0F0xBC_xD820_0C64 [Hardware Temperature Control]
+ * D0F0xBC_xD820_0CA4 [Reported Temperature Control]
  */
+#define F15H_M60H_HARDWARE_TEMP_CTRL_OFFSET     0xd8200c64
 #define F15H_M60H_REPORTED_TEMP_CTRL_OFFSET     0xd8200ca4
 
 /* F17h M01h Access througn SMN */
@@ -74,6 +77,7 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
 
 struct k10temp_data {
         struct pci_dev *pdev;
+        void (*read_htcreg)(struct pci_dev *pdev, u32 *regval);
         void (*read_tempreg)(struct pci_dev *pdev, u32 *regval);
         int temp_offset;
         u32 temp_adjust_mask;
@@ -98,6 +102,11 @@ static const struct tctl_offset tctl_offset_table[] = {
         { 0x17, "AMD Ryzen Threadripper 1910", 10000 },
 };
 
+static void read_htcreg_pci(struct pci_dev *pdev, u32 *regval)
+{
+        pci_read_config_dword(pdev, REG_HARDWARE_THERMAL_CONTROL, regval);
+}
+
 static void read_tempreg_pci(struct pci_dev *pdev, u32 *regval)
 {
         pci_read_config_dword(pdev, REG_REPORTED_TEMPERATURE, regval);
@@ -114,6 +123,12 @@ static void amd_nb_index_read(struct pci_dev *pdev, unsigned int devfn,
         mutex_unlock(&nb_smu_ind_mutex);
 }
 
+static void read_htcreg_nb_f15(struct pci_dev *pdev, u32 *regval)
+{
+        amd_nb_index_read(pdev, PCI_DEVFN(0, 0), 0xb8,
+                          F15H_M60H_HARDWARE_TEMP_CTRL_OFFSET, regval);
+}
+
 static void read_tempreg_nb_f15(struct pci_dev *pdev, u32 *regval)
 {
         amd_nb_index_read(pdev, PCI_DEVFN(0, 0), 0xb8,
@@ -122,8 +137,8 @@ static void read_tempreg_nb_f15(struct pci_dev *pdev, u32 *regval)
 
 static void read_tempreg_nb_f17(struct pci_dev *pdev, u32 *regval)
 {
-        amd_nb_index_read(pdev, PCI_DEVFN(0, 0), 0x60,
-                          F17H_M01H_REPORTED_TEMP_CTRL_OFFSET, regval);
+        amd_smn_read(amd_pci_dev_to_node_id(pdev),
+                     F17H_M01H_REPORTED_TEMP_CTRL_OFFSET, regval);
 }
 
 static ssize_t temp1_input_show(struct device *dev,
@@ -160,8 +175,7 @@ static ssize_t show_temp_crit(struct device *dev,
         u32 regval;
         int value;
 
-        pci_read_config_dword(data->pdev,
-                              REG_HARDWARE_THERMAL_CONTROL, &regval);
+        data->read_htcreg(data->pdev, &regval);
         value = ((regval >> 16) & 0x7f) * 500 + 52000;
         if (show_hyst)
                 value -= ((regval >> 24) & 0xf) * 500;
@@ -181,13 +195,18 @@ static umode_t k10temp_is_visible(struct kobject *kobj,
         struct pci_dev *pdev = data->pdev;
 
         if (index >= 2) {
-                u32 reg_caps, reg_htc;
+                u32 reg;
+
+                if (!data->read_htcreg)
+                        return 0;
 
                 pci_read_config_dword(pdev, REG_NORTHBRIDGE_CAPABILITIES,
-                                      &reg_caps);
-                pci_read_config_dword(pdev, REG_HARDWARE_THERMAL_CONTROL,
-                                      &reg_htc);
-                if (!(reg_caps & NB_CAP_HTC) || !(reg_htc & HTC_ENABLE))
+                                      &reg);
+                if (!(reg & NB_CAP_HTC))
+                        return 0;
+
+                data->read_htcreg(data->pdev, &reg);
+                if (!(reg & HTC_ENABLE))
                         return 0;
         }
         return attr->mode;
@@ -268,11 +287,13 @@ static int k10temp_probe(struct pci_dev *pdev,
 
         if (boot_cpu_data.x86 == 0x15 && (boot_cpu_data.x86_model == 0x60 ||
                                           boot_cpu_data.x86_model == 0x70)) {
+                data->read_htcreg = read_htcreg_nb_f15;
                 data->read_tempreg = read_tempreg_nb_f15;
         } else if (boot_cpu_data.x86 == 0x17) {
                 data->temp_adjust_mask = 0x80000;
                 data->read_tempreg = read_tempreg_nb_f17;
         } else {
+                data->read_htcreg = read_htcreg_pci;
                 data->read_tempreg = read_tempreg_pci;
         }
 
@@ -302,7 +323,7 @@ static const struct pci_device_id k10temp_id_table[] = {
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
-        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_RR_NB) },
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F3) },
         {}
 };
 MODULE_DEVICE_TABLE(pci, k10temp_id_table);
diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index fd36c39ddf4e..0cdba29ae0a9 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -209,7 +209,10 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
         i2c_dw_disable_int(dev);
 
         /* Enable the adapter */
-        __i2c_dw_enable_and_wait(dev, true);
+        __i2c_dw_enable(dev, true);
+
+        /* Dummy read to avoid the register getting stuck on Bay Trail */
+        dw_readl(dev, DW_IC_ENABLE_STATUS);
 
         /* Clear and enable interrupts */
         dw_readl(dev, DW_IC_CLR_INTR);
diff --git a/drivers/i2c/busses/i2c-pmcmsp.c b/drivers/i2c/busses/i2c-pmcmsp.c
index 2aa0e83174c5..dae8ac618a52 100644
--- a/drivers/i2c/busses/i2c-pmcmsp.c
+++ b/drivers/i2c/busses/i2c-pmcmsp.c
@@ -564,10 +564,10 @@ static int pmcmsptwi_master_xfer(struct i2c_adapter *adap,
                  * TODO: We could potentially loop and retry in the case
                  * of MSP_TWI_XFER_TIMEOUT.
                  */
-                return -1;
+                return -EIO;
         }
 
-        return 0;
+        return num;
 }
 
 static u32 pmcmsptwi_i2c_func(struct i2c_adapter *adapter)
diff --git a/drivers/i2c/busses/i2c-viperboard.c b/drivers/i2c/busses/i2c-viperboard.c
index e4be86b3de9a..7235c7302bb7 100644
--- a/drivers/i2c/busses/i2c-viperboard.c
+++ b/drivers/i2c/busses/i2c-viperboard.c
@@ -337,7 +337,7 @@ static int vprbrd_i2c_xfer(struct i2c_adapter *i2c, struct i2c_msg *msgs,
                 }
                 mutex_unlock(&vb->lock);
         }
-        return 0;
+        return num;
 error:
         mutex_unlock(&vb->lock);
         return error;
diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index a9126b3cda61..7c3b4740b94b 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -445,10 +445,17 @@ static int acpi_gsb_i2c_read_bytes(struct i2c_client *client,
         msgs[1].buf = buffer;
 
         ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
-        if (ret < 0)
-                dev_err(&client->adapter->dev, "i2c read failed\n");
-        else
+        if (ret < 0) {
+                /* Getting a NACK is unfortunately normal with some DSTDs */
+                if (ret == -EREMOTEIO)
+                        dev_dbg(&client->adapter->dev, "i2c read %d bytes from client@%#x starting at reg %#x failed, error: %d\n",
+                                data_len, client->addr, cmd, ret);
+                else
+                        dev_err(&client->adapter->dev, "i2c read %d bytes from client@%#x starting at reg %#x failed, error: %d\n",
+                                data_len, client->addr, cmd, ret);
+        } else {
                 memcpy(data, buffer, data_len);
+        }
 
         kfree(buffer);
         return ret;
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 1ba40bb2b966..a17f46a95f73 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -363,7 +363,7 @@ static int i2c_device_probe(struct device *dev)
                 goto err_clear_wakeup_irq;
 
         status = dev_pm_domain_attach(&client->dev, true);
-        if (status == -EPROBE_DEFER)
+        if (status)
                 goto err_clear_wakeup_irq;
 
         /*
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 9a4e899d94b3..2b6c9b516070 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -119,7 +119,6 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
         umem->length     = size;
         umem->address    = addr;
         umem->page_shift = PAGE_SHIFT;
-        umem->pid        = get_task_pid(current, PIDTYPE_PID);
         /*
          * We ask for writable memory if any of the following
          * access flags are set.  "Local write" and "remote write"
@@ -132,7 +131,6 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
                  IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_MW_BIND));
 
         if (access & IB_ACCESS_ON_DEMAND) {
-                put_pid(umem->pid);
                 ret = ib_umem_odp_get(context, umem, access);
                 if (ret) {
                         kfree(umem);
@@ -148,7 +146,6 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
 
         page_list = (struct page **) __get_free_page(GFP_KERNEL);
         if (!page_list) {
-                put_pid(umem->pid);
                 kfree(umem);
                 return ERR_PTR(-ENOMEM);
         }
@@ -231,7 +228,6 @@ out:
         if (ret < 0) {
                 if (need_release)
                         __ib_umem_release(context->device, umem, 0);
-                put_pid(umem->pid);
                 kfree(umem);
         } else
                 current->mm->pinned_vm = locked;
@@ -274,8 +270,7 @@ void ib_umem_release(struct ib_umem *umem)
 
         __ib_umem_release(umem->context->device, umem, 1);
 
-        task = get_pid_task(umem->pid, PIDTYPE_PID);
-        put_pid(umem->pid);
+        task = get_pid_task(umem->context->tgid, PIDTYPE_PID);
         if (!task)
                 goto out;
         mm = get_task_mm(task);
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index e90f2fd8dc16..1445918e3239 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -489,10 +489,10 @@ struct ib_mr *c4iw_get_dma_mr(struct ib_pd *pd, int acc)
 err_dereg_mem:
         dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
                   mhp->attr.pbl_addr, mhp->dereg_skb, mhp->wr_waitp);
-err_free_wr_wait:
-        c4iw_put_wr_wait(mhp->wr_waitp);
 err_free_skb:
         kfree_skb(mhp->dereg_skb);
+err_free_wr_wait:
+        c4iw_put_wr_wait(mhp->wr_waitp);
 err_free_mhp:
         kfree(mhp);
         return ERR_PTR(ret);
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index e6a60fa59f2b..e6bdd0c1e80a 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -5944,6 +5944,7 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd,
         u64 status;
         u32 sw_index;
         int i = 0;
+        unsigned long irq_flags;
 
         sw_index = dd->hw_to_sw[hw_context];
         if (sw_index >= dd->num_send_contexts) {
@@ -5953,10 +5954,12 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd,
                 return;
         }
         sci = &dd->send_contexts[sw_index];
+        spin_lock_irqsave(&dd->sc_lock, irq_flags);
         sc = sci->sc;
         if (!sc) {
                 dd_dev_err(dd, "%s: context %u(%u): no sc?\n", __func__,
                            sw_index, hw_context);
+                spin_unlock_irqrestore(&dd->sc_lock, irq_flags);
                 return;
         }
 
@@ -5978,6 +5981,7 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd,
          */
         if (sc->type != SC_USER)
                 queue_work(dd->pport->hfi1_wq, &sc->halt_work);
+        spin_unlock_irqrestore(&dd->sc_lock, irq_flags);
 
         /*
          * Update the counters for the corresponding status bits.
diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
index 14734d0d0b76..3a485f50fede 100644
--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
@@ -377,6 +377,7 @@ struct ib_cq *hns_roce_ib_create_cq(struct ib_device *ib_dev,
 
                         hr_cq->set_ci_db = hr_cq->db.db_record;
                         *hr_cq->set_ci_db = 0;
+                        hr_cq->db_en = 1;
                 }
 
                 /* Init mmt table and write buff address to mtt table */
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
index 47e1b6ac1e1a..8013d69c5ac4 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
@@ -722,6 +722,7 @@ static int hns_roce_v1_rsv_lp_qp(struct hns_roce_dev *hr_dev)
         free_mr->mr_free_pd = to_hr_pd(pd);
         free_mr->mr_free_pd->ibpd.device  = &hr_dev->ib_dev;
         free_mr->mr_free_pd->ibpd.uobject = NULL;
+        free_mr->mr_free_pd->ibpd.__internal_mr = NULL;
         atomic_set(&free_mr->mr_free_pd->ibpd.usecnt, 0);
 
         attr.qp_access_flags    = IB_ACCESS_REMOTE_WRITE;
@@ -1036,7 +1037,7 @@ static void hns_roce_v1_mr_free_work_fn(struct work_struct *work)
 
         do {
                 ret = hns_roce_v1_poll_cq(&mr_free_cq->ib_cq, ne, wc);
-                if (ret < 0) {
+                if (ret < 0 && hr_qp) {
                         dev_err(dev,
                            "(qp:0x%lx) starts, Poll cqe failed(%d) for mr 0x%x free! Remain %d cqe\n",
                            hr_qp->qpn, ret, hr_mr->key, ne);
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 25916e8522ed..1f0965bb64ee 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -142,8 +142,8 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         unsigned long flags;
         unsigned int ind;
         void *wqe = NULL;
-        u32 tmp_len = 0;
         bool loopback;
+        u32 tmp_len;
         int ret = 0;
         u8 *smac;
         int nreq;
@@ -189,6 +189,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
                 owner_bit =
                        ~(((qp->sq.head + nreq) >> ilog2(qp->sq.wqe_cnt)) & 0x1);
+                tmp_len = 0;
 
                 /* Corresponding to the QP type, wqe process separately */
                 if (ibqp->qp_type == IB_QPT_GSI) {
@@ -547,16 +548,20 @@ static int hns_roce_v2_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                 }
 
                 if (i < hr_qp->rq.max_gs) {
-                        dseg[i].lkey = cpu_to_le32(HNS_ROCE_INVALID_LKEY);
-                        dseg[i].addr = 0;
+                        dseg->lkey = cpu_to_le32(HNS_ROCE_INVALID_LKEY);
+                        dseg->addr = 0;
                 }
 
                 /* rq support inline data */
-                sge_list = hr_qp->rq_inl_buf.wqe_list[ind].sg_list;
-                hr_qp->rq_inl_buf.wqe_list[ind].sge_cnt = (u32)wr->num_sge;
-                for (i = 0; i < wr->num_sge; i++) {
-                        sge_list[i].addr = (void *)(u64)wr->sg_list[i].addr;
-                        sge_list[i].len = wr->sg_list[i].length;
+                if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RQ_INLINE) {
+                        sge_list = hr_qp->rq_inl_buf.wqe_list[ind].sg_list;
+                        hr_qp->rq_inl_buf.wqe_list[ind].sge_cnt =
+                                                               (u32)wr->num_sge;
+                        for (i = 0; i < wr->num_sge; i++) {
+                                sge_list[i].addr =
+                                               (void *)(u64)wr->sg_list[i].addr;
+                                sge_list[i].len = wr->sg_list[i].length;
+                        }
                 }
 
                 hr_qp->rq.wrid[ind] = wr->wr_id;
@@ -613,6 +618,8 @@ static void hns_roce_free_cmq_desc(struct hns_roce_dev *hr_dev,
         dma_unmap_single(hr_dev->dev, ring->desc_dma_addr,
                          ring->desc_num * sizeof(struct hns_roce_cmq_desc),
                          DMA_BIDIRECTIONAL);
+
+        ring->desc_dma_addr = 0;
         kfree(ring->desc);
 }
 
@@ -1081,6 +1088,7 @@ static int hns_roce_v2_profile(struct hns_roce_dev *hr_dev)
         if (ret) {
                 dev_err(hr_dev->dev, "Configure global param fail, ret = %d.\n",
                         ret);
+                return ret;
         }
 
         /* Get pf resource owned by every pf */
@@ -1372,6 +1380,8 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
 
         roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_PA_S,
                      mr->type == MR_TYPE_MR ? 0 : 1);
+        roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_INNER_PA_VLD_S,
+                     1);
         mpt_entry->byte_12_mw_pa = cpu_to_le32(mpt_entry->byte_12_mw_pa);
 
         mpt_entry->len_l = cpu_to_le32(lower_32_bits(mr->size));
@@ -2169,6 +2179,7 @@ static void modify_qp_reset_to_init(struct ib_qp *ibqp,
                                     struct hns_roce_v2_qp_context *context,
                                     struct hns_roce_v2_qp_context *qpc_mask)
 {
+        struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
         struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
 
         /*
@@ -2281,7 +2292,8 @@ static void modify_qp_reset_to_init(struct ib_qp *ibqp,
         context->rq_db_record_addr = hr_qp->rdb.dma >> 32;
         qpc_mask->rq_db_record_addr = 0;
 
-        roce_set_bit(context->byte_76_srqn_op_en, V2_QPC_BYTE_76_RQIE_S, 1);
+        roce_set_bit(context->byte_76_srqn_op_en, V2_QPC_BYTE_76_RQIE_S,
+                    (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RQ_INLINE) ? 1 : 0);
         roce_set_bit(qpc_mask->byte_76_srqn_op_en, V2_QPC_BYTE_76_RQIE_S, 0);
 
         roce_set_field(context->byte_80_rnr_rx_cqn, V2_QPC_BYTE_80_RX_CQN_M,
@@ -4703,6 +4715,8 @@ static const struct pci_device_id hns_roce_hw_v2_pci_tbl[] = {
         {0, }
 };
 
+MODULE_DEVICE_TABLE(pci, hns_roce_hw_v2_pci_tbl);
+
 static int hns_roce_hw_v2_get_cfg(struct hns_roce_dev *hr_dev,
                                   struct hnae3_handle *handle)
 {
diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
index 9d48bc07a9e6..96fb6a9ed93c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_main.c
+++ b/drivers/infiniband/hw/hns/hns_roce_main.c
@@ -199,7 +199,7 @@ static int hns_roce_query_device(struct ib_device *ib_dev,
 
         memset(props, 0, sizeof(*props));
 
-        props->sys_image_guid = cpu_to_be32(hr_dev->sys_image_guid);
+        props->sys_image_guid = cpu_to_be64(hr_dev->sys_image_guid);
         props->max_mr_size = (u64)(~(0ULL));
         props->page_size_cap = hr_dev->caps.page_size_cap;
         props->vendor_id = hr_dev->vendor_id;
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index d4aad34c21e2..baaf906f7c2e 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -660,6 +660,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
                                 goto err_rq_sge_list;
                         }
                         *hr_qp->rdb.db_record = 0;
+                        hr_qp->rdb_en = 1;
                 }
 
                 /* Allocate QP buf */
@@ -955,7 +956,14 @@ int hns_roce_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
         }
 
         if (cur_state == new_state && cur_state == IB_QPS_RESET) {
-                ret = 0;
+                if (hr_dev->caps.min_wqes) {
+                        ret = -EPERM;
+                        dev_err(dev, "cur_state=%d new_state=%d\n", cur_state,
+                                new_state);
+                } else {
+                        ret = 0;
+                }
+
                 goto out;
         }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
index d5d8c1be345a..2f2b4426ded7 100644
--- a/drivers/infiniband/hw/i40iw/i40iw.h
+++ b/drivers/infiniband/hw/i40iw/i40iw.h
@@ -207,6 +207,7 @@ struct i40iw_msix_vector {
         u32 irq;
         u32 cpu_affinity;
         u32 ceq_id;
+        cpumask_t mask;
 };
 
 struct l2params_work {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index 4cfa8f4647e2..f7c6fd9ff6e2 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -2093,7 +2093,7 @@ static int i40iw_addr_resolve_neigh_ipv6(struct i40iw_device *iwdev,
         if (netif_is_bond_slave(netdev))
                 netdev = netdev_master_upper_dev_get(netdev);
 
-        neigh = dst_neigh_lookup(dst, &dst_addr);
+        neigh = dst_neigh_lookup(dst, dst_addr.sin6_addr.in6_u.u6_addr32);
 
         rcu_read_lock();
         if (neigh) {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c
index 6139836fb533..c9f62ca7643c 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c
@@ -331,7 +331,7 @@ void i40iw_process_aeq(struct i40iw_device *iwdev)
                 switch (info->ae_id) {
                 case I40IW_AE_LLP_FIN_RECEIVED:
                         if (qp->term_flags)
-                                continue;
+                                break;
                         if (atomic_inc_return(&iwqp->close_timer_started) == 1) {
                                 iwqp->hw_tcp_state = I40IW_TCP_STATE_CLOSE_WAIT;
                                 if ((iwqp->hw_tcp_state == I40IW_TCP_STATE_CLOSE_WAIT) &&
@@ -360,7 +360,7 @@ void i40iw_process_aeq(struct i40iw_device *iwdev)
                         break;
                 case I40IW_AE_LLP_CONNECTION_RESET:
                         if (atomic_read(&iwqp->close_timer_started))
-                                continue;
+                                break;
                         i40iw_cm_disconn(iwqp);
                         break;
                 case I40IW_AE_QP_SUSPEND_COMPLETE:
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index 9cd0d3ef9057..05001e6da1f8 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -687,7 +687,6 @@ static enum i40iw_status_code i40iw_configure_ceq_vector(struct i40iw_device *iw
                                                          struct i40iw_msix_vector *msix_vec)
 {
         enum i40iw_status_code status;
-        cpumask_t mask;
 
         if (iwdev->msix_shared && !ceq_id) {
                 tasklet_init(&iwdev->dpc_tasklet, i40iw_dpc, (unsigned long)iwdev);
@@ -697,9 +696,9 @@ static enum i40iw_status_code i40iw_configure_ceq_vector(struct i40iw_device *iw
                 status = request_irq(msix_vec->irq, i40iw_ceq_handler, 0, "CEQ", iwceq);
         }
 
-        cpumask_clear(&mask);
-        cpumask_set_cpu(msix_vec->cpu_affinity, &mask);
-        irq_set_affinity_hint(msix_vec->irq, &mask);
+        cpumask_clear(&msix_vec->mask);
+        cpumask_set_cpu(msix_vec->cpu_affinity, &msix_vec->mask);
+        irq_set_affinity_hint(msix_vec->irq, &msix_vec->mask);
 
         if (status) {
                 i40iw_pr_err("ceq irq config fail\n");
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 40e4f5ab2b46..68679ad4c6da 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -394,6 +394,7 @@ static struct i40iw_pbl *i40iw_get_pbl(unsigned long va,
 
         list_for_each_entry(iwpbl, pbl_list, list) {
                 if (iwpbl->user_base == va) {
+                        iwpbl->on_list = false;
                         list_del(&iwpbl->list);
                         return iwpbl;
                 }
@@ -614,6 +615,7 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd,
                 return ERR_PTR(-ENOMEM);
 
         iwqp = (struct i40iw_qp *)mem;
+        iwqp->allocated_buffer = mem;
         qp = &iwqp->sc_qp;
         qp->back_qp = (void *)iwqp;
         qp->push_idx = I40IW_INVALID_PUSH_PAGE_INDEX;
@@ -642,7 +644,6 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd,
                 goto error;
         }
 
-        iwqp->allocated_buffer = mem;
         iwqp->iwdev = iwdev;
         iwqp->iwpd = iwpd;
         iwqp->ibqp.qp_num = qp_num;
@@ -1898,6 +1899,7 @@ static struct ib_mr *i40iw_reg_user_mr(struct ib_pd *pd,
                         goto error;
                 spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
                 list_add_tail(&iwpbl->list, &ucontext->qp_reg_mem_list);
+                iwpbl->on_list = true;
                 spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags);
                 break;
         case IW_MEMREG_TYPE_CQ:
@@ -1908,6 +1910,7 @@ static struct ib_mr *i40iw_reg_user_mr(struct ib_pd *pd,
 
                 spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags);
                 list_add_tail(&iwpbl->list, &ucontext->cq_reg_mem_list);
+                iwpbl->on_list = true;
                 spin_unlock_irqrestore(&ucontext->cq_reg_mem_list_lock, flags);
                 break;
         case IW_MEMREG_TYPE_MEM:
@@ -2045,14 +2048,18 @@ static void i40iw_del_memlist(struct i40iw_mr *iwmr,
         switch (iwmr->type) {
         case IW_MEMREG_TYPE_CQ:
                 spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags);
-                if (!list_empty(&ucontext->cq_reg_mem_list))
+                if (iwpbl->on_list) {
+                        iwpbl->on_list = false;
                         list_del(&iwpbl->list);
+                }
                 spin_unlock_irqrestore(&ucontext->cq_reg_mem_list_lock, flags);
                 break;
         case IW_MEMREG_TYPE_QP:
                 spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
-                if (!list_empty(&ucontext->qp_reg_mem_list))
+                if (iwpbl->on_list) {
+                        iwpbl->on_list = false;
                         list_del(&iwpbl->list);
+                }
                 spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags);
                 break;
         default:
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.h b/drivers/infiniband/hw/i40iw/i40iw_verbs.h
index 9067443cd311..76cf173377ab 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.h
@@ -78,6 +78,7 @@ struct i40iw_pbl {
         };
 
         bool pbl_allocated;
+        bool on_list;
         u64 user_base;
         struct i40iw_pble_alloc pble_alloc;
         struct i40iw_mr *iwmr;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index b4d8ff8ab807..69716a7ea993 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2416,7 +2416,7 @@ static void set_proto(void *outer_c, void *outer_v, u8 mask, u8 val)
         MLX5_SET(fte_match_set_lyr_2_4, outer_v, ip_protocol, val);
 }
 
-static void set_flow_label(void *misc_c, void *misc_v, u8 mask, u8 val,
+static void set_flow_label(void *misc_c, void *misc_v, u32 mask, u32 val,
                            bool inner)
 {
         if (inner) {
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 87b7c1be2a11..2193dc1765fb 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -484,11 +484,6 @@ static int qp_has_rq(struct ib_qp_init_attr *attr)
         return 1;
 }
 
-static int first_med_bfreg(void)
-{
-        return 1;
-}
-
 enum {
         /* this is the first blue flame register in the array of bfregs assigned
          * to a processes. Since we do not use it for blue flame but rather
@@ -514,6 +509,12 @@ static int num_med_bfreg(struct mlx5_ib_dev *dev,
         return n >= 0 ? n : 0;
 }
 
+static int first_med_bfreg(struct mlx5_ib_dev *dev,
+                           struct mlx5_bfreg_info *bfregi)
+{
+        return num_med_bfreg(dev, bfregi) ? 1 : -ENOMEM;
+}
+
 static int first_hi_bfreg(struct mlx5_ib_dev *dev,
                           struct mlx5_bfreg_info *bfregi)
 {
@@ -541,10 +542,13 @@ static int alloc_high_class_bfreg(struct mlx5_ib_dev *dev,
 static int alloc_med_class_bfreg(struct mlx5_ib_dev *dev,
                                  struct mlx5_bfreg_info *bfregi)
 {
-        int minidx = first_med_bfreg();
+        int minidx = first_med_bfreg(dev, bfregi);
         int i;
 
-        for (i = first_med_bfreg(); i < first_hi_bfreg(dev, bfregi); i++) {
+        if (minidx < 0)
+                return minidx;
+
+        for (i = minidx; i < first_hi_bfreg(dev, bfregi); i++) {
                 if (bfregi->count[i] < bfregi->count[minidx])
                         minidx = i;
                 if (!bfregi->count[minidx])
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 7d3763b2e01c..3f9afc02d166 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -401,49 +401,47 @@ int qedr_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
 {
         struct qedr_ucontext *ucontext = get_qedr_ucontext(context);
         struct qedr_dev *dev = get_qedr_dev(context->device);
-        unsigned long vm_page = vma->vm_pgoff << PAGE_SHIFT;
-        u64 unmapped_db = dev->db_phys_addr;
+        unsigned long phys_addr = vma->vm_pgoff << PAGE_SHIFT;
         unsigned long len = (vma->vm_end - vma->vm_start);
-        int rc = 0;
-        bool found;
+        unsigned long dpi_start;
+
+        dpi_start = dev->db_phys_addr + (ucontext->dpi * ucontext->dpi_size);
 
         DP_DEBUG(dev, QEDR_MSG_INIT,
-                 "qedr_mmap called vm_page=0x%lx vm_pgoff=0x%lx unmapped_db=0x%llx db_size=%x, len=%lx\n",
-                 vm_page, vma->vm_pgoff, unmapped_db, dev->db_size, len);
-        if (vma->vm_start & (PAGE_SIZE - 1)) {
-                DP_ERR(dev, "Vma_start not page aligned = %ld\n",
-                       vma->vm_start);
+                 "mmap invoked with vm_start=0x%pK, vm_end=0x%pK,vm_pgoff=0x%pK; dpi_start=0x%pK dpi_size=0x%x\n",
+                 (void *)vma->vm_start, (void *)vma->vm_end,
+                 (void *)vma->vm_pgoff, (void *)dpi_start, ucontext->dpi_size);
+
+        if ((vma->vm_start & (PAGE_SIZE - 1)) || (len & (PAGE_SIZE - 1))) {
+                DP_ERR(dev,
+                       "failed mmap, adrresses must be page aligned: start=0x%pK, end=0x%pK\n",
+                       (void *)vma->vm_start, (void *)vma->vm_end);
                 return -EINVAL;
         }
 
-        found = qedr_search_mmap(ucontext, vm_page, len);
-        if (!found) {
-                DP_ERR(dev, "Vma_pgoff not found in mapped array = %ld\n",
+        if (!qedr_search_mmap(ucontext, phys_addr, len)) {
+                DP_ERR(dev, "failed mmap, vm_pgoff=0x%lx is not authorized\n",
                        vma->vm_pgoff);
                 return -EINVAL;
         }
 
-        DP_DEBUG(dev, QEDR_MSG_INIT, "Mapping doorbell bar\n");
-
-        if ((vm_page >= unmapped_db) && (vm_page <= (unmapped_db +
-                                                     dev->db_size))) {
-                DP_DEBUG(dev, QEDR_MSG_INIT, "Mapping doorbell bar\n");
-                if (vma->vm_flags & VM_READ) {
-                        DP_ERR(dev, "Trying to map doorbell bar for read\n");
-                        return -EPERM;
-                }
-
-                vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+        if (phys_addr < dpi_start ||
+            ((phys_addr + len) > (dpi_start + ucontext->dpi_size))) {
+                DP_ERR(dev,
+                       "failed mmap, pages are outside of dpi; page address=0x%pK, dpi_start=0x%pK, dpi_size=0x%x\n",
+                       (void *)phys_addr, (void *)dpi_start,
+                       ucontext->dpi_size);
+                return -EINVAL;
+        }
 
-                rc = io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
-                                        PAGE_SIZE, vma->vm_page_prot);
-        } else {
-                DP_DEBUG(dev, QEDR_MSG_INIT, "Mapping chains\n");
-                rc = remap_pfn_range(vma, vma->vm_start,
-                                     vma->vm_pgoff, len, vma->vm_page_prot);
+        if (vma->vm_flags & VM_READ) {
+                DP_ERR(dev, "failed mmap, cannot map doorbell bar for read\n");
+                return -EINVAL;
         }
-        DP_DEBUG(dev, QEDR_MSG_INIT, "qedr_mmap return code: %d\n", rc);
-        return rc;
+
+        vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+        return io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, len,
+                                  vma->vm_page_prot);
 }
 
 struct ib_pd *qedr_alloc_pd(struct ib_device *ibdev,
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
index 2cb52fd48cf1..73a00a1c06f6 100644
--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -761,7 +761,6 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, struct ib_send_wr *wr,
         unsigned int mask;
         unsigned int length = 0;
         int i;
-        int must_sched;
 
         while (wr) {
                 mask = wr_opcode_mask(wr->opcode, qp);
@@ -791,14 +790,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, struct ib_send_wr *wr,
                 wr = wr->next;
         }
 
-        /*
-         * Must sched in case of GSI QP because ib_send_mad() hold irq lock,
-         * and the requester call ip_local_out_sk() that takes spin_lock_bh.
-         */
-        must_sched = (qp_type(qp) == IB_QPT_GSI) ||
-                        (queue_count(qp->sq.queue) > 1);
-
-        rxe_run_task(&qp->req.task, must_sched);
+        rxe_run_task(&qp->req.task, 1);
         if (unlikely(qp->req.state == QP_STATE_ERROR))
                 rxe_run_task(&qp->comp.task, 1);
 
diff --git a/drivers/infiniband/ulp/srpt/Kconfig b/drivers/infiniband/ulp/srpt/Kconfig
index fb8b7182f05e..25bf6955b6d0 100644
--- a/drivers/infiniband/ulp/srpt/Kconfig
+++ b/drivers/infiniband/ulp/srpt/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_SRPT
         tristate "InfiniBand SCSI RDMA Protocol target support"
-        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && TARGET_CORE
+        depends on INFINIBAND_ADDR_TRANS && TARGET_CORE
         ---help---
 
           Support for the SCSI RDMA Protocol (SRP) Target driver. The
diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c
index 29f99529b187..cfcb32559925 100644
--- a/drivers/input/mouse/elan_i2c_smbus.c
+++ b/drivers/input/mouse/elan_i2c_smbus.c
@@ -130,7 +130,7 @@ static int elan_smbus_get_baseline_data(struct i2c_client *client,
                                         bool max_baseline, u8 *value)
 {
         int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
         error = i2c_smbus_read_block_data(client,
                                           max_baseline ?
@@ -149,7 +149,7 @@ static int elan_smbus_get_version(struct i2c_client *client,
                                   bool iap, u8 *version)
 {
         int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
         error = i2c_smbus_read_block_data(client,
                                           iap ? ETP_SMBUS_IAP_VERSION_CMD :
@@ -170,7 +170,7 @@ static int elan_smbus_get_sm_version(struct i2c_client *client,
                                      u8 *clickpad)
 {
         int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
         error = i2c_smbus_read_block_data(client,
                                           ETP_SMBUS_SM_VERSION_CMD, val);
@@ -188,7 +188,7 @@ static int elan_smbus_get_sm_version(struct i2c_client *client,
 static int elan_smbus_get_product_id(struct i2c_client *client, u16 *id)
 {
         int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
         error = i2c_smbus_read_block_data(client,
                                           ETP_SMBUS_UNIQUEID_CMD, val);
@@ -205,7 +205,7 @@ static int elan_smbus_get_checksum(struct i2c_client *client,
                                    bool iap, u16 *csum)
 {
         int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
         error = i2c_smbus_read_block_data(client,
                                           iap ? ETP_SMBUS_FW_CHECKSUM_CMD :
@@ -226,7 +226,7 @@ static int elan_smbus_get_max(struct i2c_client *client,
 {
         int ret;
         int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
         ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RANGE_CMD, val);
         if (ret != 3) {
@@ -246,7 +246,7 @@ static int elan_smbus_get_resolution(struct i2c_client *client,
 {
         int ret;
         int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
         ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RESOLUTION_CMD, val);
         if (ret != 3) {
@@ -267,7 +267,7 @@ static int elan_smbus_get_num_traces(struct i2c_client *client,
 {
         int ret;
         int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
         ret = i2c_smbus_read_block_data(client, ETP_SMBUS_XY_TRACENUM_CMD, val);
         if (ret != 3) {
@@ -294,7 +294,7 @@ static int elan_smbus_iap_get_mode(struct i2c_client *client,
 {
         int error;
         u16 constant;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
         error = i2c_smbus_read_block_data(client, ETP_SMBUS_IAP_CTRL_CMD, val);
         if (error < 0) {
@@ -345,7 +345,7 @@ static int elan_smbus_prepare_fw_update(struct i2c_client *client)
         int len;
         int error;
         enum tp_mode mode;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
         u8 cmd[4] = {0x0F, 0x78, 0x00, 0x06};
         u16 password;
 
@@ -419,7 +419,7 @@ static int elan_smbus_write_fw_block(struct i2c_client *client,
         struct device *dev = &client->dev;
         int error;
         u16 result;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
         /*
          * Due to the limitation of smbus protocol limiting
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 60f2c463d1cc..a9591d278145 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -172,6 +172,12 @@ static const char * const smbus_pnp_ids[] = {
         "LEN0048", /* X1 Carbon 3 */
         "LEN0046", /* X250 */
         "LEN004a", /* W541 */
+        "LEN0071", /* T480 */
+        "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+        "LEN0073", /* X1 Carbon G5 (Elantech) */
+        "LEN0092", /* X1 Carbon 6 */
+        "LEN0096", /* X280 */
+        "LEN0097", /* X280 -> ALPS trackpoint */
         "LEN200f", /* T450s */
         NULL
 };
diff --git a/drivers/isdn/hardware/eicon/diva.c b/drivers/isdn/hardware/eicon/diva.c
index 944a7f338099..1b25d8bc153a 100644
--- a/drivers/isdn/hardware/eicon/diva.c
+++ b/drivers/isdn/hardware/eicon/diva.c
@@ -388,10 +388,10 @@ void divasa_xdi_driver_unload(void)
 **  Receive and process command from user mode utility
 */
 void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
-                            int length,
+                            int length, void *mptr,
                             divas_xdi_copy_from_user_fn_t cp_fn)
 {
-        diva_xdi_um_cfg_cmd_t msg;
+        diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr;
         diva_os_xdi_adapter_t *a = NULL;
         diva_os_spin_lock_magic_t old_irql;
         struct list_head *tmp;
@@ -401,21 +401,21 @@ void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
                          length, sizeof(diva_xdi_um_cfg_cmd_t)))
                         return NULL;
         }
-        if ((*cp_fn) (os_handle, &msg, src, sizeof(msg)) <= 0) {
+        if ((*cp_fn) (os_handle, msg, src, sizeof(*msg)) <= 0) {
                 DBG_ERR(("A: A(?) open, write error"))
                         return NULL;
         }
         diva_os_enter_spin_lock(&adapter_lock, &old_irql, "open_adapter");
         list_for_each(tmp, &adapter_queue) {
                 a = list_entry(tmp, diva_os_xdi_adapter_t, link);
-                if (a->controller == (int)msg.adapter)
+                if (a->controller == (int)msg->adapter)
                         break;
                 a = NULL;
         }
         diva_os_leave_spin_lock(&adapter_lock, &old_irql, "open_adapter");
 
         if (!a) {
-                DBG_ERR(("A: A(%d) open, adapter not found", msg.adapter))
+                DBG_ERR(("A: A(%d) open, adapter not found", msg->adapter))
                         }
 
         return (a);
@@ -437,8 +437,10 @@ void diva_xdi_close_adapter(void *adapter, void *os_handle)
 
 int
 diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
-               int length, divas_xdi_copy_from_user_fn_t cp_fn)
+               int length, void *mptr,
+               divas_xdi_copy_from_user_fn_t cp_fn)
 {
+        diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr;
         diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter;
         void *data;
 
@@ -459,7 +461,13 @@ diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
                         return (-2);
         }
 
-        length = (*cp_fn) (os_handle, data, src, length);
+        if (msg) {
+                *(diva_xdi_um_cfg_cmd_t *)data = *msg;
+                length = (*cp_fn) (os_handle, (char *)data + sizeof(*msg),
+                                   src + sizeof(*msg), length - sizeof(*msg));
+        } else {
+                length = (*cp_fn) (os_handle, data, src, length);
+        }
         if (length > 0) {
                 if ((*(a->interface.cmd_proc))
                     (a, (diva_xdi_um_cfg_cmd_t *) data, length)) {
diff --git a/drivers/isdn/hardware/eicon/diva.h b/drivers/isdn/hardware/eicon/diva.h
index b067032093a8..1ad76650fbf9 100644
--- a/drivers/isdn/hardware/eicon/diva.h
+++ b/drivers/isdn/hardware/eicon/diva.h
@@ -20,10 +20,11 @@ int diva_xdi_read(void *adapter, void *os_handle, void __user *dst,
                   int max_length, divas_xdi_copy_to_user_fn_t cp_fn);
 
 int diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
-                   int length, divas_xdi_copy_from_user_fn_t cp_fn);
+                   int length, void *msg,
+                   divas_xdi_copy_from_user_fn_t cp_fn);
 
 void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
-                            int length,
+                            int length, void *msg,
                             divas_xdi_copy_from_user_fn_t cp_fn);
 
 void diva_xdi_close_adapter(void *adapter, void *os_handle);
diff --git a/drivers/isdn/hardware/eicon/divasmain.c b/drivers/isdn/hardware/eicon/divasmain.c
index b9980e84f9db..b6a3950b2564 100644
--- a/drivers/isdn/hardware/eicon/divasmain.c
+++ b/drivers/isdn/hardware/eicon/divasmain.c
@@ -591,19 +591,22 @@ static int divas_release(struct inode *inode, struct file *file)
 static ssize_t divas_write(struct file *file, const char __user *buf,
                            size_t count, loff_t *ppos)
 {
+        diva_xdi_um_cfg_cmd_t msg;
         int ret = -EINVAL;
 
         if (!file->private_data) {
                 file->private_data = diva_xdi_open_adapter(file, buf,
-                                                           count,
+                                                           count, &msg,
                                                            xdi_copy_from_user);
-        }
-        if (!file->private_data) {
-                return (-ENODEV);
+                if (!file->private_data)
+                        return (-ENODEV);
+                ret = diva_xdi_write(file->private_data, file,
+                                     buf, count, &msg, xdi_copy_from_user);
+        } else {
+                ret = diva_xdi_write(file->private_data, file,
+                                     buf, count, NULL, xdi_copy_from_user);
         }
 
-        ret = diva_xdi_write(file->private_data, file,
-                             buf, count, xdi_copy_from_user);
         switch (ret) {
         case -1:                /* Message should be removed from rx mailbox first */
                 ret = -EBUSY;
@@ -622,11 +625,12 @@ static ssize_t divas_write(struct file *file, const char __user *buf,
 static ssize_t divas_read(struct file *file, char __user *buf,
                           size_t count, loff_t *ppos)
 {
+        diva_xdi_um_cfg_cmd_t msg;
         int ret = -EINVAL;
 
         if (!file->private_data) {
                 file->private_data = diva_xdi_open_adapter(file, buf,
-                                                           count,
+                                                           count, &msg,
                                                            xdi_copy_from_user);
         }
         if (!file->private_data) {
diff --git a/drivers/md/bcache/debug.c b/drivers/md/bcache/debug.c
index 4e63c6f6c04d..d030ce3025a6 100644
--- a/drivers/md/bcache/debug.c
+++ b/drivers/md/bcache/debug.c
@@ -250,7 +250,9 @@ void bch_debug_exit(void)
 
 int __init bch_debug_init(struct kobject *kobj)
 {
-        bcache_debug = debugfs_create_dir("bcache", NULL);
+        if (!IS_ENABLED(CONFIG_DEBUG_FS))
+                return 0;
 
+        bcache_debug = debugfs_create_dir("bcache", NULL);
         return IS_ERR_OR_NULL(bcache_debug);
 }
diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
index 1b52b8557034..2060d1483043 100644
--- a/drivers/mfd/cros_ec_spi.c
+++ b/drivers/mfd/cros_ec_spi.c
@@ -419,10 +419,25 @@ static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
                 /* Verify that EC can process command */
                 for (i = 0; i < len; i++) {
                         rx_byte = rx_buf[i];
+                        /*
+                         * Seeing the PAST_END, RX_BAD_DATA, or NOT_READY
+                         * markers are all signs that the EC didn't fully
+                         * receive our command. e.g., if the EC is flashing
+                         * itself, it can't respond to any commands and instead
+                         * clocks out EC_SPI_PAST_END from its SPI hardware
+                         * buffer. Similar occurrences can happen if the AP is
+                         * too slow to clock out data after asserting CS -- the
+                         * EC will abort and fill its buffer with
+                         * EC_SPI_RX_BAD_DATA.
+                         *
+                         * In all cases, these errors should be safe to retry.
+                         * Report -EAGAIN and let the caller decide what to do
+                         * about that.
+                         */
                         if (rx_byte == EC_SPI_PAST_END  ||
                             rx_byte == EC_SPI_RX_BAD_DATA ||
                             rx_byte == EC_SPI_NOT_READY) {
-                                ret = -EREMOTEIO;
+                                ret = -EAGAIN;
                                 break;
                         }
                 }
@@ -431,7 +446,7 @@ static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
         if (!ret)
                 ret = cros_ec_spi_receive_packet(ec_dev,
                                 ec_msg->insize + sizeof(*response));
-        else
+        else if (ret != -EAGAIN)
                 dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
 
         final_ret = terminate_request(ec_dev);
@@ -537,10 +552,11 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
                 /* Verify that EC can process command */
                 for (i = 0; i < len; i++) {
                         rx_byte = rx_buf[i];
+                        /* See comments in cros_ec_pkt_xfer_spi() */
                         if (rx_byte == EC_SPI_PAST_END  ||
                             rx_byte == EC_SPI_RX_BAD_DATA ||
                             rx_byte == EC_SPI_NOT_READY) {
-                                ret = -EREMOTEIO;
+                                ret = -EAGAIN;
                                 break;
                         }
                 }
@@ -549,7 +565,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
         if (!ret)
                 ret = cros_ec_spi_receive_response(ec_dev,
                                 ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
-        else
+        else if (ret != -EAGAIN)
                 dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
 
         final_ret = terminate_request(ec_dev);
diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
index a4c9c8297a6d..918d4fb742d1 100644
--- a/drivers/misc/cxl/cxl.h
+++ b/drivers/misc/cxl/cxl.h
@@ -717,6 +717,7 @@ struct cxl {
         bool perst_select_user;
         bool perst_same_image;
         bool psl_timebase_synced;
+        bool tunneled_ops_supported;
 
         /*
          * number of contexts mapped on to this card. Possible values are:
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index 83f1d08058fc..4d6736f9d463 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1742,6 +1742,15 @@ static int cxl_configure_adapter(struct cxl *adapter, struct pci_dev *dev)
         /* Required for devices using CAPP DMA mode, harmless for others */
         pci_set_master(dev);
 
+        adapter->tunneled_ops_supported = false;
+
+        if (cxl_is_power9()) {
+                if (pnv_pci_set_tunnel_bar(dev, 0x00020000E0000000ull, 1))
+                        dev_info(&dev->dev, "Tunneled operations unsupported\n");
+                else
+                        adapter->tunneled_ops_supported = true;
+        }
+
         if ((rc = pnv_phb_to_cxl_mode(dev, adapter->native->sl_ops->capi_mode)))
                 goto err;
 
@@ -1768,6 +1777,9 @@ static void cxl_deconfigure_adapter(struct cxl *adapter)
 {
         struct pci_dev *pdev = to_pci_dev(adapter->dev.parent);
 
+        if (cxl_is_power9())
+                pnv_pci_set_tunnel_bar(pdev, 0x00020000E0000000ull, 0);
+
         cxl_native_release_psl_err_irq(adapter);
         cxl_unmap_adapter_regs(adapter);
 
diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
index 95285b7f636f..4b5a4c5d3c01 100644
--- a/drivers/misc/cxl/sysfs.c
+++ b/drivers/misc/cxl/sysfs.c
@@ -78,6 +78,15 @@ static ssize_t psl_timebase_synced_show(struct device *device,
         return scnprintf(buf, PAGE_SIZE, "%i\n", adapter->psl_timebase_synced);
 }
 
+static ssize_t tunneled_ops_supported_show(struct device *device,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        struct cxl *adapter = to_cxl_adapter(device);
+
+        return scnprintf(buf, PAGE_SIZE, "%i\n", adapter->tunneled_ops_supported);
+}
+
 static ssize_t reset_adapter_store(struct device *device,
                                    struct device_attribute *attr,
                                    const char *buf, size_t count)
@@ -183,6 +192,7 @@ static struct device_attribute adapter_attrs[] = {
         __ATTR_RO(base_image),
         __ATTR_RO(image_loaded),
         __ATTR_RO(psl_timebase_synced),
+        __ATTR_RO(tunneled_ops_supported),
         __ATTR_RW(load_image_on_perst),
         __ATTR_RW(perst_reloads_same_image),
         __ATTR(reset, S_IWUSR, NULL, reset_adapter_store),
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 0c125f207aea..33053b0d1fdf 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -518,7 +518,7 @@ static int at24_get_pdata(struct device *dev, struct at24_platform_data *pdata)
         if (of_node && of_match_device(at24_of_match, dev))
                 cdata = of_device_get_match_data(dev);
         else if (id)
-                cdata = (void *)&id->driver_data;
+                cdata = (void *)id->driver_data;
         else
                 cdata = acpi_device_get_match_data(dev);
 
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 9e923cd1d80e..38a7586b00cc 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2485,7 +2485,7 @@ static long mmc_rpmb_ioctl(struct file *filp, unsigned int cmd,
                 break;
         }
 
-        return 0;
+        return ret;
 }
 
 #ifdef CONFIG_COMPAT
diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index 2b32b88949ba..b6d8203e46eb 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -139,7 +139,7 @@ static int sdio_bus_probe(struct device *dev)
                 return -ENODEV;
 
         ret = dev_pm_domain_attach(dev, false);
-        if (ret == -EPROBE_DEFER)
+        if (ret)
                 return ret;
 
         /* Unbound SDIO functions are always suspended.
diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index 0ef741bc515d..d0e83db42ae5 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -33,6 +33,8 @@ struct sdhci_iproc_host {
         const struct sdhci_iproc_data *data;
         u32 shadow_cmd;
         u32 shadow_blk;
+        bool is_cmd_shadowed;
+        bool is_blk_shadowed;
 };
 
 #define REG_OFFSET_IN_BITS(reg) ((reg) << 3 & 0x18)
@@ -48,8 +50,22 @@ static inline u32 sdhci_iproc_readl(struct sdhci_host *host, int reg)
 
 static u16 sdhci_iproc_readw(struct sdhci_host *host, int reg)
 {
-        u32 val = sdhci_iproc_readl(host, (reg & ~3));
-        u16 word = val >> REG_OFFSET_IN_BITS(reg) & 0xffff;
+        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+        struct sdhci_iproc_host *iproc_host = sdhci_pltfm_priv(pltfm_host);
+        u32 val;
+        u16 word;
+
+        if ((reg == SDHCI_TRANSFER_MODE) && iproc_host->is_cmd_shadowed) {
+                /* Get the saved transfer mode */
+                val = iproc_host->shadow_cmd;
+        } else if ((reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) &&
+                   iproc_host->is_blk_shadowed) {
+                /* Get the saved block info */
+                val = iproc_host->shadow_blk;
+        } else {
+                val = sdhci_iproc_readl(host, (reg & ~3));
+        }
+        word = val >> REG_OFFSET_IN_BITS(reg) & 0xffff;
         return word;
 }
 
@@ -105,13 +121,15 @@ static void sdhci_iproc_writew(struct sdhci_host *host, u16 val, int reg)
 
         if (reg == SDHCI_COMMAND) {
                 /* Write the block now as we are issuing a command */
-                if (iproc_host->shadow_blk != 0) {
+                if (iproc_host->is_blk_shadowed) {
                         sdhci_iproc_writel(host, iproc_host->shadow_blk,
                                 SDHCI_BLOCK_SIZE);
-                        iproc_host->shadow_blk = 0;
+                        iproc_host->is_blk_shadowed = false;
                 }
                 oldval = iproc_host->shadow_cmd;
-        } else if (reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) {
+                iproc_host->is_cmd_shadowed = false;
+        } else if ((reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) &&
+                   iproc_host->is_blk_shadowed) {
                 /* Block size and count are stored in shadow reg */
                 oldval = iproc_host->shadow_blk;
         } else {
@@ -123,9 +141,11 @@ static void sdhci_iproc_writew(struct sdhci_host *host, u16 val, int reg)
         if (reg == SDHCI_TRANSFER_MODE) {
                 /* Save the transfer mode until the command is issued */
                 iproc_host->shadow_cmd = newval;
+                iproc_host->is_cmd_shadowed = true;
         } else if (reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) {
                 /* Save the block info until the command is issued */
                 iproc_host->shadow_blk = newval;
+                iproc_host->is_blk_shadowed = true;
         } else {
                 /* Command or other regular 32-bit write */
                 sdhci_iproc_writel(host, newval, reg & ~3);
@@ -166,7 +186,7 @@ static const struct sdhci_ops sdhci_iproc_32only_ops = {
 
 static const struct sdhci_pltfm_data sdhci_iproc_cygnus_pltfm_data = {
         .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK,
-        .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN,
+        .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN | SDHCI_QUIRK2_HOST_OFF_CARD_ON,
         .ops = &sdhci_iproc_32only_ops,
 };
 
@@ -206,7 +226,6 @@ static const struct sdhci_iproc_data iproc_data = {
         .caps1 = SDHCI_DRIVER_TYPE_C |
                  SDHCI_DRIVER_TYPE_D |
                  SDHCI_SUPPORT_DDR50,
-        .mmc_caps = MMC_CAP_1_8V_DDR,
 };
 
 static const struct sdhci_pltfm_data sdhci_bcm2835_pltfm_data = {
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index db5ec4e8bde9..ebb1d141b900 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -1194,11 +1194,13 @@ static void marvell_nfc_hw_ecc_bch_read_chunk(struct nand_chip *chip, int chunk,
                                   NDCB0_CMD2(NAND_CMD_READSTART);
 
         /*
-         * Trigger the naked read operation only on the last chunk.
-         * Otherwise, use monolithic read.
+         * Trigger the monolithic read on the first chunk, then naked read on
+         * intermediate chunks and finally a last naked read on the last chunk.
          */
-        if (lt->nchunks == 1 || (chunk < lt->nchunks - 1))
+        if (chunk == 0)
                 nfc_op.ndcb[0] |= NDCB0_CMD_XTYPE(XTYPE_MONOLITHIC_RW);
+        else if (chunk < lt->nchunks - 1)
+                nfc_op.ndcb[0] |= NDCB0_CMD_XTYPE(XTYPE_NAKED_RW);
         else
                 nfc_op.ndcb[0] |= NDCB0_CMD_XTYPE(XTYPE_LAST_NAKED_RW);
 
diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
index 23b45da784cb..b89acaee12d4 100644
--- a/drivers/net/dsa/bcm_sf2_cfp.c
+++ b/drivers/net/dsa/bcm_sf2_cfp.c
@@ -354,10 +354,13 @@ static int bcm_sf2_cfp_ipv4_rule_set(struct bcm_sf2_priv *priv, int port,
         /* Locate the first rule available */
         if (fs->location == RX_CLS_LOC_ANY)
                 rule_index = find_first_zero_bit(priv->cfp.used,
-                                                 bcm_sf2_cfp_rule_size(priv));
+                                                 priv->num_cfp_rules);
         else
                 rule_index = fs->location;
 
+        if (rule_index > bcm_sf2_cfp_rule_size(priv))
+                return -ENOSPC;
+
         layout = &udf_tcpip4_layout;
         /* We only use one UDF slice for now */
         slice_num = bcm_sf2_get_slice_number(layout, 0);
@@ -562,19 +565,21 @@ static int bcm_sf2_cfp_ipv6_rule_set(struct bcm_sf2_priv *priv, int port,
          * first half because the HW search is by incrementing addresses.
          */
         if (fs->location == RX_CLS_LOC_ANY)
-                rule_index[0] = find_first_zero_bit(priv->cfp.used,
-                                                    bcm_sf2_cfp_rule_size(priv));
+                rule_index[1] = find_first_zero_bit(priv->cfp.used,
+                                                    priv->num_cfp_rules);
         else
-                rule_index[0] = fs->location;
+                rule_index[1] = fs->location;
+        if (rule_index[1] > bcm_sf2_cfp_rule_size(priv))
+                return -ENOSPC;
 
         /* Flag it as used (cleared on error path) such that we can immediately
          * obtain a second one to chain from.
          */
-        set_bit(rule_index[0], priv->cfp.used);
+        set_bit(rule_index[1], priv->cfp.used);
 
-        rule_index[1] = find_first_zero_bit(priv->cfp.used,
-                                            bcm_sf2_cfp_rule_size(priv));
-        if (rule_index[1] > bcm_sf2_cfp_rule_size(priv)) {
+        rule_index[0] = find_first_zero_bit(priv->cfp.used,
+                                            priv->num_cfp_rules);
+        if (rule_index[0] > bcm_sf2_cfp_rule_size(priv)) {
                 ret = -ENOSPC;
                 goto out_err;
         }
@@ -712,14 +717,14 @@ static int bcm_sf2_cfp_ipv6_rule_set(struct bcm_sf2_priv *priv, int port,
         /* Flag the second half rule as being used now, return it as the
          * location, and flag it as unique while dumping rules
          */
-        set_bit(rule_index[1], priv->cfp.used);
+        set_bit(rule_index[0], priv->cfp.used);
         set_bit(rule_index[1], priv->cfp.unique);
         fs->location = rule_index[1];
 
         return ret;
 
 out_err:
-        clear_bit(rule_index[0], priv->cfp.used);
+        clear_bit(rule_index[1], priv->cfp.used);
         return ret;
 }
 
@@ -785,10 +790,6 @@ static int bcm_sf2_cfp_rule_del_one(struct bcm_sf2_priv *priv, int port,
         int ret;
         u32 reg;
 
-        /* Refuse deletion of unused rules, and the default reserved rule */
-        if (!test_bit(loc, priv->cfp.used) || loc == 0)
-                return -EINVAL;
-
         /* Indicate which rule we want to read */
         bcm_sf2_cfp_rule_addr_set(priv, loc);
 
@@ -826,6 +827,13 @@ static int bcm_sf2_cfp_rule_del(struct bcm_sf2_priv *priv, int port,
         u32 next_loc = 0;
         int ret;
 
+        /* Refuse deleting unused rules, and those that are not unique since
+         * that could leave IPv6 rules with one of the chained rule in the
+         * table.
+         */
+        if (!test_bit(loc, priv->cfp.unique) || loc == 0)
+                return -EINVAL;
+
         ret = bcm_sf2_cfp_rule_del_one(priv, port, loc, &next_loc);
         if (ret)
                 return ret;
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 36c8950dbd2d..176861bd2252 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -1212,9 +1212,9 @@ static int vortex_probe1(struct device *gendev, void __iomem *ioaddr, int irq,
         vp->mii.reg_num_mask = 0x1f;
 
         /* Makes sure rings are at least 16 byte aligned. */
-        vp->rx_ring = pci_alloc_consistent(pdev, sizeof(struct boom_rx_desc) * RX_RING_SIZE
+        vp->rx_ring = dma_alloc_coherent(gendev, sizeof(struct boom_rx_desc) * RX_RING_SIZE
                                            + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
-                                           &vp->rx_ring_dma);
+                                           &vp->rx_ring_dma, GFP_KERNEL);
         retval = -ENOMEM;
         if (!vp->rx_ring)
                 goto free_device;
@@ -1476,11 +1476,10 @@ static int vortex_probe1(struct device *gendev, void __iomem *ioaddr, int irq,
                 return 0;
 
 free_ring:
-        pci_free_consistent(pdev,
-                                                sizeof(struct boom_rx_desc) * RX_RING_SIZE
-                                                        + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
-                                                vp->rx_ring,
-                                                vp->rx_ring_dma);
+        dma_free_coherent(&pdev->dev,
+                sizeof(struct boom_rx_desc) * RX_RING_SIZE +
+                sizeof(struct boom_tx_desc) * TX_RING_SIZE,
+                vp->rx_ring, vp->rx_ring_dma);
 free_device:
         free_netdev(dev);
         pr_err(PFX "vortex_probe1 fails.  Returns %d\n", retval);
@@ -1751,9 +1750,9 @@ vortex_open(struct net_device *dev)
                                 break;                  /* Bad news!  */
 
                         skb_reserve(skb, NET_IP_ALIGN); /* Align IP on 16 byte boundaries */
-                        dma = pci_map_single(VORTEX_PCI(vp), skb->data,
-                                             PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
-                        if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma))
+                        dma = dma_map_single(vp->gendev, skb->data,
+                                             PKT_BUF_SZ, DMA_FROM_DEVICE);
+                        if (dma_mapping_error(vp->gendev, dma))
                                 break;
                         vp->rx_ring[i].addr = cpu_to_le32(dma);
                 }
@@ -2067,9 +2066,9 @@ vortex_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (vp->bus_master) {
                 /* Set the bus-master controller to transfer the packet. */
                 int len = (skb->len + 3) & ~3;
-                vp->tx_skb_dma = pci_map_single(VORTEX_PCI(vp), skb->data, len,
-                                                PCI_DMA_TODEVICE);
-                if (dma_mapping_error(&VORTEX_PCI(vp)->dev, vp->tx_skb_dma)) {
+                vp->tx_skb_dma = dma_map_single(vp->gendev, skb->data, len,
+                                                DMA_TO_DEVICE);
+                if (dma_mapping_error(vp->gendev, vp->tx_skb_dma)) {
                         dev_kfree_skb_any(skb);
                         dev->stats.tx_dropped++;
                         return NETDEV_TX_OK;
@@ -2168,9 +2167,9 @@ boomerang_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         vp->tx_ring[entry].status = cpu_to_le32(skb->len | TxIntrUploaded | AddTCPChksum | AddUDPChksum);
 
         if (!skb_shinfo(skb)->nr_frags) {
-                dma_addr = pci_map_single(VORTEX_PCI(vp), skb->data, skb->len,
-                                          PCI_DMA_TODEVICE);
-                if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr))
+                dma_addr = dma_map_single(vp->gendev, skb->data, skb->len,
+                                          DMA_TO_DEVICE);
+                if (dma_mapping_error(vp->gendev, dma_addr))
                         goto out_dma_err;
 
                 vp->tx_ring[entry].frag[0].addr = cpu_to_le32(dma_addr);
@@ -2178,9 +2177,9 @@ boomerang_start_xmit(struct sk_buff *skb, struct net_device *dev)
         } else {
                 int i;
 
-                dma_addr = pci_map_single(VORTEX_PCI(vp), skb->data,
-                                          skb_headlen(skb), PCI_DMA_TODEVICE);
-                if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr))
+                dma_addr = dma_map_single(vp->gendev, skb->data,
+                                          skb_headlen(skb), DMA_TO_DEVICE);
+                if (dma_mapping_error(vp->gendev, dma_addr))
                         goto out_dma_err;
 
                 vp->tx_ring[entry].frag[0].addr = cpu_to_le32(dma_addr);
@@ -2189,21 +2188,21 @@ boomerang_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
-                        dma_addr = skb_frag_dma_map(&VORTEX_PCI(vp)->dev, frag,
+                        dma_addr = skb_frag_dma_map(vp->gendev, frag,
                                                     0,
                                                     frag->size,
                                                     DMA_TO_DEVICE);
-                        if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr)) {
+                        if (dma_mapping_error(vp->gendev, dma_addr)) {
                                 for(i = i-1; i >= 0; i--)
-                                        dma_unmap_page(&VORTEX_PCI(vp)->dev,
+                                        dma_unmap_page(vp->gendev,
                                                        le32_to_cpu(vp->tx_ring[entry].frag[i+1].addr),
                                                        le32_to_cpu(vp->tx_ring[entry].frag[i+1].length),
                                                        DMA_TO_DEVICE);
 
-                                pci_unmap_single(VORTEX_PCI(vp),
+                                dma_unmap_single(vp->gendev,
                                                  le32_to_cpu(vp->tx_ring[entry].frag[0].addr),
                                                  le32_to_cpu(vp->tx_ring[entry].frag[0].length),
-                                                 PCI_DMA_TODEVICE);
+                                                 DMA_TO_DEVICE);
 
                                 goto out_dma_err;
                         }
@@ -2218,8 +2217,8 @@ boomerang_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         }
 #else
-        dma_addr = pci_map_single(VORTEX_PCI(vp), skb->data, skb->len, PCI_DMA_TODEVICE);
-        if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma_addr))
+        dma_addr = dma_map_single(vp->gendev, skb->data, skb->len, DMA_TO_DEVICE);
+        if (dma_mapping_error(vp->gendev, dma_addr))
                 goto out_dma_err;
         vp->tx_ring[entry].addr = cpu_to_le32(dma_addr);
         vp->tx_ring[entry].length = cpu_to_le32(skb->len | LAST_FRAG);
@@ -2254,7 +2253,7 @@ boomerang_start_xmit(struct sk_buff *skb, struct net_device *dev)
 out:
         return NETDEV_TX_OK;
 out_dma_err:
-        dev_err(&VORTEX_PCI(vp)->dev, "Error mapping dma buffer\n");
+        dev_err(vp->gendev, "Error mapping dma buffer\n");
         goto out;
 }
 
@@ -2322,7 +2321,7 @@ vortex_interrupt(int irq, void *dev_id)
                 if (status & DMADone) {
                         if (ioread16(ioaddr + Wn7_MasterStatus) & 0x1000) {
                                 iowrite16(0x1000, ioaddr + Wn7_MasterStatus); /* Ack the event. */
-                                pci_unmap_single(VORTEX_PCI(vp), vp->tx_skb_dma, (vp->tx_skb->len + 3) & ~3, PCI_DMA_TODEVICE);
+                                dma_unmap_single(vp->gendev, vp->tx_skb_dma, (vp->tx_skb->len + 3) & ~3, DMA_TO_DEVICE);
                                 pkts_compl++;
                                 bytes_compl += vp->tx_skb->len;
                                 dev_kfree_skb_irq(vp->tx_skb); /* Release the transferred buffer */
@@ -2459,19 +2458,19 @@ boomerang_interrupt(int irq, void *dev_id)
                                         struct sk_buff *skb = vp->tx_skbuff[entry];
 #if DO_ZEROCOPY
                                         int i;
-                                        pci_unmap_single(VORTEX_PCI(vp),
+                                        dma_unmap_single(vp->gendev,
                                                         le32_to_cpu(vp->tx_ring[entry].frag[0].addr),
                                                         le32_to_cpu(vp->tx_ring[entry].frag[0].length)&0xFFF,
-                                                        PCI_DMA_TODEVICE);
+                                                        DMA_TO_DEVICE);
 
                                         for (i=1; i<=skb_shinfo(skb)->nr_frags; i++)
-                                                        pci_unmap_page(VORTEX_PCI(vp),
+                                                        dma_unmap_page(vp->gendev,
                                                                                          le32_to_cpu(vp->tx_ring[entry].frag[i].addr),
                                                                                          le32_to_cpu(vp->tx_ring[entry].frag[i].length)&0xFFF,
-                                                                                         PCI_DMA_TODEVICE);
+                                                                                         DMA_TO_DEVICE);
 #else
-                                        pci_unmap_single(VORTEX_PCI(vp),
-                                                le32_to_cpu(vp->tx_ring[entry].addr), skb->len, PCI_DMA_TODEVICE);
+                                        dma_unmap_single(vp->gendev,
+                                                le32_to_cpu(vp->tx_ring[entry].addr), skb->len, DMA_TO_DEVICE);
 #endif
                                         pkts_compl++;
                                         bytes_compl += skb->len;
@@ -2561,14 +2560,14 @@ static int vortex_rx(struct net_device *dev)
                                 /* 'skb_put()' points to the start of sk_buff data area. */
                                 if (vp->bus_master &&
                                         ! (ioread16(ioaddr + Wn7_MasterStatus) & 0x8000)) {
-                                        dma_addr_t dma = pci_map_single(VORTEX_PCI(vp), skb_put(skb, pkt_len),
-                                                                           pkt_len, PCI_DMA_FROMDEVICE);
+                                        dma_addr_t dma = dma_map_single(vp->gendev, skb_put(skb, pkt_len),
+                                                                           pkt_len, DMA_FROM_DEVICE);
                                         iowrite32(dma, ioaddr + Wn7_MasterAddr);
                                         iowrite16((skb->len + 3) & ~3, ioaddr + Wn7_MasterLen);
                                         iowrite16(StartDMAUp, ioaddr + EL3_CMD);
                                         while (ioread16(ioaddr + Wn7_MasterStatus) & 0x8000)
                                                 ;
-                                        pci_unmap_single(VORTEX_PCI(vp), dma, pkt_len, PCI_DMA_FROMDEVICE);
+                                        dma_unmap_single(vp->gendev, dma, pkt_len, DMA_FROM_DEVICE);
                                 } else {
                                         ioread32_rep(ioaddr + RX_FIFO,
                                                      skb_put(skb, pkt_len),
@@ -2635,11 +2634,11 @@ boomerang_rx(struct net_device *dev)
                         if (pkt_len < rx_copybreak &&
                             (skb = netdev_alloc_skb(dev, pkt_len + 2)) != NULL) {
                                 skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
-                                pci_dma_sync_single_for_cpu(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+                                dma_sync_single_for_cpu(vp->gendev, dma, PKT_BUF_SZ, DMA_FROM_DEVICE);
                                 /* 'skb_put()' points to the start of sk_buff data area. */
                                 skb_put_data(skb, vp->rx_skbuff[entry]->data,
                                              pkt_len);
-                                pci_dma_sync_single_for_device(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+                                dma_sync_single_for_device(vp->gendev, dma, PKT_BUF_SZ, DMA_FROM_DEVICE);
                                 vp->rx_copy++;
                         } else {
                                 /* Pre-allocate the replacement skb.  If it or its
@@ -2651,9 +2650,9 @@ boomerang_rx(struct net_device *dev)
                                         dev->stats.rx_dropped++;
                                         goto clear_complete;
                                 }
-                                newdma = pci_map_single(VORTEX_PCI(vp), newskb->data,
-                                                        PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
-                                if (dma_mapping_error(&VORTEX_PCI(vp)->dev, newdma)) {
+                                newdma = dma_map_single(vp->gendev, newskb->data,
+                                                        PKT_BUF_SZ, DMA_FROM_DEVICE);
+                                if (dma_mapping_error(vp->gendev, newdma)) {
                                         dev->stats.rx_dropped++;
                                         consume_skb(newskb);
                                         goto clear_complete;
@@ -2664,7 +2663,7 @@ boomerang_rx(struct net_device *dev)
                                 vp->rx_skbuff[entry] = newskb;
                                 vp->rx_ring[entry].addr = cpu_to_le32(newdma);
                                 skb_put(skb, pkt_len);
-                                pci_unmap_single(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+                                dma_unmap_single(vp->gendev, dma, PKT_BUF_SZ, DMA_FROM_DEVICE);
                                 vp->rx_nocopy++;
                         }
                         skb->protocol = eth_type_trans(skb, dev);
@@ -2761,8 +2760,8 @@ vortex_close(struct net_device *dev)
         if (vp->full_bus_master_rx) { /* Free Boomerang bus master Rx buffers. */
                 for (i = 0; i < RX_RING_SIZE; i++)
                         if (vp->rx_skbuff[i]) {
-                                pci_unmap_single(       VORTEX_PCI(vp), le32_to_cpu(vp->rx_ring[i].addr),
-                                                                        PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+                                dma_unmap_single(vp->gendev, le32_to_cpu(vp->rx_ring[i].addr),
+                                                                        PKT_BUF_SZ, DMA_FROM_DEVICE);
                                 dev_kfree_skb(vp->rx_skbuff[i]);
                                 vp->rx_skbuff[i] = NULL;
                         }
@@ -2775,12 +2774,12 @@ vortex_close(struct net_device *dev)
                                 int k;
 
                                 for (k=0; k<=skb_shinfo(skb)->nr_frags; k++)
-                                                pci_unmap_single(VORTEX_PCI(vp),
+                                                dma_unmap_single(vp->gendev,
                                                                                  le32_to_cpu(vp->tx_ring[i].frag[k].addr),
                                                                                  le32_to_cpu(vp->tx_ring[i].frag[k].length)&0xFFF,
-                                                                                 PCI_DMA_TODEVICE);
+                                                                                 DMA_TO_DEVICE);
 #else
-                                pci_unmap_single(VORTEX_PCI(vp), le32_to_cpu(vp->tx_ring[i].addr), skb->len, PCI_DMA_TODEVICE);
+                                dma_unmap_single(vp->gendev, le32_to_cpu(vp->tx_ring[i].addr), skb->len, DMA_TO_DEVICE);
 #endif
                                 dev_kfree_skb(skb);
                                 vp->tx_skbuff[i] = NULL;
@@ -3288,11 +3287,10 @@ static void vortex_remove_one(struct pci_dev *pdev)
 
         pci_iounmap(pdev, vp->ioaddr);
 
-        pci_free_consistent(pdev,
-                                                sizeof(struct boom_rx_desc) * RX_RING_SIZE
-                                                        + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
-                                                vp->rx_ring,
-                                                vp->rx_ring_dma);
+        dma_free_coherent(&pdev->dev,
+                        sizeof(struct boom_rx_desc) * RX_RING_SIZE +
+                        sizeof(struct boom_tx_desc) * TX_RING_SIZE,
+                        vp->rx_ring, vp->rx_ring_dma);
 
         pci_release_regions(pdev);
 
diff --git a/drivers/net/ethernet/8390/ne.c b/drivers/net/ethernet/8390/ne.c
index ac99d089ac72..1c97e39b478e 100644
--- a/drivers/net/ethernet/8390/ne.c
+++ b/drivers/net/ethernet/8390/ne.c
@@ -164,7 +164,9 @@ bad_clone_list[] __initdata = {
 #define NESM_START_PG   0x40    /* First page of TX buffer */
 #define NESM_STOP_PG    0x80    /* Last page +1 of RX ring */
 
-#if defined(CONFIG_ATARI)       /* 8-bit mode on Atari, normal on Q40 */
+#if defined(CONFIG_MACH_TX49XX)
+#  define DCR_VAL 0x48          /* 8-bit mode */
+#elif defined(CONFIG_ATARI)     /* 8-bit mode on Atari, normal on Q40 */
 #  define DCR_VAL (MACH_IS_ATARI ? 0x48 : 0x49)
 #else
 #  define DCR_VAL 0x49
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index a561705f232c..be198cc0b10c 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1552,22 +1552,26 @@ pcnet32_probe_pci(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!ioaddr) {
                 if (pcnet32_debug & NETIF_MSG_PROBE)
                         pr_err("card has no PCI IO resources, aborting\n");
-                return -ENODEV;
+                err = -ENODEV;
+                goto err_disable_dev;
         }
 
         err = pci_set_dma_mask(pdev, PCNET32_DMA_MASK);
         if (err) {
                 if (pcnet32_debug & NETIF_MSG_PROBE)
                         pr_err("architecture does not support 32bit PCI busmaster DMA\n");
-                return err;
+                goto err_disable_dev;
         }
         if (!request_region(ioaddr, PCNET32_TOTAL_SIZE, "pcnet32_probe_pci")) {
                 if (pcnet32_debug & NETIF_MSG_PROBE)
                         pr_err("io address range already allocated\n");
-                return -EBUSY;
+                err = -EBUSY;
+                goto err_disable_dev;
         }
 
         err = pcnet32_probe1(ioaddr, 1, pdev);
+
+err_disable_dev:
         if (err < 0)
                 pci_disable_device(pdev);
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_entity.h b/drivers/net/ethernet/chelsio/cxgb4/cudbg_entity.h
index b57acb8dc35b..dc25066c59a1 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_entity.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_entity.h
@@ -419,15 +419,15 @@ static const u32 t6_up_cim_reg_array[][IREG_NUM_ELEM + 1] = {
         {0x7b50, 0x7b54, 0x280, 0x20, 0}, /* up_cim_280_to_2fc */
         {0x7b50, 0x7b54, 0x300, 0x20, 0}, /* up_cim_300_to_37c */
         {0x7b50, 0x7b54, 0x380, 0x14, 0}, /* up_cim_380_to_3cc */
-        {0x7b50, 0x7b54, 0x2900, 0x4, 0x4}, /* up_cim_2900_to_3d40 */
-        {0x7b50, 0x7b54, 0x2904, 0x4, 0x4}, /* up_cim_2904_to_3d44 */
-        {0x7b50, 0x7b54, 0x2908, 0x4, 0x4}, /* up_cim_2908_to_3d48 */
-        {0x7b50, 0x7b54, 0x2910, 0x4, 0x4}, /* up_cim_2910_to_3d4c */
-        {0x7b50, 0x7b54, 0x2914, 0x4, 0x4}, /* up_cim_2914_to_3d50 */
-        {0x7b50, 0x7b54, 0x2920, 0x10, 0x10}, /* up_cim_2920_to_2a10 */
-        {0x7b50, 0x7b54, 0x2924, 0x10, 0x10}, /* up_cim_2924_to_2a14 */
-        {0x7b50, 0x7b54, 0x2928, 0x10, 0x10}, /* up_cim_2928_to_2a18 */
-        {0x7b50, 0x7b54, 0x292c, 0x10, 0x10}, /* up_cim_292c_to_2a1c */
+        {0x7b50, 0x7b54, 0x4900, 0x4, 0x4}, /* up_cim_4900_to_4c60 */
+        {0x7b50, 0x7b54, 0x4904, 0x4, 0x4}, /* up_cim_4904_to_4c64 */
+        {0x7b50, 0x7b54, 0x4908, 0x4, 0x4}, /* up_cim_4908_to_4c68 */
+        {0x7b50, 0x7b54, 0x4910, 0x4, 0x4}, /* up_cim_4910_to_4c70 */
+        {0x7b50, 0x7b54, 0x4914, 0x4, 0x4}, /* up_cim_4914_to_4c74 */
+        {0x7b50, 0x7b54, 0x4920, 0x10, 0x10}, /* up_cim_4920_to_4a10 */
+        {0x7b50, 0x7b54, 0x4924, 0x10, 0x10}, /* up_cim_4924_to_4a14 */
+        {0x7b50, 0x7b54, 0x4928, 0x10, 0x10}, /* up_cim_4928_to_4a18 */
+        {0x7b50, 0x7b54, 0x492c, 0x10, 0x10}, /* up_cim_492c_to_4a1c */
 };
 
 static const u32 t5_up_cim_reg_array[][IREG_NUM_ELEM + 1] = {
@@ -444,16 +444,6 @@ static const u32 t5_up_cim_reg_array[][IREG_NUM_ELEM + 1] = {
         {0x7b50, 0x7b54, 0x280, 0x20, 0}, /* up_cim_280_to_2fc */
         {0x7b50, 0x7b54, 0x300, 0x20, 0}, /* up_cim_300_to_37c */
         {0x7b50, 0x7b54, 0x380, 0x14, 0}, /* up_cim_380_to_3cc */
-        {0x7b50, 0x7b54, 0x2900, 0x4, 0x4}, /* up_cim_2900_to_3d40 */
-        {0x7b50, 0x7b54, 0x2904, 0x4, 0x4}, /* up_cim_2904_to_3d44 */
-        {0x7b50, 0x7b54, 0x2908, 0x4, 0x4}, /* up_cim_2908_to_3d48 */
-        {0x7b50, 0x7b54, 0x2910, 0x4, 0x4}, /* up_cim_2910_to_3d4c */
-        {0x7b50, 0x7b54, 0x2914, 0x4, 0x4}, /* up_cim_2914_to_3d50 */
-        {0x7b50, 0x7b54, 0x2918, 0x4, 0x4}, /* up_cim_2918_to_3d54 */
-        {0x7b50, 0x7b54, 0x291c, 0x4, 0x4}, /* up_cim_291c_to_3d58 */
-        {0x7b50, 0x7b54, 0x2924, 0x10, 0x10}, /* up_cim_2924_to_2914 */
-        {0x7b50, 0x7b54, 0x2928, 0x10, 0x10}, /* up_cim_2928_to_2a18 */
-        {0x7b50, 0x7b54, 0x292c, 0x10, 0x10}, /* up_cim_292c_to_2a1c */
 };
 
 static const u32 t6_hma_ireg_array[][IREG_NUM_ELEM] = {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
index db92f1858060..b76447baccaf 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
@@ -836,7 +836,7 @@ bool is_filter_exact_match(struct adapter *adap,
 {
         struct tp_params *tp = &adap->params.tp;
         u64 hash_filter_mask = tp->hash_filter_mask;
-        u32 mask;
+        u64 ntuple_mask = 0;
 
         if (!is_hashfilter(adap))
                 return false;
@@ -865,73 +865,45 @@ bool is_filter_exact_match(struct adapter *adap,
         if (!fs->val.fport || fs->mask.fport != 0xffff)
                 return false;
 
-        if (tp->fcoe_shift >= 0) {
-                mask = (hash_filter_mask >> tp->fcoe_shift) & FT_FCOE_W;
-                if (mask && !fs->mask.fcoe)
-                        return false;
-        }
+        /* calculate tuple mask and compare with mask configured in hw */
+        if (tp->fcoe_shift >= 0)
+                ntuple_mask |= (u64)fs->mask.fcoe << tp->fcoe_shift;
 
-        if (tp->port_shift >= 0) {
-                mask = (hash_filter_mask >> tp->port_shift) & FT_PORT_W;
-                if (mask && !fs->mask.iport)
-                        return false;
-        }
+        if (tp->port_shift >= 0)
+                ntuple_mask |= (u64)fs->mask.iport << tp->port_shift;
 
         if (tp->vnic_shift >= 0) {
-                mask = (hash_filter_mask >> tp->vnic_shift) & FT_VNIC_ID_W;
-
-                if ((adap->params.tp.ingress_config & VNIC_F)) {
-                        if (mask && !fs->mask.pfvf_vld)
-                                return false;
-                } else {
-                        if (mask && !fs->mask.ovlan_vld)
-                                return false;
-                }
+                if ((adap->params.tp.ingress_config & VNIC_F))
+                        ntuple_mask |= (u64)fs->mask.pfvf_vld << tp->vnic_shift;
+                else
+                        ntuple_mask |= (u64)fs->mask.ovlan_vld <<
+                                tp->vnic_shift;
         }
 
-        if (tp->vlan_shift >= 0) {
-                mask = (hash_filter_mask >> tp->vlan_shift) & FT_VLAN_W;
-                if (mask && !fs->mask.ivlan)
-                        return false;
-        }
+        if (tp->vlan_shift >= 0)
+                ntuple_mask |= (u64)fs->mask.ivlan << tp->vlan_shift;
 
-        if (tp->tos_shift >= 0) {
-                mask = (hash_filter_mask >> tp->tos_shift) & FT_TOS_W;
-                if (mask && !fs->mask.tos)
-                        return false;
-        }
+        if (tp->tos_shift >= 0)
+                ntuple_mask |= (u64)fs->mask.tos << tp->tos_shift;
 
-        if (tp->protocol_shift >= 0) {
-                mask = (hash_filter_mask >> tp->protocol_shift) & FT_PROTOCOL_W;
-                if (mask && !fs->mask.proto)
-                        return false;
-        }
+        if (tp->protocol_shift >= 0)
+                ntuple_mask |= (u64)fs->mask.proto << tp->protocol_shift;
 
-        if (tp->ethertype_shift >= 0) {
-                mask = (hash_filter_mask >> tp->ethertype_shift) &
-                        FT_ETHERTYPE_W;
-                if (mask && !fs->mask.ethtype)
-                        return false;
-        }
+        if (tp->ethertype_shift >= 0)
+                ntuple_mask |= (u64)fs->mask.ethtype << tp->ethertype_shift;
 
-        if (tp->macmatch_shift >= 0) {
-                mask = (hash_filter_mask >> tp->macmatch_shift) & FT_MACMATCH_W;
-                if (mask && !fs->mask.macidx)
-                        return false;
-        }
+        if (tp->macmatch_shift >= 0)
+                ntuple_mask |= (u64)fs->mask.macidx << tp->macmatch_shift;
+
+        if (tp->matchtype_shift >= 0)
+                ntuple_mask |= (u64)fs->mask.matchtype << tp->matchtype_shift;
+
+        if (tp->frag_shift >= 0)
+                ntuple_mask |= (u64)fs->mask.frag << tp->frag_shift;
+
+        if (ntuple_mask != hash_filter_mask)
+                return false;
 
-        if (tp->matchtype_shift >= 0) {
-                mask = (hash_filter_mask >> tp->matchtype_shift) &
-                        FT_MPSHITTYPE_W;
-                if (mask && !fs->mask.matchtype)
-                        return false;
-        }
-        if (tp->frag_shift >= 0) {
-                mask = (hash_filter_mask >> tp->frag_shift) &
-                        FT_FRAGMENTATION_W;
-                if (mask && !fs->mask.frag)
-                        return false;
-        }
         return true;
 }
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 81684acf52af..8a8b12b720ef 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2747,11 +2747,11 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_set_master(pdev);
 
         /* Query PCI controller on system for DMA addressing
-         * limitation for the device.  Try 64-bit first, and
+         * limitation for the device.  Try 47-bit first, and
          * fail to 32-bit.
          */
 
-        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
+        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(47));
         if (err) {
                 err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                 if (err) {
@@ -2765,10 +2765,10 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                         goto err_out_release_regions;
                 }
         } else {
-                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
+                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(47));
                 if (err) {
                         dev_err(dev, "Unable to obtain %u-bit DMA "
-                                "for consistent allocations, aborting\n", 64);
+                                "for consistent allocations, aborting\n", 47);
                         goto err_out_release_regions;
                 }
                 using_dac = 1;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index d4604bc8eb5b..9d3eed46830d 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * Fast Ethernet Controller (FEC) driver for Motorola MPC8xx.
  * Copyright (c) 1997 Dan Malek (dmalek@jlc.net)
diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index f81439796ac7..43d973215040 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -1,20 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Fast Ethernet Controller (ENET) PTP driver for MX6x.
  *
  * Copyright (C) 2012 Freescale Semiconductor, Inc.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 6e8d6a6f6aaf..5ec1185808e5 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -192,6 +192,7 @@ static int alloc_long_term_buff(struct ibmvnic_adapter *adapter,
         if (adapter->fw_done_rc) {
                 dev_err(dev, "Couldn't map long term buffer,rc = %d\n",
                         adapter->fw_done_rc);
+                dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr);
                 return -1;
         }
         return 0;
@@ -795,9 +796,11 @@ static int ibmvnic_login(struct net_device *netdev)
         struct ibmvnic_adapter *adapter = netdev_priv(netdev);
         unsigned long timeout = msecs_to_jiffies(30000);
         int retry_count = 0;
+        bool retry;
         int rc;
 
         do {
+                retry = false;
                 if (retry_count > IBMVNIC_MAX_QUEUES) {
                         netdev_warn(netdev, "Login attempts exceeded\n");
                         return -1;
@@ -821,6 +824,9 @@ static int ibmvnic_login(struct net_device *netdev)
                         retry_count++;
                         release_sub_crqs(adapter, 1);
 
+                        retry = true;
+                        netdev_dbg(netdev,
+                                   "Received partial success, retrying...\n");
                         adapter->init_done_rc = 0;
                         reinit_completion(&adapter->init_done);
                         send_cap_queries(adapter);
@@ -848,7 +854,7 @@ static int ibmvnic_login(struct net_device *netdev)
                         netdev_warn(netdev, "Adapter login failed\n");
                         return -1;
                 }
-        } while (adapter->init_done_rc == PARTIALSUCCESS);
+        } while (retry);
 
         /* handle pending MAC address changes after successful login */
         if (adapter->mac_change_pending) {
@@ -1821,9 +1827,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                         if (rc)
                                 return rc;
                 }
+                ibmvnic_disable_irqs(adapter);
         }
-
-        ibmvnic_disable_irqs(adapter);
         adapter->state = VNIC_CLOSED;
 
         if (reset_state == VNIC_CLOSED)
@@ -2617,18 +2622,21 @@ static int enable_scrq_irq(struct ibmvnic_adapter *adapter,
 {
         struct device *dev = &adapter->vdev->dev;
         unsigned long rc;
-        u64 val;
 
         if (scrq->hw_irq > 0x100000000ULL) {
                 dev_err(dev, "bad hw_irq = %lx\n", scrq->hw_irq);
                 return 1;
         }
 
-        val = (0xff000000) | scrq->hw_irq;
-        rc = plpar_hcall_norets(H_EOI, val);
-        if (rc)
-                dev_err(dev, "H_EOI FAILED irq 0x%llx. rc=%ld\n",
-                        val, rc);
+        if (adapter->resetting &&
+            adapter->reset_reason == VNIC_RESET_MOBILITY) {
+                u64 val = (0xff000000) | scrq->hw_irq;
+
+                rc = plpar_hcall_norets(H_EOI, val);
+                if (rc)
+                        dev_err(dev, "H_EOI FAILED irq 0x%llx. rc=%ld\n",
+                                val, rc);
+        }
 
         rc = plpar_hcall_norets(H_VIOCTL, adapter->vdev->unit_address,
                                 H_ENABLE_VIO_INTERRUPT, scrq->hw_irq, 0, 0);
@@ -4586,14 +4594,6 @@ static int ibmvnic_init(struct ibmvnic_adapter *adapter)
                 release_crq_queue(adapter);
         }
 
-        rc = init_stats_buffers(adapter);
-        if (rc)
-                return rc;
-
-        rc = init_stats_token(adapter);
-        if (rc)
-                return rc;
-
         return rc;
 }
 
@@ -4662,13 +4662,21 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
                         goto ibmvnic_init_fail;
         } while (rc == EAGAIN);
 
+        rc = init_stats_buffers(adapter);
+        if (rc)
+                goto ibmvnic_init_fail;
+
+        rc = init_stats_token(adapter);
+        if (rc)
+                goto ibmvnic_stats_fail;
+
         netdev->mtu = adapter->req_mtu - ETH_HLEN;
         netdev->min_mtu = adapter->min_mtu - ETH_HLEN;
         netdev->max_mtu = adapter->max_mtu - ETH_HLEN;
 
         rc = device_create_file(&dev->dev, &dev_attr_failover);
         if (rc)
-                goto ibmvnic_init_fail;
+                goto ibmvnic_dev_file_err;
 
         netif_carrier_off(netdev);
         rc = register_netdev(netdev);
@@ -4687,6 +4695,12 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
 ibmvnic_register_fail:
         device_remove_file(&dev->dev, &dev_attr_failover);
 
+ibmvnic_dev_file_err:
+        release_stats_token(adapter);
+
+ibmvnic_stats_fail:
+        release_stats_buffers(adapter);
+
 ibmvnic_init_fail:
         release_sub_crqs(adapter, 1);
         release_crq_queue(adapter);
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
index a822f7a56bc5..685337d58276 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
@@ -43,12 +43,12 @@
 #include "fw.h"
 
 /*
- * We allocate in as big chunks as we can, up to a maximum of 256 KB
- * per chunk.
+ * We allocate in page size (default 4KB on many archs) chunks to avoid high
+ * order memory allocations in fragmented/high usage memory situation.
  */
 enum {
-        MLX4_ICM_ALLOC_SIZE     = 1 << 18,
-        MLX4_TABLE_CHUNK_SIZE   = 1 << 18
+        MLX4_ICM_ALLOC_SIZE     = PAGE_SIZE,
+        MLX4_TABLE_CHUNK_SIZE   = PAGE_SIZE,
 };
 
 static void mlx4_free_icm_pages(struct mlx4_dev *dev, struct mlx4_icm_chunk *chunk)
@@ -398,9 +398,11 @@ int mlx4_init_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table,
         u64 size;
 
         obj_per_chunk = MLX4_TABLE_CHUNK_SIZE / obj_size;
+        if (WARN_ON(!obj_per_chunk))
+                return -EINVAL;
         num_icm = (nobj + obj_per_chunk - 1) / obj_per_chunk;
 
-        table->icm      = kcalloc(num_icm, sizeof(*table->icm), GFP_KERNEL);
+        table->icm      = kvzalloc(num_icm * sizeof(*table->icm), GFP_KERNEL);
         if (!table->icm)
                 return -ENOMEM;
         table->virt     = virt;
@@ -446,7 +448,7 @@ err:
                         mlx4_free_icm(dev, table->icm[i], use_coherent);
                 }
 
-        kfree(table->icm);
+        kvfree(table->icm);
 
         return -ENOMEM;
 }
@@ -462,5 +464,5 @@ void mlx4_cleanup_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table)
                         mlx4_free_icm(dev, table->icm[i], table->coherent);
                 }
 
-        kfree(table->icm);
+        kvfree(table->icm);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/intf.c b/drivers/net/ethernet/mellanox/mlx4/intf.c
index 2edcce98ab2d..65482f004e50 100644
--- a/drivers/net/ethernet/mellanox/mlx4/intf.c
+++ b/drivers/net/ethernet/mellanox/mlx4/intf.c
@@ -172,7 +172,7 @@ int mlx4_do_bond(struct mlx4_dev *dev, bool enable)
                 list_add_tail(&dev_ctx->list, &priv->ctx_list);
                 spin_unlock_irqrestore(&priv->ctx_lock, flags);
 
-                mlx4_dbg(dev, "Inrerface for protocol %d restarted with when bonded mode is %s\n",
+                mlx4_dbg(dev, "Interface for protocol %d restarted with bonded mode %s\n",
                          dev_ctx->intf->protocol, enable ?
                          "enabled" : "disabled");
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 211578ffc70d..60172a38c4a4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2929,6 +2929,7 @@ static int mlx4_init_port_info(struct mlx4_dev *dev, int port)
                 mlx4_err(dev, "Failed to create file for port %d\n", port);
                 devlink_port_unregister(&info->devlink_port);
                 info->port = -1;
+                return err;
         }
 
         sprintf(info->dev_mtu_name, "mlx4_port%d_mtu", port);
@@ -2950,9 +2951,10 @@ static int mlx4_init_port_info(struct mlx4_dev *dev, int port)
                                    &info->port_attr);
                 devlink_port_unregister(&info->devlink_port);
                 info->port = -1;
+                return err;
         }
 
-        return err;
+        return 0;
 }
 
 static void mlx4_cleanup_port_info(struct mlx4_port_info *info)
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 3aaf4bad6c5a..427e7a31862c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -393,11 +393,11 @@ struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
         struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
         struct mlx4_qp *qp;
 
-        spin_lock(&qp_table->lock);
+        spin_lock_irq(&qp_table->lock);
 
         qp = __mlx4_qp_lookup(dev, qpn);
 
-        spin_unlock(&qp_table->lock);
+        spin_unlock_irq(&qp_table->lock);
         return qp;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 176645762e49..1ff0b0e93804 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -615,6 +615,45 @@ static inline bool is_last_ethertype_ip(struct sk_buff *skb, int *network_depth)
         return (ethertype == htons(ETH_P_IP) || ethertype == htons(ETH_P_IPV6));
 }
 
+static __be32 mlx5e_get_fcs(struct sk_buff *skb)
+{
+        int last_frag_sz, bytes_in_prev, nr_frags;
+        u8 *fcs_p1, *fcs_p2;
+        skb_frag_t *last_frag;
+        __be32 fcs_bytes;
+
+        if (!skb_is_nonlinear(skb))
+                return *(__be32 *)(skb->data + skb->len - ETH_FCS_LEN);
+
+        nr_frags = skb_shinfo(skb)->nr_frags;
+        last_frag = &skb_shinfo(skb)->frags[nr_frags - 1];
+        last_frag_sz = skb_frag_size(last_frag);
+
+        /* If all FCS data is in last frag */
+        if (last_frag_sz >= ETH_FCS_LEN)
+                return *(__be32 *)(skb_frag_address(last_frag) +
+                                   last_frag_sz - ETH_FCS_LEN);
+
+        fcs_p2 = (u8 *)skb_frag_address(last_frag);
+        bytes_in_prev = ETH_FCS_LEN - last_frag_sz;
+
+        /* Find where the other part of the FCS is - Linear or another frag */
+        if (nr_frags == 1) {
+                fcs_p1 = skb_tail_pointer(skb);
+        } else {
+                skb_frag_t *prev_frag = &skb_shinfo(skb)->frags[nr_frags - 2];
+
+                fcs_p1 = skb_frag_address(prev_frag) +
+                            skb_frag_size(prev_frag);
+        }
+        fcs_p1 -= bytes_in_prev;
+
+        memcpy(&fcs_bytes, fcs_p1, bytes_in_prev);
+        memcpy(((u8 *)&fcs_bytes) + bytes_in_prev, fcs_p2, last_frag_sz);
+
+        return fcs_bytes;
+}
+
 static inline void mlx5e_handle_csum(struct net_device *netdev,
                                      struct mlx5_cqe64 *cqe,
                                      struct mlx5e_rq *rq,
@@ -643,6 +682,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                         skb->csum = csum_partial(skb->data + ETH_HLEN,
                                                  network_depth - ETH_HLEN,
                                                  skb->csum);
+                if (unlikely(netdev->features & NETIF_F_RXFCS))
+                        skb->csum = csum_add(skb->csum,
+                                             (__force __wsum)mlx5e_get_fcs(skb));
                 rq->stats.csum_complete++;
                 return;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
index 0f5da499a223..fad8c2e3804e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
@@ -237,19 +237,17 @@ static void *mlx5_fpga_ipsec_cmd_exec(struct mlx5_core_dev *mdev,
         context->buf.sg[0].data = &context->command;
 
         spin_lock_irqsave(&fdev->ipsec->pending_cmds_lock, flags);
-        list_add_tail(&context->list, &fdev->ipsec->pending_cmds);
+        res = mlx5_fpga_sbu_conn_sendmsg(fdev->ipsec->conn, &context->buf);
+        if (!res)
+                list_add_tail(&context->list, &fdev->ipsec->pending_cmds);
         spin_unlock_irqrestore(&fdev->ipsec->pending_cmds_lock, flags);
 
-        res = mlx5_fpga_sbu_conn_sendmsg(fdev->ipsec->conn, &context->buf);
         if (res) {
-                mlx5_fpga_warn(fdev, "Failure sending IPSec command: %d\n",
-                               res);
-                spin_lock_irqsave(&fdev->ipsec->pending_cmds_lock, flags);
-                list_del(&context->list);
-                spin_unlock_irqrestore(&fdev->ipsec->pending_cmds_lock, flags);
+                mlx5_fpga_warn(fdev, "Failed to send IPSec command: %d\n", res);
                 kfree(context);
                 return ERR_PTR(res);
         }
+
         /* Context will be freed by wait func after completion */
         return context;
 }
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c
index 1dc424685f4e..35fb31f682af 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
@@ -335,7 +335,7 @@ static int nfp_bpf_parse_capabilities(struct nfp_app *app)
                 return PTR_ERR(mem) == -ENOENT ? 0 : PTR_ERR(mem);
 
         start = mem;
-        while (mem - start + 8 < nfp_cpp_area_size(area)) {
+        while (mem - start + 8 <= nfp_cpp_area_size(area)) {
                 u8 __iomem *value;
                 u32 type, length;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
index 00f41c145d4d..820b226d6ff8 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
@@ -77,7 +77,7 @@
 #define ILT_CFG_REG(cli, reg)   PSWRQ2_REG_ ## cli ## _ ## reg ## _RT_OFFSET
 
 /* ILT entry structure */
-#define ILT_ENTRY_PHY_ADDR_MASK         0x000FFFFFFFFFFFULL
+#define ILT_ENTRY_PHY_ADDR_MASK         (~0ULL >> 12)
 #define ILT_ENTRY_PHY_ADDR_SHIFT        0
 #define ILT_ENTRY_VALID_MASK            0x1ULL
 #define ILT_ENTRY_VALID_SHIFT           52
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 38502815d681..468c59d2e491 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -292,6 +292,7 @@ static void qed_ll2_txq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
         struct qed_ll2_tx_packet *p_pkt = NULL;
         struct qed_ll2_info *p_ll2_conn;
         struct qed_ll2_tx_queue *p_tx;
+        unsigned long flags = 0;
         dma_addr_t tx_frag;
 
         p_ll2_conn = qed_ll2_handle_sanity_inactive(p_hwfn, connection_handle);
@@ -300,6 +301,7 @@ static void qed_ll2_txq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
 
         p_tx = &p_ll2_conn->tx_queue;
 
+        spin_lock_irqsave(&p_tx->lock, flags);
         while (!list_empty(&p_tx->active_descq)) {
                 p_pkt = list_first_entry(&p_tx->active_descq,
                                          struct qed_ll2_tx_packet, list_entry);
@@ -309,6 +311,7 @@ static void qed_ll2_txq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
                 list_del(&p_pkt->list_entry);
                 b_last_packet = list_empty(&p_tx->active_descq);
                 list_add_tail(&p_pkt->list_entry, &p_tx->free_descq);
+                spin_unlock_irqrestore(&p_tx->lock, flags);
                 if (p_ll2_conn->input.conn_type == QED_LL2_TYPE_OOO) {
                         struct qed_ooo_buffer *p_buffer;
 
@@ -328,7 +331,9 @@ static void qed_ll2_txq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
                                                       b_last_frag,
                                                       b_last_packet);
                 }
+                spin_lock_irqsave(&p_tx->lock, flags);
         }
+        spin_unlock_irqrestore(&p_tx->lock, flags);
 }
 
 static int qed_ll2_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
@@ -556,6 +561,7 @@ static void qed_ll2_rxq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
         struct qed_ll2_info *p_ll2_conn = NULL;
         struct qed_ll2_rx_packet *p_pkt = NULL;
         struct qed_ll2_rx_queue *p_rx;
+        unsigned long flags = 0;
 
         p_ll2_conn = qed_ll2_handle_sanity_inactive(p_hwfn, connection_handle);
         if (!p_ll2_conn)
@@ -563,13 +569,14 @@ static void qed_ll2_rxq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
 
         p_rx = &p_ll2_conn->rx_queue;
 
+        spin_lock_irqsave(&p_rx->lock, flags);
         while (!list_empty(&p_rx->active_descq)) {
                 p_pkt = list_first_entry(&p_rx->active_descq,
                                          struct qed_ll2_rx_packet, list_entry);
                 if (!p_pkt)
                         break;
-
                 list_move_tail(&p_pkt->list_entry, &p_rx->free_descq);
+                spin_unlock_irqrestore(&p_rx->lock, flags);
 
                 if (p_ll2_conn->input.conn_type == QED_LL2_TYPE_OOO) {
                         struct qed_ooo_buffer *p_buffer;
@@ -588,7 +595,30 @@ static void qed_ll2_rxq_flush(struct qed_hwfn *p_hwfn, u8 connection_handle)
                                                       cookie,
                                                       rx_buf_addr, b_last);
                 }
+                spin_lock_irqsave(&p_rx->lock, flags);
         }
+        spin_unlock_irqrestore(&p_rx->lock, flags);
+}
+
+static bool
+qed_ll2_lb_rxq_handler_slowpath(struct qed_hwfn *p_hwfn,
+                                struct core_rx_slow_path_cqe *p_cqe)
+{
+        struct ooo_opaque *iscsi_ooo;
+        u32 cid;
+
+        if (p_cqe->ramrod_cmd_id != CORE_RAMROD_RX_QUEUE_FLUSH)
+                return false;
+
+        iscsi_ooo = (struct ooo_opaque *)&p_cqe->opaque_data;
+        if (iscsi_ooo->ooo_opcode != TCP_EVENT_DELETE_ISLES)
+                return false;
+
+        /* Need to make a flush */
+        cid = le32_to_cpu(iscsi_ooo->cid);
+        qed_ooo_release_connection_isles(p_hwfn, p_hwfn->p_ooo_info, cid);
+
+        return true;
 }
 
 static int qed_ll2_lb_rxq_handler(struct qed_hwfn *p_hwfn,
@@ -617,6 +647,11 @@ static int qed_ll2_lb_rxq_handler(struct qed_hwfn *p_hwfn,
                 cq_old_idx = qed_chain_get_cons_idx(&p_rx->rcq_chain);
                 cqe_type = cqe->rx_cqe_sp.type;
 
+                if (cqe_type == CORE_RX_CQE_TYPE_SLOW_PATH)
+                        if (qed_ll2_lb_rxq_handler_slowpath(p_hwfn,
+                                                            &cqe->rx_cqe_sp))
+                                continue;
+
                 if (cqe_type != CORE_RX_CQE_TYPE_REGULAR) {
                         DP_NOTICE(p_hwfn,
                                   "Got a non-regular LB LL2 completion [type 0x%02x]\n",
@@ -794,6 +829,9 @@ static int qed_ll2_lb_rxq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
         struct qed_ll2_info *p_ll2_conn = (struct qed_ll2_info *)p_cookie;
         int rc;
 
+        if (!QED_LL2_RX_REGISTERED(p_ll2_conn))
+                return 0;
+
         rc = qed_ll2_lb_rxq_handler(p_hwfn, p_ll2_conn);
         if (rc)
                 return rc;
@@ -814,6 +852,9 @@ static int qed_ll2_lb_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
         u16 new_idx = 0, num_bds = 0;
         int rc;
 
+        if (!QED_LL2_TX_REGISTERED(p_ll2_conn))
+                return 0;
+
         new_idx = le16_to_cpu(*p_tx->p_fw_cons);
         num_bds = ((s16)new_idx - (s16)p_tx->bds_idx);
 
@@ -1867,17 +1908,25 @@ int qed_ll2_terminate_connection(void *cxt, u8 connection_handle)
 
         /* Stop Tx & Rx of connection, if needed */
         if (QED_LL2_TX_REGISTERED(p_ll2_conn)) {
+                p_ll2_conn->tx_queue.b_cb_registred = false;
+                smp_wmb(); /* Make sure this is seen by ll2_lb_rxq_completion */
                 rc = qed_sp_ll2_tx_queue_stop(p_hwfn, p_ll2_conn);
                 if (rc)
                         goto out;
+
                 qed_ll2_txq_flush(p_hwfn, connection_handle);
+                qed_int_unregister_cb(p_hwfn, p_ll2_conn->tx_queue.tx_sb_index);
         }
 
         if (QED_LL2_RX_REGISTERED(p_ll2_conn)) {
+                p_ll2_conn->rx_queue.b_cb_registred = false;
+                smp_wmb(); /* Make sure this is seen by ll2_lb_rxq_completion */
                 rc = qed_sp_ll2_rx_queue_stop(p_hwfn, p_ll2_conn);
                 if (rc)
                         goto out;
+
                 qed_ll2_rxq_flush(p_hwfn, connection_handle);
+                qed_int_unregister_cb(p_hwfn, p_ll2_conn->rx_queue.rx_sb_index);
         }
 
         if (p_ll2_conn->input.conn_type == QED_LL2_TYPE_OOO)
@@ -1925,16 +1974,6 @@ void qed_ll2_release_connection(void *cxt, u8 connection_handle)
         if (!p_ll2_conn)
                 return;
 
-        if (QED_LL2_RX_REGISTERED(p_ll2_conn)) {
-                p_ll2_conn->rx_queue.b_cb_registred = false;
-                qed_int_unregister_cb(p_hwfn, p_ll2_conn->rx_queue.rx_sb_index);
-        }
-
-        if (QED_LL2_TX_REGISTERED(p_ll2_conn)) {
-                p_ll2_conn->tx_queue.b_cb_registred = false;
-                qed_int_unregister_cb(p_hwfn, p_ll2_conn->tx_queue.tx_sb_index);
-        }
-
         kfree(p_ll2_conn->tx_queue.descq_mem);
         qed_chain_free(p_hwfn->cdev, &p_ll2_conn->tx_queue.txq_chain);
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index a01e7d6e5442..f6655e251bbd 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -1066,13 +1066,12 @@ static void __qede_remove(struct pci_dev *pdev, enum qede_remove_mode mode)
 
         DP_INFO(edev, "Starting qede_remove\n");
 
+        qede_rdma_dev_remove(edev);
         unregister_netdev(ndev);
         cancel_delayed_work_sync(&edev->sp_task);
 
         qede_ptp_disable(edev);
 
-        qede_rdma_dev_remove(edev);
-
         edev->ops->common->set_power_state(cdev, PCI_D0);
 
         pci_set_drvdata(pdev, NULL);
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index a5b792ce2ae7..1bf930d4a1e5 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -163,7 +163,7 @@ enum {
 };
 
 /* Driver's parameters */
-#if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARCH_SHMOBILE)
+#if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARCH_RENESAS)
 #define SH_ETH_RX_ALIGN         32
 #else
 #define SH_ETH_RX_ALIGN         2
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 450eec264a5e..4377c26f714d 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -792,8 +792,10 @@ static int ipvlan_device_event(struct notifier_block *unused,
                 break;
 
         case NETDEV_CHANGEADDR:
-                list_for_each_entry(ipvlan, &port->ipvlans, pnode)
+                list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
                         ether_addr_copy(ipvlan->dev->dev_addr, dev->dev_addr);
+                        call_netdevice_notifiers(NETDEV_CHANGEADDR, ipvlan->dev);
+                }
                 break;
 
         case NETDEV_PRE_TYPE_CHANGE:
diff --git a/drivers/net/phy/bcm-cygnus.c b/drivers/net/phy/bcm-cygnus.c
index 6838129839ca..e757b09f1889 100644
--- a/drivers/net/phy/bcm-cygnus.c
+++ b/drivers/net/phy/bcm-cygnus.c
@@ -61,17 +61,17 @@ static int bcm_cygnus_afe_config(struct phy_device *phydev)
                 return rc;
 
         /* make rcal=100, since rdb default is 000 */
-        rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB1, 0x10);
+        rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB1, 0x10);
         if (rc < 0)
                 return rc;
 
         /* CORE_EXPB0, Reset R_CAL/RC_CAL Engine */
-        rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x10);
+        rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x10);
         if (rc < 0)
                 return rc;
 
         /* CORE_EXPB0, Disable Reset R_CAL/RC_CAL Engine */
-        rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x00);
+        rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x00);
 
         return 0;
 }
diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c
index 5ad130c3da43..d5e0833d69b9 100644
--- a/drivers/net/phy/bcm-phy-lib.c
+++ b/drivers/net/phy/bcm-phy-lib.c
@@ -56,7 +56,7 @@ int bcm54xx_auxctl_read(struct phy_device *phydev, u16 regnum)
         /* The register must be written to both the Shadow Register Select and
          * the Shadow Read Register Selector
          */
-        phy_write(phydev, MII_BCM54XX_AUX_CTL, regnum |
+        phy_write(phydev, MII_BCM54XX_AUX_CTL, MII_BCM54XX_AUXCTL_SHDWSEL_MASK |
                   regnum << MII_BCM54XX_AUXCTL_SHDWSEL_READ_SHIFT);
         return phy_read(phydev, MII_BCM54XX_AUX_CTL);
 }
diff --git a/drivers/net/phy/bcm-phy-lib.h b/drivers/net/phy/bcm-phy-lib.h
index 7c73808cbbde..81cceaa412fe 100644
--- a/drivers/net/phy/bcm-phy-lib.h
+++ b/drivers/net/phy/bcm-phy-lib.h
@@ -14,11 +14,18 @@
 #ifndef _LINUX_BCM_PHY_LIB_H
 #define _LINUX_BCM_PHY_LIB_H
 
+#include <linux/brcmphy.h>
 #include <linux/phy.h>
 
 int bcm_phy_write_exp(struct phy_device *phydev, u16 reg, u16 val);
 int bcm_phy_read_exp(struct phy_device *phydev, u16 reg);
 
+static inline int bcm_phy_write_exp_sel(struct phy_device *phydev,
+                                        u16 reg, u16 val)
+{
+        return bcm_phy_write_exp(phydev, reg | MII_BCM54XX_EXP_SEL_ER, val);
+}
+
 int bcm54xx_auxctl_write(struct phy_device *phydev, u16 regnum, u16 val);
 int bcm54xx_auxctl_read(struct phy_device *phydev, u16 regnum);
 
diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c
index 29b1c88b55cc..01d2ff2f6241 100644
--- a/drivers/net/phy/bcm7xxx.c
+++ b/drivers/net/phy/bcm7xxx.c
@@ -65,10 +65,10 @@ struct bcm7xxx_phy_priv {
 static void r_rc_cal_reset(struct phy_device *phydev)
 {
         /* Reset R_CAL/RC_CAL Engine */
-        bcm_phy_write_exp(phydev, 0x00b0, 0x0010);
+        bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0010);
 
         /* Disable Reset R_AL/RC_CAL Engine */
-        bcm_phy_write_exp(phydev, 0x00b0, 0x0000);
+        bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0000);
 }
 
 static int bcm7xxx_28nm_b0_afe_config_init(struct phy_device *phydev)
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index f41b224a9cdb..ab195f0916d6 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -573,9 +573,40 @@ static int ksz9031_config_init(struct phy_device *phydev)
                 ksz9031_of_load_skew_values(phydev, of_node,
                                 MII_KSZ9031RN_TX_DATA_PAD_SKEW, 4,
                                 tx_data_skews, 4);
+
+                /* Silicon Errata Sheet (DS80000691D or DS80000692D):
+                 * When the device links in the 1000BASE-T slave mode only,
+                 * the optional 125MHz reference output clock (CLK125_NDO)
+                 * has wide duty cycle variation.
+                 *
+                 * The optional CLK125_NDO clock does not meet the RGMII
+                 * 45/55 percent (min/max) duty cycle requirement and therefore
+                 * cannot be used directly by the MAC side for clocking
+                 * applications that have setup/hold time requirements on
+                 * rising and falling clock edges.
+                 *
+                 * Workaround:
+                 * Force the phy to be the master to receive a stable clock
+                 * which meets the duty cycle requirement.
+                 */
+                if (of_property_read_bool(of_node, "micrel,force-master")) {
+                        result = phy_read(phydev, MII_CTRL1000);
+                        if (result < 0)
+                                goto err_force_master;
+
+                        /* enable master mode, config & prefer master */
+                        result |= CTL1000_ENABLE_MASTER | CTL1000_AS_MASTER;
+                        result = phy_write(phydev, MII_CTRL1000, result);
+                        if (result < 0)
+                                goto err_force_master;
+                }
         }
 
         return ksz9031_center_flp_timing(phydev);
+
+err_force_master:
+        phydev_err(phydev, "failed to force the phy to master mode\n");
+        return result;
 }
 
 #define KSZ8873MLL_GLOBAL_CONTROL_4     0x06
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index dc7c7ec43202..02ad03a2fab7 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -605,30 +605,13 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
         if (cmd == PPPIOCDETACH) {
                 /*
-                 * We have to be careful here... if the file descriptor
-                 * has been dup'd, we could have another process in the
-                 * middle of a poll using the same file *, so we had
-                 * better not free the interface data structures -
-                 * instead we fail the ioctl.  Even in this case, we
-                 * shut down the interface if we are the owner of it.
-                 * Actually, we should get rid of PPPIOCDETACH, userland
-                 * (i.e. pppd) could achieve the same effect by closing
-                 * this fd and reopening /dev/ppp.
+                 * PPPIOCDETACH is no longer supported as it was heavily broken,
+                 * and is only known to have been used by pppd older than
+                 * ppp-2.4.2 (released November 2003).
                  */
+                pr_warn_once("%s (%d) used obsolete PPPIOCDETACH ioctl\n",
+                             current->comm, current->pid);
                 err = -EINVAL;
-                if (pf->kind == INTERFACE) {
-                        ppp = PF_TO_PPP(pf);
-                        rtnl_lock();
-                        if (file == ppp->owner)
-                                unregister_netdevice(ppp->dev);
-                        rtnl_unlock();
-                }
-                if (atomic_long_read(&file->f_count) < 2) {
-                        ppp_release(NULL, file);
-                        err = 0;
-                } else
-                        pr_warn("PPPIOCDETACH file->f_count=%ld\n",
-                                atomic_long_read(&file->f_count));
                 goto out;
         }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index ef33950a45d9..45d807796a18 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -681,15 +681,6 @@ static void tun_queue_purge(struct tun_file *tfile)
         skb_queue_purge(&tfile->sk.sk_error_queue);
 }
 
-static void tun_cleanup_tx_ring(struct tun_file *tfile)
-{
-        if (tfile->tx_ring.queue) {
-                ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free);
-                xdp_rxq_info_unreg(&tfile->xdp_rxq);
-                memset(&tfile->tx_ring, 0, sizeof(tfile->tx_ring));
-        }
-}
-
 static void __tun_detach(struct tun_file *tfile, bool clean)
 {
         struct tun_file *ntfile;
@@ -736,7 +727,9 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
                             tun->dev->reg_state == NETREG_REGISTERED)
                                 unregister_netdevice(tun->dev);
                 }
-                tun_cleanup_tx_ring(tfile);
+                if (tun)
+                        xdp_rxq_info_unreg(&tfile->xdp_rxq);
+                ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free);
                 sock_put(&tfile->sk);
         }
 }
@@ -783,14 +776,14 @@ static void tun_detach_all(struct net_device *dev)
                 tun_napi_del(tun, tfile);
                 /* Drop read queue */
                 tun_queue_purge(tfile);
+                xdp_rxq_info_unreg(&tfile->xdp_rxq);
                 sock_put(&tfile->sk);
-                tun_cleanup_tx_ring(tfile);
         }
         list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
                 tun_enable_queue(tfile);
                 tun_queue_purge(tfile);
+                xdp_rxq_info_unreg(&tfile->xdp_rxq);
                 sock_put(&tfile->sk);
-                tun_cleanup_tx_ring(tfile);
         }
         BUG_ON(tun->numdisabled != 0);
 
@@ -834,7 +827,8 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
         }
 
         if (!tfile->detached &&
-            ptr_ring_init(&tfile->tx_ring, dev->tx_queue_len, GFP_KERNEL)) {
+            ptr_ring_resize(&tfile->tx_ring, dev->tx_queue_len,
+                            GFP_KERNEL, tun_ptr_free)) {
                 err = -ENOMEM;
                 goto out;
         }
@@ -1429,6 +1423,13 @@ static void tun_net_init(struct net_device *dev)
         dev->max_mtu = MAX_MTU - dev->hard_header_len;
 }
 
+static bool tun_sock_writeable(struct tun_struct *tun, struct tun_file *tfile)
+{
+        struct sock *sk = tfile->socket.sk;
+
+        return (tun->dev->flags & IFF_UP) && sock_writeable(sk);
+}
+
 /* Character device part */
 
 /* Poll */
@@ -1451,10 +1452,14 @@ static __poll_t tun_chr_poll(struct file *file, poll_table *wait)
         if (!ptr_ring_empty(&tfile->tx_ring))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
-        if (tun->dev->flags & IFF_UP &&
-            (sock_writeable(sk) ||
-             (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
-              sock_writeable(sk))))
+        /* Make sure SOCKWQ_ASYNC_NOSPACE is set if not writable to
+         * guarantee EPOLLOUT to be raised by either here or
+         * tun_sock_write_space(). Then process could get notification
+         * after it writes to a down device and meets -EIO.
+         */
+        if (tun_sock_writeable(tun, tfile) ||
+            (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
+             tun_sock_writeable(tun, tfile)))
                 mask |= EPOLLOUT | EPOLLWRNORM;
 
         if (tun->dev->reg_state != NETREG_REGISTERED)
@@ -3219,6 +3224,11 @@ static int tun_chr_open(struct inode *inode, struct file * file)
                                             &tun_proto, 0);
         if (!tfile)
                 return -ENOMEM;
+        if (ptr_ring_init(&tfile->tx_ring, 0, GFP_KERNEL)) {
+                sk_free(&tfile->sk);
+                return -ENOMEM;
+        }
+
         RCU_INIT_POINTER(tfile->tun, NULL);
         tfile->flags = 0;
         tfile->ifindex = 0;
@@ -3239,8 +3249,6 @@ static int tun_chr_open(struct inode *inode, struct file * file)
 
         sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);
 
-        memset(&tfile->tx_ring, 0, sizeof(tfile->tx_ring));
-
         return 0;
 }
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 770422e953f7..032e1ac10a30 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -707,6 +707,13 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                 void *data;
                 u32 act;
 
+                /* Transient failure which in theory could occur if
+                 * in-flight packets from before XDP was enabled reach
+                 * the receive path after XDP is loaded.
+                 */
+                if (unlikely(hdr->hdr.gso_type))
+                        goto err_xdp;
+
                 /* This happens when rx buffer size is underestimated
                  * or headroom is not enough because of the buffer
                  * was refilled before XDP is set. This should only
@@ -727,14 +734,6 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                         xdp_page = page;
                 }
 
-                /* Transient failure which in theory could occur if
-                 * in-flight packets from before XDP was enabled reach
-                 * the receive path after XDP is loaded. In practice I
-                 * was not able to create this condition.
-                 */
-                if (unlikely(hdr->hdr.gso_type))
-                        goto err_xdp;
-
                 /* Allow consuming headroom but reserve enough space to push
                  * the descriptor on if we get an XDP_TX return code.
                  */
@@ -775,7 +774,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                         }
                         *xdp_xmit = true;
                         if (unlikely(xdp_page != page))
-                                goto err_xdp;
+                                put_page(page);
                         rcu_read_unlock();
                         goto xdp_xmit;
                 case XDP_REDIRECT:
@@ -787,7 +786,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                         }
                         *xdp_xmit = true;
                         if (unlikely(xdp_page != page))
-                                goto err_xdp;
+                                put_page(page);
                         rcu_read_unlock();
                         goto xdp_xmit;
                 default:
@@ -875,7 +874,7 @@ err_xdp:
         rcu_read_unlock();
 err_skb:
         put_page(page);
-        while (--num_buf) {
+        while (num_buf-- > 1) {
                 buf = virtqueue_get_buf(rq->vq, &len);
                 if (unlikely(!buf)) {
                         pr_debug("%s: rx error: %d buffers missing\n",
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 9ebe2a689966..27a9bb8c9611 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -369,6 +369,11 @@ vmxnet3_tq_tx_complete(struct vmxnet3_tx_queue *tq,
 
         gdesc = tq->comp_ring.base + tq->comp_ring.next2proc;
         while (VMXNET3_TCD_GET_GEN(&gdesc->tcd) == tq->comp_ring.gen) {
+                /* Prevent any &gdesc->tcd field from being (speculatively)
+                 * read before (&gdesc->tcd)->gen is read.
+                 */
+                dma_rmb();
+
                 completed += vmxnet3_unmap_pkt(VMXNET3_TCD_GET_TXIDX(
                                                &gdesc->tcd), tq, adapter->pdev,
                                                adapter);
@@ -1103,6 +1108,11 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                 gdesc->txd.tci = skb_vlan_tag_get(skb);
         }
 
+        /* Ensure that the write to (&gdesc->txd)->gen will be observed after
+         * all other writes to &gdesc->txd.
+         */
+        dma_wmb();
+
         /* finally flips the GEN bit of the SOP desc. */
         gdesc->dword[2] = cpu_to_le32(le32_to_cpu(gdesc->dword[2]) ^
                                                   VMXNET3_TXD_GEN);
@@ -1298,6 +1308,12 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                          */
                         break;
                 }
+
+                /* Prevent any rcd field from being (speculatively) read before
+                 * rcd->gen is read.
+                 */
+                dma_rmb();
+
                 BUG_ON(rcd->rqID != rq->qid && rcd->rqID != rq->qid2 &&
                        rcd->rqID != rq->dataRingQid);
                 idx = rcd->rxdIdx;
@@ -1528,6 +1544,12 @@ rcd_done:
                 ring->next2comp = idx;
                 num_to_alloc = vmxnet3_cmd_ring_desc_avail(ring);
                 ring = rq->rx_ring + ring_idx;
+
+                /* Ensure that the writes to rxd->gen bits will be observed
+                 * after all other writes to rxd objects.
+                 */
+                dma_wmb();
+
                 while (num_to_alloc) {
                         vmxnet3_getRxDesc(rxd, &ring->base[ring->next2fill].rxd,
                                           &rxCmdDesc);
@@ -2688,7 +2710,7 @@ vmxnet3_set_mac_addr(struct net_device *netdev, void *p)
 /* ==================== initialization and cleanup routines ============ */
 
 static int
-vmxnet3_alloc_pci_resources(struct vmxnet3_adapter *adapter, bool *dma64)
+vmxnet3_alloc_pci_resources(struct vmxnet3_adapter *adapter)
 {
         int err;
         unsigned long mmio_start, mmio_len;
@@ -2700,30 +2722,12 @@ vmxnet3_alloc_pci_resources(struct vmxnet3_adapter *adapter, bool *dma64)
                 return err;
         }
 
-        if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) {
-                if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) {
-                        dev_err(&pdev->dev,
-                                "pci_set_consistent_dma_mask failed\n");
-                        err = -EIO;
-                        goto err_set_mask;
-                }
-                *dma64 = true;
-        } else {
-                if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0) {
-                        dev_err(&pdev->dev,
-                                "pci_set_dma_mask failed\n");
-                        err = -EIO;
-                        goto err_set_mask;
-                }
-                *dma64 = false;
-        }
-
         err = pci_request_selected_regions(pdev, (1 << 2) - 1,
                                            vmxnet3_driver_name);
         if (err) {
                 dev_err(&pdev->dev,
                         "Failed to request region for adapter: error %d\n", err);
-                goto err_set_mask;
+                goto err_enable_device;
         }
 
         pci_set_master(pdev);
@@ -2751,7 +2755,7 @@ err_bar1:
         iounmap(adapter->hw_addr0);
 err_ioremap:
         pci_release_selected_regions(pdev, (1 << 2) - 1);
-err_set_mask:
+err_enable_device:
         pci_disable_device(pdev);
         return err;
 }
@@ -3254,7 +3258,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
 #endif
         };
         int err;
-        bool dma64 = false; /* stupid gcc */
+        bool dma64;
         u32 ver;
         struct net_device *netdev;
         struct vmxnet3_adapter *adapter;
@@ -3300,6 +3304,24 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         adapter->rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
         adapter->rx_ring2_size = VMXNET3_DEF_RX_RING2_SIZE;
 
+        if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) {
+                if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) {
+                        dev_err(&pdev->dev,
+                                "pci_set_consistent_dma_mask failed\n");
+                        err = -EIO;
+                        goto err_set_mask;
+                }
+                dma64 = true;
+        } else {
+                if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0) {
+                        dev_err(&pdev->dev,
+                                "pci_set_dma_mask failed\n");
+                        err = -EIO;
+                        goto err_set_mask;
+                }
+                dma64 = false;
+        }
+
         spin_lock_init(&adapter->cmd_lock);
         adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
                                              sizeof(struct vmxnet3_adapter),
@@ -3307,7 +3329,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         if (dma_mapping_error(&adapter->pdev->dev, adapter->adapter_pa)) {
                 dev_err(&pdev->dev, "Failed to map dma\n");
                 err = -EFAULT;
-                goto err_dma_map;
+                goto err_set_mask;
         }
         adapter->shared = dma_alloc_coherent(
                                 &adapter->pdev->dev,
@@ -3358,7 +3380,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         }
 #endif /* VMXNET3_RSS */
 
-        err = vmxnet3_alloc_pci_resources(adapter, &dma64);
+        err = vmxnet3_alloc_pci_resources(adapter);
         if (err < 0)
                 goto err_alloc_pci;
 
@@ -3504,7 +3526,7 @@ err_alloc_queue_desc:
 err_alloc_shared:
         dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa,
                          sizeof(struct vmxnet3_adapter), PCI_DMA_TODEVICE);
-err_dma_map:
+err_set_mask:
         free_netdev(netdev);
         return err;
 }
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index a3326463b71f..a2c554f8a61b 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,12 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.14.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.16.0-k"
 
-/* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040e00
+/* Each byte of this 32-bit integer encodes a version number in
+ * VMXNET3_DRIVER_VERSION_STRING.
+ */
+#define VMXNET3_DRIVER_VERSION_NUM      0x01041000
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 4a017a0d71ea..920c23e542a5 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -3340,7 +3340,7 @@ out_err:
 static int hwsim_dump_radio_nl(struct sk_buff *skb,
                                struct netlink_callback *cb)
 {
-        int last_idx = cb->args[0];
+        int last_idx = cb->args[0] - 1;
         struct mac80211_hwsim_data *data = NULL;
         int res = 0;
         void *hdr;
@@ -3368,7 +3368,7 @@ static int hwsim_dump_radio_nl(struct sk_buff *skb,
                 last_idx = data->idx;
         }
 
-        cb->args[0] = last_idx;
+        cb->args[0] = last_idx + 1;
 
         /* list changed, but no new element sent, set interrupted flag */
         if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index 88a8b5916624..dbb7464c018c 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -27,7 +27,7 @@ config NVME_FABRICS
 
 config NVME_RDMA
         tristate "NVM Express over Fabrics RDMA host driver"
-        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && BLOCK
+        depends on INFINIBAND_ADDR_TRANS && BLOCK
         select NVME_CORE
         select NVME_FABRICS
         select SG_POOL
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 99b857e5a7a9..b9ca782fe82d 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1447,8 +1447,8 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
         if (ns->lba_shift == 0)
                 ns->lba_shift = 9;
         ns->noiob = le16_to_cpu(id->noiob);
-        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
         ns->ms = le16_to_cpu(id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ms);
+        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
         /* the PI implementation requires metadata equal t10 pi tuple size */
         if (ns->ms == sizeof(struct t10_pi_tuple))
                 ns->pi_type = id->dps & NVME_NS_DPS_PI_MASK;
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index 3c7b61ddb0d1..7595664ee753 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -27,7 +27,7 @@ config NVME_TARGET_LOOP
 
 config NVME_TARGET_RDMA
         tristate "NVMe over Fabrics RDMA target support"
-        depends on INFINIBAND && INFINIBAND_ADDR_TRANS
+        depends on INFINIBAND_ADDR_TRANS
         depends on NVME_TARGET
         select SGL_ALLOC
         help
diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index 92fa94a6dcc1..ab2f3fead6b1 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -33,8 +33,6 @@ LIST_HEAD(opp_tables);
 /* Lock to allow exclusive modification to the device and opp lists */
 DEFINE_MUTEX(opp_table_lock);
 
-static void dev_pm_opp_get(struct dev_pm_opp *opp);
-
 static struct opp_device *_find_opp_dev(const struct device *dev,
                                         struct opp_table *opp_table)
 {
@@ -281,6 +279,23 @@ unsigned long dev_pm_opp_get_suspend_opp_freq(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_get_suspend_opp_freq);
 
+int _get_opp_count(struct opp_table *opp_table)
+{
+        struct dev_pm_opp *opp;
+        int count = 0;
+
+        mutex_lock(&opp_table->lock);
+
+        list_for_each_entry(opp, &opp_table->opp_list, node) {
+                if (opp->available)
+                        count++;
+        }
+
+        mutex_unlock(&opp_table->lock);
+
+        return count;
+}
+
 /**
  * dev_pm_opp_get_opp_count() - Get number of opps available in the opp table
  * @dev:        device for which we do this operation
@@ -291,25 +306,17 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_get_suspend_opp_freq);
 int dev_pm_opp_get_opp_count(struct device *dev)
 {
         struct opp_table *opp_table;
-        struct dev_pm_opp *temp_opp;
-        int count = 0;
+        int count;
 
         opp_table = _find_opp_table(dev);
         if (IS_ERR(opp_table)) {
                 count = PTR_ERR(opp_table);
                 dev_dbg(dev, "%s: OPP table not found (%d)\n",
                         __func__, count);
-                return count;
-        }
-
-        mutex_lock(&opp_table->lock);
-
-        list_for_each_entry(temp_opp, &opp_table->opp_list, node) {
-                if (temp_opp->available)
-                        count++;
+                return 0;
         }
 
-        mutex_unlock(&opp_table->lock);
+        count = _get_opp_count(opp_table);
         dev_pm_opp_put_opp_table(opp_table);
 
         return count;
@@ -892,7 +899,7 @@ static void _opp_kref_release(struct kref *kref)
         dev_pm_opp_put_opp_table(opp_table);
 }
 
-static void dev_pm_opp_get(struct dev_pm_opp *opp)
+void dev_pm_opp_get(struct dev_pm_opp *opp)
 {
         kref_get(&opp->kref);
 }
@@ -985,22 +992,11 @@ static bool _opp_supported_by_regulators(struct dev_pm_opp *opp,
         return true;
 }
 
-/*
- * Returns:
- * 0: On success. And appropriate error message for duplicate OPPs.
- * -EBUSY: For OPP with same freq/volt and is available. The callers of
- *  _opp_add() must return 0 if they receive -EBUSY from it. This is to make
- *  sure we don't print error messages unnecessarily if different parts of
- *  kernel try to initialize the OPP table.
- * -EEXIST: For OPP with same freq but different volt or is unavailable. This
- *  should be considered an error by the callers of _opp_add().
- */
-int _opp_add(struct device *dev, struct dev_pm_opp *new_opp,
-             struct opp_table *opp_table)
+static int _opp_is_duplicate(struct device *dev, struct dev_pm_opp *new_opp,
+                             struct opp_table *opp_table,
+                             struct list_head **head)
 {
         struct dev_pm_opp *opp;
-        struct list_head *head;
-        int ret;
 
         /*
          * Insert new OPP in order of increasing frequency and discard if
@@ -1010,17 +1006,14 @@ int _opp_add(struct device *dev, struct dev_pm_opp *new_opp,
          * loop, don't replace it with head otherwise it will become an infinite
          * loop.
          */
-        mutex_lock(&opp_table->lock);
-        head = &opp_table->opp_list;
-
         list_for_each_entry(opp, &opp_table->opp_list, node) {
                 if (new_opp->rate > opp->rate) {
-                        head = &opp->node;
+                        *head = &opp->node;
                         continue;
                 }
 
                 if (new_opp->rate < opp->rate)
-                        break;
+                        return 0;
 
                 /* Duplicate OPPs */
                 dev_warn(dev, "%s: duplicate OPPs detected. Existing: freq: %lu, volt: %lu, enabled: %d. New: freq: %lu, volt: %lu, enabled: %d\n",
@@ -1029,15 +1022,39 @@ int _opp_add(struct device *dev, struct dev_pm_opp *new_opp,
                          new_opp->supplies[0].u_volt, new_opp->available);
 
                 /* Should we compare voltages for all regulators here ? */
-                ret = opp->available &&
-                      new_opp->supplies[0].u_volt == opp->supplies[0].u_volt ? -EBUSY : -EEXIST;
-
-                mutex_unlock(&opp_table->lock);
-                return ret;
+                return opp->available &&
+                       new_opp->supplies[0].u_volt == opp->supplies[0].u_volt ? -EBUSY : -EEXIST;
         }
 
-        if (opp_table->get_pstate)
-                new_opp->pstate = opp_table->get_pstate(dev, new_opp->rate);
+        return 0;
+}
+
+/*
+ * Returns:
+ * 0: On success. And appropriate error message for duplicate OPPs.
+ * -EBUSY: For OPP with same freq/volt and is available. The callers of
+ *  _opp_add() must return 0 if they receive -EBUSY from it. This is to make
+ *  sure we don't print error messages unnecessarily if different parts of
+ *  kernel try to initialize the OPP table.
+ * -EEXIST: For OPP with same freq but different volt or is unavailable. This
+ *  should be considered an error by the callers of _opp_add().
+ */
+int _opp_add(struct device *dev, struct dev_pm_opp *new_opp,
+             struct opp_table *opp_table, bool rate_not_available)
+{
+        struct list_head *head;
+        int ret;
+
+        mutex_lock(&opp_table->lock);
+        head = &opp_table->opp_list;
+
+        if (likely(!rate_not_available)) {
+                ret = _opp_is_duplicate(dev, new_opp, opp_table, &head);
+                if (ret) {
+                        mutex_unlock(&opp_table->lock);
+                        return ret;
+                }
+        }
 
         list_add(&new_opp->node, head);
         mutex_unlock(&opp_table->lock);
@@ -1104,7 +1121,7 @@ int _opp_add_v1(struct opp_table *opp_table, struct device *dev,
         new_opp->available = true;
         new_opp->dynamic = dynamic;
 
-        ret = _opp_add(dev, new_opp, opp_table);
+        ret = _opp_add(dev, new_opp, opp_table, false);
         if (ret) {
                 /* Don't return error for duplicate OPPs */
                 if (ret == -EBUSY)
@@ -1140,7 +1157,6 @@ struct opp_table *dev_pm_opp_set_supported_hw(struct device *dev,
                         const u32 *versions, unsigned int count)
 {
         struct opp_table *opp_table;
-        int ret;
 
         opp_table = dev_pm_opp_get_opp_table(dev);
         if (!opp_table)
@@ -1149,29 +1165,20 @@ struct opp_table *dev_pm_opp_set_supported_hw(struct device *dev,
         /* Make sure there are no concurrent readers while updating opp_table */
         WARN_ON(!list_empty(&opp_table->opp_list));
 
-        /* Do we already have a version hierarchy associated with opp_table? */
-        if (opp_table->supported_hw) {
-                dev_err(dev, "%s: Already have supported hardware list\n",
-                        __func__);
-                ret = -EBUSY;
-                goto err;
-        }
+        /* Another CPU that shares the OPP table has set the property ? */
+        if (opp_table->supported_hw)
+                return opp_table;
 
         opp_table->supported_hw = kmemdup(versions, count * sizeof(*versions),
                                         GFP_KERNEL);
         if (!opp_table->supported_hw) {
-                ret = -ENOMEM;
-                goto err;
+                dev_pm_opp_put_opp_table(opp_table);
+                return ERR_PTR(-ENOMEM);
         }
 
         opp_table->supported_hw_count = count;
 
         return opp_table;
-
-err:
-        dev_pm_opp_put_opp_table(opp_table);
-
-        return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_set_supported_hw);
 
@@ -1188,12 +1195,6 @@ void dev_pm_opp_put_supported_hw(struct opp_table *opp_table)
         /* Make sure there are no concurrent readers while updating opp_table */
         WARN_ON(!list_empty(&opp_table->opp_list));
 
-        if (!opp_table->supported_hw) {
-                pr_err("%s: Doesn't have supported hardware list\n",
-                       __func__);
-                return;
-        }
-
         kfree(opp_table->supported_hw);
         opp_table->supported_hw = NULL;
         opp_table->supported_hw_count = 0;
@@ -1215,7 +1216,6 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_put_supported_hw);
 struct opp_table *dev_pm_opp_set_prop_name(struct device *dev, const char *name)
 {
         struct opp_table *opp_table;
-        int ret;
 
         opp_table = dev_pm_opp_get_opp_table(dev);
         if (!opp_table)
@@ -1224,26 +1224,17 @@ struct opp_table *dev_pm_opp_set_prop_name(struct device *dev, const char *name)
         /* Make sure there are no concurrent readers while updating opp_table */
         WARN_ON(!list_empty(&opp_table->opp_list));
 
-        /* Do we already have a prop-name associated with opp_table? */
-        if (opp_table->prop_name) {
-                dev_err(dev, "%s: Already have prop-name %s\n", __func__,
-                        opp_table->prop_name);
-                ret = -EBUSY;
-                goto err;
-        }
+        /* Another CPU that shares the OPP table has set the property ? */
+        if (opp_table->prop_name)
+                return opp_table;
 
         opp_table->prop_name = kstrdup(name, GFP_KERNEL);
         if (!opp_table->prop_name) {
-                ret = -ENOMEM;
-                goto err;
+                dev_pm_opp_put_opp_table(opp_table);
+                return ERR_PTR(-ENOMEM);
         }
 
         return opp_table;
-
-err:
-        dev_pm_opp_put_opp_table(opp_table);
-
-        return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_set_prop_name);
 
@@ -1260,11 +1251,6 @@ void dev_pm_opp_put_prop_name(struct opp_table *opp_table)
         /* Make sure there are no concurrent readers while updating opp_table */
         WARN_ON(!list_empty(&opp_table->opp_list));
 
-        if (!opp_table->prop_name) {
-                pr_err("%s: Doesn't have a prop-name\n", __func__);
-                return;
-        }
-
         kfree(opp_table->prop_name);
         opp_table->prop_name = NULL;
 
@@ -1334,11 +1320,9 @@ struct opp_table *dev_pm_opp_set_regulators(struct device *dev,
                 goto err;
         }
 
-        /* Already have regulators set */
-        if (opp_table->regulators) {
-                ret = -EBUSY;
-                goto err;
-        }
+        /* Another CPU that shares the OPP table has set the regulators ? */
+        if (opp_table->regulators)
+                return opp_table;
 
         opp_table->regulators = kmalloc_array(count,
                                               sizeof(*opp_table->regulators),
@@ -1392,10 +1376,8 @@ void dev_pm_opp_put_regulators(struct opp_table *opp_table)
 {
         int i;
 
-        if (!opp_table->regulators) {
-                pr_err("%s: Doesn't have regulators set\n", __func__);
-                return;
-        }
+        if (!opp_table->regulators)
+                goto put_opp_table;
 
         /* Make sure there are no concurrent readers while updating opp_table */
         WARN_ON(!list_empty(&opp_table->opp_list));
@@ -1409,6 +1391,7 @@ void dev_pm_opp_put_regulators(struct opp_table *opp_table)
         opp_table->regulators = NULL;
         opp_table->regulator_count = 0;
 
+put_opp_table:
         dev_pm_opp_put_opp_table(opp_table);
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_put_regulators);
@@ -1494,7 +1477,6 @@ struct opp_table *dev_pm_opp_register_set_opp_helper(struct device *dev,
                         int (*set_opp)(struct dev_pm_set_opp_data *data))
 {
         struct opp_table *opp_table;
-        int ret;
 
         if (!set_opp)
                 return ERR_PTR(-EINVAL);
@@ -1505,24 +1487,15 @@ struct opp_table *dev_pm_opp_register_set_opp_helper(struct device *dev,
 
         /* This should be called before OPPs are initialized */
         if (WARN_ON(!list_empty(&opp_table->opp_list))) {
-                ret = -EBUSY;
-                goto err;
-        }
-
-        /* Already have custom set_opp helper */
-        if (WARN_ON(opp_table->set_opp)) {
-                ret = -EBUSY;
-                goto err;
+                dev_pm_opp_put_opp_table(opp_table);
+                return ERR_PTR(-EBUSY);
         }
 
-        opp_table->set_opp = set_opp;
+        /* Another CPU that shares the OPP table has set the helper ? */
+        if (!opp_table->set_opp)
+                opp_table->set_opp = set_opp;
 
         return opp_table;
-
-err:
-        dev_pm_opp_put_opp_table(opp_table);
-
-        return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_register_set_opp_helper);
 
@@ -1535,97 +1508,15 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_register_set_opp_helper);
  */
 void dev_pm_opp_unregister_set_opp_helper(struct opp_table *opp_table)
 {
-        if (!opp_table->set_opp) {
-                pr_err("%s: Doesn't have custom set_opp helper set\n",
-                       __func__);
-                return;
-        }
-
         /* Make sure there are no concurrent readers while updating opp_table */
         WARN_ON(!list_empty(&opp_table->opp_list));
 
         opp_table->set_opp = NULL;
-
         dev_pm_opp_put_opp_table(opp_table);
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_unregister_set_opp_helper);
 
 /**
- * dev_pm_opp_register_get_pstate_helper() - Register get_pstate() helper.
- * @dev: Device for which the helper is getting registered.
- * @get_pstate: Helper.
- *
- * TODO: Remove this callback after the same information is available via Device
- * Tree.
- *
- * This allows a platform to initialize the performance states of individual
- * OPPs for its devices, until we get similar information directly from DT.
- *
- * This must be called before the OPPs are initialized for the device.
- */
-struct opp_table *dev_pm_opp_register_get_pstate_helper(struct device *dev,
-                int (*get_pstate)(struct device *dev, unsigned long rate))
-{
-        struct opp_table *opp_table;
-        int ret;
-
-        if (!get_pstate)
-                return ERR_PTR(-EINVAL);
-
-        opp_table = dev_pm_opp_get_opp_table(dev);
-        if (!opp_table)
-                return ERR_PTR(-ENOMEM);
-
-        /* This should be called before OPPs are initialized */
-        if (WARN_ON(!list_empty(&opp_table->opp_list))) {
-                ret = -EBUSY;
-                goto err;
-        }
-
-        /* Already have genpd_performance_state set */
-        if (WARN_ON(opp_table->genpd_performance_state)) {
-                ret = -EBUSY;
-                goto err;
-        }
-
-        opp_table->genpd_performance_state = true;
-        opp_table->get_pstate = get_pstate;
-
-        return opp_table;
-
-err:
-        dev_pm_opp_put_opp_table(opp_table);
-
-        return ERR_PTR(ret);
-}
-EXPORT_SYMBOL_GPL(dev_pm_opp_register_get_pstate_helper);
-
-/**
- * dev_pm_opp_unregister_get_pstate_helper() - Releases resources blocked for
- *                                         get_pstate() helper
- * @opp_table: OPP table returned from dev_pm_opp_register_get_pstate_helper().
- *
- * Release resources blocked for platform specific get_pstate() helper.
- */
-void dev_pm_opp_unregister_get_pstate_helper(struct opp_table *opp_table)
-{
-        if (!opp_table->genpd_performance_state) {
-                pr_err("%s: Doesn't have performance states set\n",
-                       __func__);
-                return;
-        }
-
-        /* Make sure there are no concurrent readers while updating opp_table */
-        WARN_ON(!list_empty(&opp_table->opp_list));
-
-        opp_table->genpd_performance_state = false;
-        opp_table->get_pstate = NULL;
-
-        dev_pm_opp_put_opp_table(opp_table);
-}
-EXPORT_SYMBOL_GPL(dev_pm_opp_unregister_get_pstate_helper);
-
-/**
  * dev_pm_opp_add()  - Add an OPP table from a table definitions
  * @dev:        device for which we do this operation
  * @freq:       Frequency in Hz for this OPP
diff --git a/drivers/opp/debugfs.c b/drivers/opp/debugfs.c
index b03c03576a62..e6828e5f81b0 100644
--- a/drivers/opp/debugfs.c
+++ b/drivers/opp/debugfs.c
@@ -77,10 +77,21 @@ int opp_debug_create_one(struct dev_pm_opp *opp, struct opp_table *opp_table)
 {
         struct dentry *pdentry = opp_table->dentry;
         struct dentry *d;
+        unsigned long id;
         char name[25];  /* 20 chars for 64 bit value + 5 (opp:\0) */
 
-        /* Rate is unique to each OPP, use it to give opp-name */
-        snprintf(name, sizeof(name), "opp:%lu", opp->rate);
+        /*
+         * Get directory name for OPP.
+         *
+         * - Normally rate is unique to each OPP, use it to get unique opp-name.
+         * - For some devices rate isn't available, use index instead.
+         */
+        if (likely(opp->rate))
+                id = opp->rate;
+        else
+                id = _get_opp_count(opp_table);
+
+        snprintf(name, sizeof(name), "opp:%lu", id);
 
         /* Create per-opp directory */
         d = debugfs_create_dir(name, pdentry);
diff --git a/drivers/opp/of.c b/drivers/opp/of.c
index cb716aa2f44b..7af0ddec936b 100644
--- a/drivers/opp/of.c
+++ b/drivers/opp/of.c
@@ -17,6 +17,7 @@
 #include <linux/errno.h>
 #include <linux/device.h>
 #include <linux/of_device.h>
+#include <linux/pm_domain.h>
 #include <linux/slab.h>
 #include <linux/export.h>
 
@@ -250,20 +251,17 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_of_remove_table);
 
 /* Returns opp descriptor node for a device node, caller must
  * do of_node_put() */
-static struct device_node *_opp_of_get_opp_desc_node(struct device_node *np)
+static struct device_node *_opp_of_get_opp_desc_node(struct device_node *np,
+                                                     int index)
 {
-        /*
-         * There should be only ONE phandle present in "operating-points-v2"
-         * property.
-         */
-
-        return of_parse_phandle(np, "operating-points-v2", 0);
+        /* "operating-points-v2" can be an array for power domain providers */
+        return of_parse_phandle(np, "operating-points-v2", index);
 }
 
 /* Returns opp descriptor node for a device, caller must do of_node_put() */
 struct device_node *dev_pm_opp_of_get_opp_desc_node(struct device *dev)
 {
-        return _opp_of_get_opp_desc_node(dev->of_node);
+        return _opp_of_get_opp_desc_node(dev->of_node, 0);
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_of_get_opp_desc_node);
 
@@ -289,9 +287,10 @@ static int _opp_add_static_v2(struct opp_table *opp_table, struct device *dev,
                               struct device_node *np)
 {
         struct dev_pm_opp *new_opp;
-        u64 rate;
+        u64 rate = 0;
         u32 val;
         int ret;
+        bool rate_not_available = false;
 
         new_opp = _opp_allocate(opp_table);
         if (!new_opp)
@@ -299,8 +298,21 @@ static int _opp_add_static_v2(struct opp_table *opp_table, struct device *dev,
 
         ret = of_property_read_u64(np, "opp-hz", &rate);
         if (ret < 0) {
-                dev_err(dev, "%s: opp-hz not found\n", __func__);
-                goto free_opp;
+                /* "opp-hz" is optional for devices like power domains. */
+                if (!of_find_property(dev->of_node, "#power-domain-cells",
+                                      NULL)) {
+                        dev_err(dev, "%s: opp-hz not found\n", __func__);
+                        goto free_opp;
+                }
+
+                rate_not_available = true;
+        } else {
+                /*
+                 * Rate is defined as an unsigned long in clk API, and so
+                 * casting explicitly to its type. Must be fixed once rate is 64
+                 * bit guaranteed in clk API.
+                 */
+                new_opp->rate = (unsigned long)rate;
         }
 
         /* Check if the OPP supports hardware's hierarchy of versions or not */
@@ -309,12 +321,6 @@ static int _opp_add_static_v2(struct opp_table *opp_table, struct device *dev,
                 goto free_opp;
         }
 
-        /*
-         * Rate is defined as an unsigned long in clk API, and so casting
-         * explicitly to its type. Must be fixed once rate is 64 bit
-         * guaranteed in clk API.
-         */
-        new_opp->rate = (unsigned long)rate;
         new_opp->turbo = of_property_read_bool(np, "turbo-mode");
 
         new_opp->np = np;
@@ -324,11 +330,13 @@ static int _opp_add_static_v2(struct opp_table *opp_table, struct device *dev,
         if (!of_property_read_u32(np, "clock-latency-ns", &val))
                 new_opp->clock_latency_ns = val;
 
+        new_opp->pstate = of_genpd_opp_to_performance_state(dev, np);
+
         ret = opp_parse_supplies(new_opp, dev, opp_table);
         if (ret)
                 goto free_opp;
 
-        ret = _opp_add(dev, new_opp, opp_table);
+        ret = _opp_add(dev, new_opp, opp_table, rate_not_available);
         if (ret) {
                 /* Don't return error for duplicate OPPs */
                 if (ret == -EBUSY)
@@ -374,7 +382,8 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np)
 {
         struct device_node *np;
         struct opp_table *opp_table;
-        int ret = 0, count = 0;
+        int ret = 0, count = 0, pstate_count = 0;
+        struct dev_pm_opp *opp;
 
         opp_table = _managed_opp(opp_np);
         if (opp_table) {
@@ -408,6 +417,20 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np)
                 goto put_opp_table;
         }
 
+        list_for_each_entry(opp, &opp_table->opp_list, node)
+                pstate_count += !!opp->pstate;
+
+        /* Either all or none of the nodes shall have performance state set */
+        if (pstate_count && pstate_count != count) {
+                dev_err(dev, "Not all nodes have performance state set (%d: %d)\n",
+                        count, pstate_count);
+                ret = -ENOENT;
+                goto put_opp_table;
+        }
+
+        if (pstate_count)
+                opp_table->genpd_performance_state = true;
+
         opp_table->np = opp_np;
         if (of_property_read_bool(opp_np, "opp-shared"))
                 opp_table->shared_opp = OPP_TABLE_ACCESS_SHARED;
@@ -509,6 +532,54 @@ int dev_pm_opp_of_add_table(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_of_add_table);
 
+/**
+ * dev_pm_opp_of_add_table_indexed() - Initialize indexed opp table from device tree
+ * @dev:        device pointer used to lookup OPP table.
+ * @index:      Index number.
+ *
+ * Register the initial OPP table with the OPP library for given device only
+ * using the "operating-points-v2" property.
+ *
+ * Return:
+ * 0            On success OR
+ *              Duplicate OPPs (both freq and volt are same) and opp->available
+ * -EEXIST      Freq are same and volt are different OR
+ *              Duplicate OPPs (both freq and volt are same) and !opp->available
+ * -ENOMEM      Memory allocation failure
+ * -ENODEV      when 'operating-points' property is not found or is invalid data
+ *              in device node.
+ * -ENODATA     when empty 'operating-points' property is found
+ * -EINVAL      when invalid entries are found in opp-v2 table
+ */
+int dev_pm_opp_of_add_table_indexed(struct device *dev, int index)
+{
+        struct device_node *opp_np;
+        int ret, count;
+
+again:
+        opp_np = _opp_of_get_opp_desc_node(dev->of_node, index);
+        if (!opp_np) {
+                /*
+                 * If only one phandle is present, then the same OPP table
+                 * applies for all index requests.
+                 */
+                count = of_count_phandle_with_args(dev->of_node,
+                                                   "operating-points-v2", NULL);
+                if (count == 1 && index) {
+                        index = 0;
+                        goto again;
+                }
+
+                return -ENODEV;
+        }
+
+        ret = _of_add_opp_table_v2(dev, opp_np);
+        of_node_put(opp_np);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dev_pm_opp_of_add_table_indexed);
+
 /* CPU device specific helpers */
 
 /**
@@ -613,7 +684,7 @@ int dev_pm_opp_of_get_sharing_cpus(struct device *cpu_dev,
                 }
 
                 /* Get OPP descriptor node */
-                tmp_np = _opp_of_get_opp_desc_node(cpu_np);
+                tmp_np = _opp_of_get_opp_desc_node(cpu_np, 0);
                 of_node_put(cpu_np);
                 if (!tmp_np) {
                         pr_err("%pOF: Couldn't find opp node\n", cpu_np);
@@ -633,3 +704,76 @@ put_cpu_node:
         return ret;
 }
 EXPORT_SYMBOL_GPL(dev_pm_opp_of_get_sharing_cpus);
+
+/**
+ * of_dev_pm_opp_find_required_opp() - Search for required OPP.
+ * @dev: The device whose OPP node is referenced by the 'np' DT node.
+ * @np: Node that contains the "required-opps" property.
+ *
+ * Returns the OPP of the device 'dev', whose phandle is present in the "np"
+ * node. Although the "required-opps" property supports having multiple
+ * phandles, this helper routine only parses the very first phandle in the list.
+ *
+ * Return: Matching opp, else returns ERR_PTR in case of error and should be
+ * handled using IS_ERR.
+ *
+ * The callers are required to call dev_pm_opp_put() for the returned OPP after
+ * use.
+ */
+struct dev_pm_opp *of_dev_pm_opp_find_required_opp(struct device *dev,
+                                                   struct device_node *np)
+{
+        struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ENODEV);
+        struct device_node *required_np;
+        struct opp_table *opp_table;
+
+        opp_table = _find_opp_table(dev);
+        if (IS_ERR(opp_table))
+                return ERR_CAST(opp_table);
+
+        required_np = of_parse_phandle(np, "required-opps", 0);
+        if (unlikely(!required_np)) {
+                dev_err(dev, "Unable to parse required-opps\n");
+                goto put_opp_table;
+        }
+
+        mutex_lock(&opp_table->lock);
+
+        list_for_each_entry(temp_opp, &opp_table->opp_list, node) {
+                if (temp_opp->available && temp_opp->np == required_np) {
+                        opp = temp_opp;
+
+                        /* Increment the reference count of OPP */
+                        dev_pm_opp_get(opp);
+                        break;
+                }
+        }
+
+        mutex_unlock(&opp_table->lock);
+
+        of_node_put(required_np);
+put_opp_table:
+        dev_pm_opp_put_opp_table(opp_table);
+
+        return opp;
+}
+EXPORT_SYMBOL_GPL(of_dev_pm_opp_find_required_opp);
+
+/**
+ * dev_pm_opp_get_of_node() - Gets the DT node corresponding to an opp
+ * @opp:        opp for which DT node has to be returned for
+ *
+ * Return: DT node corresponding to the opp, else 0 on success.
+ *
+ * The caller needs to put the node with of_node_put() after using it.
+ */
+struct device_node *dev_pm_opp_get_of_node(struct dev_pm_opp *opp)
+{
+        if (IS_ERR_OR_NULL(opp)) {
+                pr_err("%s: Invalid parameters\n", __func__);
+                return NULL;
+        }
+
+        return of_node_get(opp->np);
+}
+EXPORT_SYMBOL_GPL(dev_pm_opp_get_of_node);
diff --git a/drivers/opp/opp.h b/drivers/opp/opp.h
index 4d00061648a3..7c540fd063b2 100644
--- a/drivers/opp/opp.h
+++ b/drivers/opp/opp.h
@@ -140,7 +140,6 @@ enum opp_table_access {
  * @genpd_performance_state: Device's power domain support performance state.
  * @set_opp: Platform specific set_opp callback
  * @set_opp_data: Data to be passed to set_opp callback
- * @get_pstate: Platform specific get_pstate callback
  * @dentry:     debugfs dentry pointer of the real device directory (not links).
  * @dentry_name: Name of the real dentry.
  *
@@ -178,7 +177,6 @@ struct opp_table {
 
         int (*set_opp)(struct dev_pm_set_opp_data *data);
         struct dev_pm_set_opp_data *set_opp_data;
-        int (*get_pstate)(struct device *dev, unsigned long rate);
 
 #ifdef CONFIG_DEBUG_FS
         struct dentry *dentry;
@@ -187,14 +185,16 @@ struct opp_table {
 };
 
 /* Routines internal to opp core */
+void dev_pm_opp_get(struct dev_pm_opp *opp);
 void _get_opp_table_kref(struct opp_table *opp_table);
+int _get_opp_count(struct opp_table *opp_table);
 struct opp_table *_find_opp_table(struct device *dev);
 struct opp_device *_add_opp_dev(const struct device *dev, struct opp_table *opp_table);
 void _dev_pm_opp_remove_table(struct opp_table *opp_table, struct device *dev, bool remove_all);
 void _dev_pm_opp_find_and_remove_table(struct device *dev, bool remove_all);
 struct dev_pm_opp *_opp_allocate(struct opp_table *opp_table);
 void _opp_free(struct dev_pm_opp *opp);
-int _opp_add(struct device *dev, struct dev_pm_opp *new_opp, struct opp_table *opp_table);
+int _opp_add(struct device *dev, struct dev_pm_opp *new_opp, struct opp_table *opp_table, bool rate_not_available);
 int _opp_add_v1(struct opp_table *opp_table, struct device *dev, unsigned long freq, long u_volt, bool dynamic);
 void _dev_pm_opp_cpumask_remove_table(const struct cpumask *cpumask, bool of);
 struct opp_table *_add_opp_table(struct device *dev);
diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
index 126cf19e869b..297599fcbc32 100644
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -1195,7 +1195,7 @@ void * ccio_get_iommu(const struct parisc_device *dev)
  * to/from certain pages.  To avoid this happening, we mark these pages
  * as `used', and ensure that nothing will try to allocate from them.
  */
-void ccio_cujo20_fixup(struct parisc_device *cujo, u32 iovp)
+void __init ccio_cujo20_fixup(struct parisc_device *cujo, u32 iovp)
 {
         unsigned int idx;
         struct parisc_device *dev = parisc_parent(cujo);
diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
index e7bbdf947bbc..8350ca2311c7 100644
--- a/drivers/platform/chrome/cros_ec_proto.c
+++ b/drivers/platform/chrome/cros_ec_proto.c
@@ -91,6 +91,8 @@ static int send_command(struct cros_ec_device *ec_dev,
                         usleep_range(10000, 11000);
 
                         ret = (*xfer_fxn)(ec_dev, status_msg);
+                        if (ret == -EAGAIN)
+                                continue;
                         if (ret < 0)
                                 break;
 
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index bc309c5327ff..566644bb496a 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -168,8 +168,8 @@ config DELL_WMI
         depends on DMI
         depends on INPUT
         depends on ACPI_VIDEO || ACPI_VIDEO = n
+        depends on DELL_SMBIOS
         select DELL_WMI_DESCRIPTOR
-        select DELL_SMBIOS
         select INPUT_SPARSEKMAP
         ---help---
           Say Y here if you want to support WMI-based hotkeys on Dell laptops.
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index a32c5c00e0e7..ffffb9909ae1 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -163,6 +163,16 @@ MODULE_LICENSE("GPL");
 
 static const char * const ashs_ids[] = { "ATK4001", "ATK4002", NULL };
 
+static bool ashs_present(void)
+{
+        int i = 0;
+        while (ashs_ids[i]) {
+                if (acpi_dev_found(ashs_ids[i++]))
+                        return true;
+        }
+        return false;
+}
+
 struct bios_args {
         u32 arg0;
         u32 arg1;
@@ -1025,6 +1035,9 @@ static int asus_new_rfkill(struct asus_wmi *asus,
 
 static void asus_wmi_rfkill_exit(struct asus_wmi *asus)
 {
+        if (asus->driver->wlan_ctrl_by_user && ashs_present())
+                return;
+
         asus_unregister_rfkill_notifier(asus, "\\_SB.PCI0.P0P5");
         asus_unregister_rfkill_notifier(asus, "\\_SB.PCI0.P0P6");
         asus_unregister_rfkill_notifier(asus, "\\_SB.PCI0.P0P7");
@@ -2121,16 +2134,6 @@ static int asus_wmi_fan_init(struct asus_wmi *asus)
         return 0;
 }
 
-static bool ashs_present(void)
-{
-        int i = 0;
-        while (ashs_ids[i]) {
-                if (acpi_dev_found(ashs_ids[i++]))
-                        return true;
-        }
-        return false;
-}
-
 /*
  * WMI Driver
  */
diff --git a/drivers/reset/reset-uniphier.c b/drivers/reset/reset-uniphier.c
index 360e06b20c53..ac18f2f27881 100644
--- a/drivers/reset/reset-uniphier.c
+++ b/drivers/reset/reset-uniphier.c
@@ -110,7 +110,7 @@ static const struct uniphier_reset_data uniphier_ld20_sys_reset_data[] = {
         UNIPHIER_RESETX(4, 0x200c, 2),          /* eMMC */
         UNIPHIER_RESETX(6, 0x200c, 6),          /* Ether */
         UNIPHIER_RESETX(8, 0x200c, 8),          /* STDMAC (HSC) */
-        UNIPHIER_RESETX(12, 0x200c, 5),         /* GIO (PCIe, USB3) */
+        UNIPHIER_RESETX(14, 0x200c, 5),         /* USB30 */
         UNIPHIER_RESETX(16, 0x200c, 12),        /* USB30-PHY0 */
         UNIPHIER_RESETX(17, 0x200c, 13),        /* USB30-PHY1 */
         UNIPHIER_RESETX(18, 0x200c, 14),        /* USB30-PHY2 */
@@ -127,8 +127,8 @@ static const struct uniphier_reset_data uniphier_pxs3_sys_reset_data[] = {
         UNIPHIER_RESETX(6, 0x200c, 9),          /* Ether0 */
         UNIPHIER_RESETX(7, 0x200c, 10),         /* Ether1 */
         UNIPHIER_RESETX(8, 0x200c, 12),         /* STDMAC */
-        UNIPHIER_RESETX(12, 0x200c, 4),         /* USB30 link (GIO0) */
-        UNIPHIER_RESETX(13, 0x200c, 5),         /* USB31 link (GIO1) */
+        UNIPHIER_RESETX(12, 0x200c, 4),         /* USB30 link */
+        UNIPHIER_RESETX(13, 0x200c, 5),         /* USB31 link */
         UNIPHIER_RESETX(16, 0x200c, 16),        /* USB30-PHY0 */
         UNIPHIER_RESETX(17, 0x200c, 18),        /* USB30-PHY1 */
         UNIPHIER_RESETX(18, 0x200c, 20),        /* USB30-PHY2 */
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 04143c08bd6e..02c03e418c27 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -3034,7 +3034,8 @@ static blk_status_t do_dasd_request(struct blk_mq_hw_ctx *hctx,
         cqr->callback_data = req;
         cqr->status = DASD_CQR_FILLED;
         cqr->dq = dq;
-        req->completion_data = cqr;
+        *((struct dasd_ccw_req **) blk_mq_rq_to_pdu(req)) = cqr;
+
         blk_mq_start_request(req);
         spin_lock(&block->queue_lock);
         list_add_tail(&cqr->blocklist, &block->ccw_queue);
@@ -3058,12 +3059,13 @@ out:
  */
 enum blk_eh_timer_return dasd_times_out(struct request *req, bool reserved)
 {
-        struct dasd_ccw_req *cqr = req->completion_data;
         struct dasd_block *block = req->q->queuedata;
         struct dasd_device *device;
+        struct dasd_ccw_req *cqr;
         unsigned long flags;
         int rc = 0;
 
+        cqr = *((struct dasd_ccw_req **) blk_mq_rq_to_pdu(req));
         if (!cqr)
                 return BLK_EH_NOT_HANDLED;
 
@@ -3169,6 +3171,7 @@ static int dasd_alloc_queue(struct dasd_block *block)
         int rc;
 
         block->tag_set.ops = &dasd_mq_ops;
+        block->tag_set.cmd_size = sizeof(struct dasd_ccw_req *);
         block->tag_set.nr_hw_queues = DASD_NR_HW_QUEUES;
         block->tag_set.queue_depth = DASD_MAX_LCU_DEV * DASD_REQ_PER_DEV;
         block->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index 439991d71b14..4c14ce428e92 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -141,7 +141,7 @@ static int __qdio_allocate_qs(struct qdio_q **irq_ptr_qs, int nr_queues)
         int i;
 
         for (i = 0; i < nr_queues; i++) {
-                q = kmem_cache_alloc(qdio_q_cache, GFP_KERNEL);
+                q = kmem_cache_zalloc(qdio_q_cache, GFP_KERNEL);
                 if (!q)
                         return -ENOMEM;
 
@@ -456,7 +456,6 @@ int qdio_setup_irq(struct qdio_initialize *init_data)
 {
         struct ciw *ciw;
         struct qdio_irq *irq_ptr = init_data->cdev->private->qdio_data;
-        int rc;
 
         memset(&irq_ptr->qib, 0, sizeof(irq_ptr->qib));
         memset(&irq_ptr->siga_flag, 0, sizeof(irq_ptr->siga_flag));
@@ -493,16 +492,14 @@ int qdio_setup_irq(struct qdio_initialize *init_data)
         ciw = ccw_device_get_ciw(init_data->cdev, CIW_TYPE_EQUEUE);
         if (!ciw) {
                 DBF_ERROR("%4x NO EQ", irq_ptr->schid.sch_no);
-                rc = -EINVAL;
-                goto out_err;
+                return -EINVAL;
         }
         irq_ptr->equeue = *ciw;
 
         ciw = ccw_device_get_ciw(init_data->cdev, CIW_TYPE_AQUEUE);
         if (!ciw) {
                 DBF_ERROR("%4x NO AQ", irq_ptr->schid.sch_no);
-                rc = -EINVAL;
-                goto out_err;
+                return -EINVAL;
         }
         irq_ptr->aqueue = *ciw;
 
@@ -512,9 +509,6 @@ int qdio_setup_irq(struct qdio_initialize *init_data)
         init_data->cdev->handler = qdio_int_handler;
         spin_unlock_irq(get_ccwdev_lock(irq_ptr->cdev));
         return 0;
-out_err:
-        qdio_release_memory(irq_ptr);
-        return rc;
 }
 
 void qdio_print_subchannel_info(struct qdio_irq *irq_ptr,
diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index 2c7550797ec2..dce92b2a895d 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -715,6 +715,10 @@ void cp_free(struct channel_program *cp)
  * and stores the result to ccwchain list. @cp must have been
  * initialized by a previous call with cp_init(). Otherwise, undefined
  * behavior occurs.
+ * For each chain composing the channel program:
+ * - On entry ch_len holds the count of CCWs to be translated.
+ * - On exit ch_len is adjusted to the count of successfully translated CCWs.
+ * This allows cp_free to find in ch_len the count of CCWs to free in a chain.
  *
  * The S/390 CCW Translation APIS (prefixed by 'cp_') are introduced
  * as helpers to do ccw chain translation inside the kernel. Basically
@@ -749,11 +753,18 @@ int cp_prefetch(struct channel_program *cp)
                 for (idx = 0; idx < len; idx++) {
                         ret = ccwchain_fetch_one(chain, idx, cp);
                         if (ret)
-                                return ret;
+                                goto out_err;
                 }
         }
 
         return 0;
+out_err:
+        /* Only cleanup the chain elements that were actually translated. */
+        chain->ch_len = idx;
+        list_for_each_entry_continue(chain, &cp->ccwchain_list, next) {
+                chain->ch_len = 0;
+        }
+        return ret;
 }
 
 /**
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index a8b831000b2d..18c4f933e8b9 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -4,7 +4,7 @@
  *
  * Debug traces for zfcp.
  *
- * Copyright IBM Corp. 2002, 2017
+ * Copyright IBM Corp. 2002, 2018
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -308,6 +308,27 @@ void zfcp_dbf_rec_trig(char *tag, struct zfcp_adapter *adapter,
         spin_unlock_irqrestore(&dbf->rec_lock, flags);
 }
 
+/**
+ * zfcp_dbf_rec_trig_lock - trace event related to triggered recovery with lock
+ * @tag: identifier for event
+ * @adapter: adapter on which the erp_action should run
+ * @port: remote port involved in the erp_action
+ * @sdev: scsi device involved in the erp_action
+ * @want: wanted erp_action
+ * @need: required erp_action
+ *
+ * The adapter->erp_lock must not be held.
+ */
+void zfcp_dbf_rec_trig_lock(char *tag, struct zfcp_adapter *adapter,
+                            struct zfcp_port *port, struct scsi_device *sdev,
+                            u8 want, u8 need)
+{
+        unsigned long flags;
+
+        read_lock_irqsave(&adapter->erp_lock, flags);
+        zfcp_dbf_rec_trig(tag, adapter, port, sdev, want, need);
+        read_unlock_irqrestore(&adapter->erp_lock, flags);
+}
 
 /**
  * zfcp_dbf_rec_run_lvl - trace event related to running recovery
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index bf8ea4df2bb8..e5eed8aac0ce 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -4,7 +4,7 @@
  *
  * External function declarations.
  *
- * Copyright IBM Corp. 2002, 2016
+ * Copyright IBM Corp. 2002, 2018
  */
 
 #ifndef ZFCP_EXT_H
@@ -35,6 +35,9 @@ extern int zfcp_dbf_adapter_register(struct zfcp_adapter *);
 extern void zfcp_dbf_adapter_unregister(struct zfcp_adapter *);
 extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *,
                               struct zfcp_port *, struct scsi_device *, u8, u8);
+extern void zfcp_dbf_rec_trig_lock(char *tag, struct zfcp_adapter *adapter,
+                                   struct zfcp_port *port,
+                                   struct scsi_device *sdev, u8 want, u8 need);
 extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *);
 extern void zfcp_dbf_rec_run_lvl(int level, char *tag,
                                  struct zfcp_erp_action *erp);
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 4d2ba5682493..22f9562f415c 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -4,7 +4,7 @@
  *
  * Interface to Linux SCSI midlayer.
  *
- * Copyright IBM Corp. 2002, 2017
+ * Copyright IBM Corp. 2002, 2018
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -618,9 +618,9 @@ static void zfcp_scsi_rport_register(struct zfcp_port *port)
         ids.port_id = port->d_id;
         ids.roles = FC_RPORT_ROLE_FCP_TARGET;
 
-        zfcp_dbf_rec_trig("scpaddy", port->adapter, port, NULL,
-                          ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD,
-                          ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD);
+        zfcp_dbf_rec_trig_lock("scpaddy", port->adapter, port, NULL,
+                               ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD,
+                               ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD);
         rport = fc_remote_port_add(port->adapter->scsi_host, 0, &ids);
         if (!rport) {
                 dev_err(&port->adapter->ccw_device->dev,
@@ -642,9 +642,9 @@ static void zfcp_scsi_rport_block(struct zfcp_port *port)
         struct fc_rport *rport = port->rport;
 
         if (rport) {
-                zfcp_dbf_rec_trig("scpdely", port->adapter, port, NULL,
-                                  ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL,
-                                  ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL);
+                zfcp_dbf_rec_trig_lock("scpdely", port->adapter, port, NULL,
+                                       ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL,
+                                       ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL);
                 fc_remote_port_delete(rport);
                 port->rport = NULL;
         }
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index e29f9b8fd66d..56c940394729 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -182,7 +182,7 @@ zalon7xx-objs	:= zalon.o ncr53c8xx.o
 NCR_Q720_mod-objs       := NCR_Q720.o ncr53c8xx.o
 
 # Files generated that shall be removed upon make clean
-clean-files :=  53c700_d.h 53c700_u.h
+clean-files :=  53c700_d.h 53c700_u.h scsi_devinfo_tbl.c
 
 $(obj)/53c700.o $(MODVERDIR)/$(obj)/53c700.ver: $(obj)/53c700_d.h
 
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index 0156c9623c35..d62ddd63f4fe 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -724,6 +724,8 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback,
         int wait;
         unsigned long flags = 0;
         unsigned long mflags = 0;
+        struct aac_hba_cmd_req *hbacmd = (struct aac_hba_cmd_req *)
+                        fibptr->hw_fib_va;
 
         fibptr->flags = (FIB_CONTEXT_FLAG | FIB_CONTEXT_FLAG_NATIVE_HBA);
         if (callback) {
@@ -734,11 +736,9 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback,
                 wait = 1;
 
 
-        if (command == HBA_IU_TYPE_SCSI_CMD_REQ) {
-                struct aac_hba_cmd_req *hbacmd =
-                        (struct aac_hba_cmd_req *)fibptr->hw_fib_va;
+        hbacmd->iu_type = command;
 
-                hbacmd->iu_type = command;
+        if (command == HBA_IU_TYPE_SCSI_CMD_REQ) {
                 /* bit1 of request_id must be 0 */
                 hbacmd->request_id =
                         cpu_to_le32((((u32)(fibptr - dev->fibs)) << 2) + 1);
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index c198b96368dd..5c40d809830f 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1894,7 +1894,7 @@ retry:
                 num = (rem_sz > scatter_elem_sz_prev) ?
                         scatter_elem_sz_prev : rem_sz;
 
-                schp->pages[k] = alloc_pages(gfp_mask, order);
+                schp->pages[k] = alloc_pages(gfp_mask | __GFP_ZERO, order);
                 if (!schp->pages[k])
                         goto out;
 
diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c
index 2a21f2d48592..35fab1e18adc 100644
--- a/drivers/scsi/sr_ioctl.c
+++ b/drivers/scsi/sr_ioctl.c
@@ -188,9 +188,13 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc)
         struct scsi_device *SDev;
         struct scsi_sense_hdr sshdr;
         int result, err = 0, retries = 0;
+        unsigned char sense_buffer[SCSI_SENSE_BUFFERSIZE], *senseptr = NULL;
 
         SDev = cd->device;
 
+        if (cgc->sense)
+                senseptr = sense_buffer;
+
       retry:
         if (!scsi_block_when_processing_errors(SDev)) {
                 err = -ENODEV;
@@ -198,10 +202,12 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc)
         }
 
         result = scsi_execute(SDev, cgc->cmd, cgc->data_direction,
-                              cgc->buffer, cgc->buflen,
-                              (unsigned char *)cgc->sense, &sshdr,
+                              cgc->buffer, cgc->buflen, senseptr, &sshdr,
                               cgc->timeout, IOCTL_RETRIES, 0, 0, NULL);
 
+        if (cgc->sense)
+                memcpy(cgc->sense, sense_buffer, sizeof(*cgc->sense));
+
         /* Minimal error checking.  Ignore cases we know about, and report the rest. */
         if (driver_byte(result) != 0) {
                 switch (sshdr.sense_key) {
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index c374e3b5c678..777e5f1e52d1 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -609,7 +609,7 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
                         break;
 
                 case BTSTAT_ABORTQUEUE:
-                        cmd->result = (DID_ABORT << 16);
+                        cmd->result = (DID_BUS_BUSY << 16);
                         break;
 
                 case BTSTAT_SCSIPARITY:
diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
index d9fcdb592b39..3e3d12ce4587 100644
--- a/drivers/soc/tegra/pmc.c
+++ b/drivers/soc/tegra/pmc.c
@@ -559,22 +559,28 @@ EXPORT_SYMBOL(tegra_powergate_remove_clamping);
 int tegra_powergate_sequence_power_up(unsigned int id, struct clk *clk,
                                       struct reset_control *rst)
 {
-        struct tegra_powergate pg;
+        struct tegra_powergate *pg;
         int err;
 
         if (!tegra_powergate_is_available(id))
                 return -EINVAL;
 
-        pg.id = id;
-        pg.clks = &clk;
-        pg.num_clks = 1;
-        pg.reset = rst;
-        pg.pmc = pmc;
+        pg = kzalloc(sizeof(*pg), GFP_KERNEL);
+        if (!pg)
+                return -ENOMEM;
 
-        err = tegra_powergate_power_up(&pg, false);
+        pg->id = id;
+        pg->clks = &clk;
+        pg->num_clks = 1;
+        pg->reset = rst;
+        pg->pmc = pmc;
+
+        err = tegra_powergate_power_up(pg, false);
         if (err)
                 pr_err("failed to turn on partition %d: %d\n", id, err);
 
+        kfree(pg);
+
         return err;
 }
 EXPORT_SYMBOL(tegra_powergate_sequence_power_up);
diff --git a/drivers/soundwire/bus_type.c b/drivers/soundwire/bus_type.c
index d5f3a70c06b0..283b2832728e 100644
--- a/drivers/soundwire/bus_type.c
+++ b/drivers/soundwire/bus_type.c
@@ -83,17 +83,16 @@ static int sdw_drv_probe(struct device *dev)
          * attach to power domain but don't turn on (last arg)
          */
         ret = dev_pm_domain_attach(dev, false);
-        if (ret != -EPROBE_DEFER) {
-                ret = drv->probe(slave, id);
-                if (ret) {
-                        dev_err(dev, "Probe of %s failed: %d\n", drv->name, ret);
-                        dev_pm_domain_detach(dev, false);
-                }
-        }
-
         if (ret)
                 return ret;
 
+        ret = drv->probe(slave, id);
+        if (ret) {
+                dev_err(dev, "Probe of %s failed: %d\n", drv->name, ret);
+                dev_pm_domain_detach(dev, false);
+                return ret;
+        }
+
         /* device is probed so let's read the properties now */
         if (slave->ops && slave->ops->read_prop)
                 slave->ops->read_prop(slave);
diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index 1596d35498c5..6573152ce893 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -490,7 +490,7 @@ static int bcm_qspi_bspi_set_mode(struct bcm_qspi *qspi,
 
 static void bcm_qspi_enable_bspi(struct bcm_qspi *qspi)
 {
-        if (!has_bspi(qspi) || (qspi->bspi_enabled))
+        if (!has_bspi(qspi))
                 return;
 
         qspi->bspi_enabled = 1;
@@ -505,7 +505,7 @@ static void bcm_qspi_enable_bspi(struct bcm_qspi *qspi)
 
 static void bcm_qspi_disable_bspi(struct bcm_qspi *qspi)
 {
-        if (!has_bspi(qspi) || (!qspi->bspi_enabled))
+        if (!has_bspi(qspi))
                 return;
 
         qspi->bspi_enabled = 0;
@@ -519,16 +519,19 @@ static void bcm_qspi_disable_bspi(struct bcm_qspi *qspi)
 
 static void bcm_qspi_chip_select(struct bcm_qspi *qspi, int cs)
 {
-        u32 data = 0;
+        u32 rd = 0;
+        u32 wr = 0;
 
-        if (qspi->curr_cs == cs)
-                return;
         if (qspi->base[CHIP_SELECT]) {
-                data = bcm_qspi_read(qspi, CHIP_SELECT, 0);
-                data = (data & ~0xff) | (1 << cs);
-                bcm_qspi_write(qspi, CHIP_SELECT, 0, data);
+                rd = bcm_qspi_read(qspi, CHIP_SELECT, 0);
+                wr = (rd & ~0xff) | (1 << cs);
+                if (rd == wr)
+                        return;
+                bcm_qspi_write(qspi, CHIP_SELECT, 0, wr);
                 usleep_range(10, 20);
         }
+
+        dev_dbg(&qspi->pdev->dev, "using cs:%d\n", cs);
         qspi->curr_cs = cs;
 }
 
@@ -755,8 +758,13 @@ static int write_to_hw(struct bcm_qspi *qspi, struct spi_device *spi)
                         dev_dbg(&qspi->pdev->dev, "WR %04x\n", val);
                 }
                 mspi_cdram = MSPI_CDRAM_CONT_BIT;
-                mspi_cdram |= (~(1 << spi->chip_select) &
-                               MSPI_CDRAM_PCS);
+
+                if (has_bspi(qspi))
+                        mspi_cdram &= ~1;
+                else
+                        mspi_cdram |= (~(1 << spi->chip_select) &
+                                       MSPI_CDRAM_PCS);
+
                 mspi_cdram |= ((tp.trans->bits_per_word <= 8) ? 0 :
                                 MSPI_CDRAM_BITSE_BIT);
 
diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 1431cb98fe40..3094d818cf06 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -184,6 +184,11 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
         struct bcm2835aux_spi *bs = spi_master_get_devdata(master);
         irqreturn_t ret = IRQ_NONE;
 
+        /* IRQ may be shared, so return if our interrupts are disabled */
+        if (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_CNTL1) &
+              (BCM2835_AUX_SPI_CNTL1_TXEMPTY | BCM2835_AUX_SPI_CNTL1_IDLE)))
+                return ret;
+
         /* check if we have data to read */
         while (bs->rx_len &&
                (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) &
diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
index 5c9516ae4942..4a001634023e 100644
--- a/drivers/spi/spi-cadence.c
+++ b/drivers/spi/spi-cadence.c
@@ -313,6 +313,14 @@ static void cdns_spi_fill_tx_fifo(struct cdns_spi *xspi)
 
         while ((trans_cnt < CDNS_SPI_FIFO_DEPTH) &&
                (xspi->tx_bytes > 0)) {
+
+                /* When xspi in busy condition, bytes may send failed,
+                 * then spi control did't work thoroughly, add one byte delay
+                 */
+                if (cdns_spi_read(xspi, CDNS_SPI_ISR) &
+                    CDNS_SPI_IXR_TXFULL)
+                        usleep_range(10, 20);
+
                 if (xspi->txbuf)
                         cdns_spi_write(xspi, CDNS_SPI_TXD, *xspi->txbuf++);
                 else
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 6f57592a7f95..a056ee88a960 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -1701,7 +1701,7 @@ static struct platform_driver spi_imx_driver = {
 };
 module_platform_driver(spi_imx_driver);
 
-MODULE_DESCRIPTION("SPI Master Controller driver");
+MODULE_DESCRIPTION("SPI Controller driver");
 MODULE_AUTHOR("Sascha Hauer, Pengutronix");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:" DRIVER_NAME);
diff --git a/drivers/spi/spi-pxa2xx.h b/drivers/spi/spi-pxa2xx.h
index 513ec6c6e25b..0ae7defd3492 100644
--- a/drivers/spi/spi-pxa2xx.h
+++ b/drivers/spi/spi-pxa2xx.h
@@ -38,7 +38,7 @@ struct driver_data {
 
         /* SSP register addresses */
         void __iomem *ioaddr;
-        u32 ssdr_physical;
+        phys_addr_t ssdr_physical;
 
         /* SSP masks*/
         u32 dma_cr1;
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index ae086aab57d5..8171eedbfc90 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -283,6 +283,7 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p,
         }
 
         k = min_t(int, k, ARRAY_SIZE(sh_msiof_spi_div_table) - 1);
+        brps = min_t(int, brps, 32);
 
         scr = sh_msiof_spi_div_table[k].brdv | SCR_BRPS(brps);
         sh_msiof_write(p, TSCR, scr);
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 7b213faa0a2b..eeab67f50580 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -356,11 +356,12 @@ static int spi_drv_probe(struct device *dev)
         }
 
         ret = dev_pm_domain_attach(dev, true);
-        if (ret != -EPROBE_DEFER) {
-                ret = sdrv->probe(spi);
-                if (ret)
-                        dev_pm_domain_detach(dev, true);
-        }
+        if (ret)
+                return ret;
+
+        ret = sdrv->probe(spi);
+        if (ret)
+                dev_pm_domain_detach(dev, true);
 
         return ret;
 }
diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig
index 9371651d8017..c574dd210500 100644
--- a/drivers/ssb/Kconfig
+++ b/drivers/ssb/Kconfig
@@ -117,7 +117,7 @@ config SSB_SERIAL
 
 config SSB_DRIVER_PCICORE_POSSIBLE
         bool
-        depends on SSB_PCIHOST && SSB = y
+        depends on SSB_PCIHOST
         default y
 
 config SSB_DRIVER_PCICORE
@@ -131,7 +131,7 @@ config SSB_DRIVER_PCICORE
 
 config SSB_PCICORE_HOSTMODE
         bool "Hostmode support for SSB PCI core"
-        depends on SSB_DRIVER_PCICORE && SSB_DRIVER_MIPS
+        depends on SSB_DRIVER_PCICORE && SSB_DRIVER_MIPS && SSB = y
         help
           PCIcore hostmode operation (external PCI bus).
 
diff --git a/drivers/staging/lustre/lnet/Kconfig b/drivers/staging/lustre/lnet/Kconfig
index ad049e6f24e4..f3b1ad4bd3dc 100644
--- a/drivers/staging/lustre/lnet/Kconfig
+++ b/drivers/staging/lustre/lnet/Kconfig
@@ -34,7 +34,7 @@ config LNET_SELFTEST
 
 config LNET_XPRT_IB
         tristate "LNET infiniband support"
-        depends on LNET && PCI && INFINIBAND && INFINIBAND_ADDR_TRANS
+        depends on LNET && PCI && INFINIBAND_ADDR_TRANS
         default LNET && INFINIBAND
         help
           This option allows the LNET users to use infiniband as an
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 4ad89ea71a70..4f26bdc3d1dc 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -2121,6 +2121,8 @@ static ssize_t tcmu_qfull_time_out_store(struct config_item *item,
 
         if (val >= 0) {
                 udev->qfull_time_out = val * MSEC_PER_SEC;
+        } else if (val == -1) {
+                udev->qfull_time_out = val;
         } else {
                 printk(KERN_ERR "Invalid qfull timeout value %d\n", val);
                 return -EINVAL;
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
index 0124a91c8d71..dd46b758852a 100644
--- a/drivers/tee/tee_core.c
+++ b/drivers/tee/tee_core.c
@@ -238,6 +238,17 @@ static int params_from_user(struct tee_context *ctx, struct tee_param *params,
                         if (IS_ERR(shm))
                                 return PTR_ERR(shm);
 
+                        /*
+                         * Ensure offset + size does not overflow offset
+                         * and does not overflow the size of the referred
+                         * shared memory object.
+                         */
+                        if ((ip.a + ip.b) < ip.a ||
+                            (ip.a + ip.b) > shm->size) {
+                                tee_shm_put(shm);
+                                return -EINVAL;
+                        }
+
                         params[n].u.memref.shm_offs = ip.a;
                         params[n].u.memref.size = ip.b;
                         params[n].u.memref.shm = shm;
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index 556960a1bab3..07d3be6f0780 100644
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -360,9 +360,10 @@ int tee_shm_get_fd(struct tee_shm *shm)
         if (!(shm->flags & TEE_SHM_DMA_BUF))
                 return -EINVAL;
 
+        get_dma_buf(shm->dmabuf);
         fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
-        if (fd >= 0)
-                get_dma_buf(shm->dmabuf);
+        if (fd < 0)
+                dma_buf_put(shm->dmabuf);
         return fd;
 }
 
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 72ebbc908e19..32cd52ca8318 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -354,7 +354,7 @@ int xhci_find_slot_id_by_port(struct usb_hcd *hcd, struct xhci_hcd *xhci,
 
         slot_id = 0;
         for (i = 0; i < MAX_HC_SLOTS; i++) {
-                if (!xhci->devs[i])
+                if (!xhci->devs[i] || !xhci->devs[i]->udev)
                         continue;
                 speed = xhci->devs[i]->udev->speed;
                 if (((speed >= USB_SPEED_SUPER) == (hcd->speed >= HCD_USB3))
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index e7f99d55922a..15a42cee0a9c 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2524,8 +2524,11 @@ static int musb_bus_suspend(struct usb_hcd *hcd)
 {
         struct musb     *musb = hcd_to_musb(hcd);
         u8              devctl;
+        int             ret;
 
-        musb_port_suspend(musb, true);
+        ret = musb_port_suspend(musb, true);
+        if (ret)
+                return ret;
 
         if (!is_host_active(musb))
                 return 0;
diff --git a/drivers/usb/musb/musb_host.h b/drivers/usb/musb/musb_host.h
index 72392bbcd0a4..2999845632ce 100644
--- a/drivers/usb/musb/musb_host.h
+++ b/drivers/usb/musb/musb_host.h
@@ -67,7 +67,7 @@ extern void musb_host_rx(struct musb *, u8);
 extern void musb_root_disconnect(struct musb *musb);
 extern void musb_host_resume_root_hub(struct musb *musb);
 extern void musb_host_poke_root_hub(struct musb *musb);
-extern void musb_port_suspend(struct musb *musb, bool do_suspend);
+extern int musb_port_suspend(struct musb *musb, bool do_suspend);
 extern void musb_port_reset(struct musb *musb, bool do_reset);
 extern void musb_host_finish_resume(struct work_struct *work);
 #else
@@ -99,7 +99,10 @@ static inline void musb_root_disconnect(struct musb *musb)	{}
 static inline void musb_host_resume_root_hub(struct musb *musb) {}
 static inline void musb_host_poll_rh_status(struct musb *musb)  {}
 static inline void musb_host_poke_root_hub(struct musb *musb)   {}
-static inline void musb_port_suspend(struct musb *musb, bool do_suspend) {}
+static inline int musb_port_suspend(struct musb *musb, bool do_suspend)
+{
+        return 0;
+}
 static inline void musb_port_reset(struct musb *musb, bool do_reset) {}
 static inline void musb_host_finish_resume(struct work_struct *work) {}
 #endif
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index 5165d2b07ade..2f8dd9826e94 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -48,14 +48,14 @@ void musb_host_finish_resume(struct work_struct *work)
         spin_unlock_irqrestore(&musb->lock, flags);
 }
 
-void musb_port_suspend(struct musb *musb, bool do_suspend)
+int musb_port_suspend(struct musb *musb, bool do_suspend)
 {
         struct usb_otg  *otg = musb->xceiv->otg;
         u8              power;
         void __iomem    *mbase = musb->mregs;
 
         if (!is_host_active(musb))
-                return;
+                return 0;
 
         /* NOTE:  this doesn't necessarily put PHY into low power mode,
          * turning off its clock; that's a function of PHY integration and
@@ -66,16 +66,20 @@ void musb_port_suspend(struct musb *musb, bool do_suspend)
         if (do_suspend) {
                 int retries = 10000;
 
-                power &= ~MUSB_POWER_RESUME;
-                power |= MUSB_POWER_SUSPENDM;
-                musb_writeb(mbase, MUSB_POWER, power);
+                if (power & MUSB_POWER_RESUME)
+                        return -EBUSY;
 
-                /* Needed for OPT A tests */
-                power = musb_readb(mbase, MUSB_POWER);
-                while (power & MUSB_POWER_SUSPENDM) {
+                if (!(power & MUSB_POWER_SUSPENDM)) {
+                        power |= MUSB_POWER_SUSPENDM;
+                        musb_writeb(mbase, MUSB_POWER, power);
+
+                        /* Needed for OPT A tests */
                         power = musb_readb(mbase, MUSB_POWER);
-                        if (retries-- < 1)
-                                break;
+                        while (power & MUSB_POWER_SUSPENDM) {
+                                power = musb_readb(mbase, MUSB_POWER);
+                                if (retries-- < 1)
+                                        break;
+                        }
                 }
 
                 musb_dbg(musb, "Root port suspended, power %02x", power);
@@ -111,6 +115,7 @@ void musb_port_suspend(struct musb *musb, bool do_suspend)
                 schedule_delayed_work(&musb->finish_resume_work,
                                       msecs_to_jiffies(USB_RESUME_TIMEOUT));
         }
+        return 0;
 }
 
 void musb_port_reset(struct musb *musb, bool do_reset)
diff --git a/drivers/usb/usbip/stub.h b/drivers/usb/usbip/stub.h
index 14a72357800a..35618ceb2791 100644
--- a/drivers/usb/usbip/stub.h
+++ b/drivers/usb/usbip/stub.h
@@ -73,6 +73,7 @@ struct bus_id_priv {
         struct stub_device *sdev;
         struct usb_device *udev;
         char shutdown_busid;
+        spinlock_t busid_lock;
 };
 
 /* stub_priv is allocated from stub_priv_cache */
@@ -83,6 +84,7 @@ extern struct usb_device_driver stub_driver;
 
 /* stub_main.c */
 struct bus_id_priv *get_busid_priv(const char *busid);
+void put_busid_priv(struct bus_id_priv *bid);
 int del_match_busid(char *busid);
 void stub_device_cleanup_urbs(struct stub_device *sdev);
 
diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index dd8ef36ab10e..c0d6ff1baa72 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -300,9 +300,9 @@ static int stub_probe(struct usb_device *udev)
         struct stub_device *sdev = NULL;
         const char *udev_busid = dev_name(&udev->dev);
         struct bus_id_priv *busid_priv;
-        int rc;
+        int rc = 0;
 
-        dev_dbg(&udev->dev, "Enter\n");
+        dev_dbg(&udev->dev, "Enter probe\n");
 
         /* check we should claim or not by busid_table */
         busid_priv = get_busid_priv(udev_busid);
@@ -317,13 +317,15 @@ static int stub_probe(struct usb_device *udev)
                  * other matched drivers by the driver core.
                  * See driver_probe_device() in driver/base/dd.c
                  */
-                return -ENODEV;
+                rc = -ENODEV;
+                goto call_put_busid_priv;
         }
 
         if (udev->descriptor.bDeviceClass == USB_CLASS_HUB) {
                 dev_dbg(&udev->dev, "%s is a usb hub device... skip!\n",
                          udev_busid);
-                return -ENODEV;
+                rc = -ENODEV;
+                goto call_put_busid_priv;
         }
 
         if (!strcmp(udev->bus->bus_name, "vhci_hcd")) {
@@ -331,13 +333,16 @@ static int stub_probe(struct usb_device *udev)
                         "%s is attached on vhci_hcd... skip!\n",
                         udev_busid);
 
-                return -ENODEV;
+                rc = -ENODEV;
+                goto call_put_busid_priv;
         }
 
         /* ok, this is my device */
         sdev = stub_device_alloc(udev);
-        if (!sdev)
-                return -ENOMEM;
+        if (!sdev) {
+                rc = -ENOMEM;
+                goto call_put_busid_priv;
+        }
 
         dev_info(&udev->dev,
                 "usbip-host: register new device (bus %u dev %u)\n",
@@ -369,7 +374,9 @@ static int stub_probe(struct usb_device *udev)
         }
         busid_priv->status = STUB_BUSID_ALLOC;
 
-        return 0;
+        rc = 0;
+        goto call_put_busid_priv;
+
 err_files:
         usb_hub_release_port(udev->parent, udev->portnum,
                              (struct usb_dev_state *) udev);
@@ -379,6 +386,9 @@ err_port:
 
         busid_priv->sdev = NULL;
         stub_device_free(sdev);
+
+call_put_busid_priv:
+        put_busid_priv(busid_priv);
         return rc;
 }
 
@@ -404,7 +414,7 @@ static void stub_disconnect(struct usb_device *udev)
         struct bus_id_priv *busid_priv;
         int rc;
 
-        dev_dbg(&udev->dev, "Enter\n");
+        dev_dbg(&udev->dev, "Enter disconnect\n");
 
         busid_priv = get_busid_priv(udev_busid);
         if (!busid_priv) {
@@ -417,7 +427,7 @@ static void stub_disconnect(struct usb_device *udev)
         /* get stub_device */
         if (!sdev) {
                 dev_err(&udev->dev, "could not get device");
-                return;
+                goto call_put_busid_priv;
         }
 
         dev_set_drvdata(&udev->dev, NULL);
@@ -432,12 +442,12 @@ static void stub_disconnect(struct usb_device *udev)
                                   (struct usb_dev_state *) udev);
         if (rc) {
                 dev_dbg(&udev->dev, "unable to release port\n");
-                return;
+                goto call_put_busid_priv;
         }
 
         /* If usb reset is called from event handler */
         if (usbip_in_eh(current))
-                return;
+                goto call_put_busid_priv;
 
         /* shutdown the current connection */
         shutdown_busid(busid_priv);
@@ -448,12 +458,11 @@ static void stub_disconnect(struct usb_device *udev)
         busid_priv->sdev = NULL;
         stub_device_free(sdev);
 
-        if (busid_priv->status == STUB_BUSID_ALLOC) {
+        if (busid_priv->status == STUB_BUSID_ALLOC)
                 busid_priv->status = STUB_BUSID_ADDED;
-        } else {
-                busid_priv->status = STUB_BUSID_OTHER;
-                del_match_busid((char *)udev_busid);
-        }
+
+call_put_busid_priv:
+        put_busid_priv(busid_priv);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
index d41d0cdeec0f..bf8a5feb0ee9 100644
--- a/drivers/usb/usbip/stub_main.c
+++ b/drivers/usb/usbip/stub_main.c
@@ -14,6 +14,7 @@
 #define DRIVER_DESC "USB/IP Host Driver"
 
 struct kmem_cache *stub_priv_cache;
+
 /*
  * busid_tables defines matching busids that usbip can grab. A user can change
  * dynamically what device is locally used and what device is exported to a
@@ -25,6 +26,8 @@ static spinlock_t busid_table_lock;
 
 static void init_busid_table(void)
 {
+        int i;
+
         /*
          * This also sets the bus_table[i].status to
          * STUB_BUSID_OTHER, which is 0.
@@ -32,6 +35,9 @@ static void init_busid_table(void)
         memset(busid_table, 0, sizeof(busid_table));
 
         spin_lock_init(&busid_table_lock);
+
+        for (i = 0; i < MAX_BUSID; i++)
+                spin_lock_init(&busid_table[i].busid_lock);
 }
 
 /*
@@ -43,15 +49,20 @@ static int get_busid_idx(const char *busid)
         int i;
         int idx = -1;
 
-        for (i = 0; i < MAX_BUSID; i++)
+        for (i = 0; i < MAX_BUSID; i++) {
+                spin_lock(&busid_table[i].busid_lock);
                 if (busid_table[i].name[0])
                         if (!strncmp(busid_table[i].name, busid, BUSID_SIZE)) {
                                 idx = i;
+                                spin_unlock(&busid_table[i].busid_lock);
                                 break;
                         }
+                spin_unlock(&busid_table[i].busid_lock);
+        }
         return idx;
 }
 
+/* Returns holding busid_lock. Should call put_busid_priv() to unlock */
 struct bus_id_priv *get_busid_priv(const char *busid)
 {
         int idx;
@@ -59,13 +70,22 @@ struct bus_id_priv *get_busid_priv(const char *busid)
 
         spin_lock(&busid_table_lock);
         idx = get_busid_idx(busid);
-        if (idx >= 0)
+        if (idx >= 0) {
                 bid = &(busid_table[idx]);
+                /* get busid_lock before returning */
+                spin_lock(&bid->busid_lock);
+        }
         spin_unlock(&busid_table_lock);
 
         return bid;
 }
 
+void put_busid_priv(struct bus_id_priv *bid)
+{
+        if (bid)
+                spin_unlock(&bid->busid_lock);
+}
+
 static int add_match_busid(char *busid)
 {
         int i;
@@ -78,15 +98,19 @@ static int add_match_busid(char *busid)
                 goto out;
         }
 
-        for (i = 0; i < MAX_BUSID; i++)
+        for (i = 0; i < MAX_BUSID; i++) {
+                spin_lock(&busid_table[i].busid_lock);
                 if (!busid_table[i].name[0]) {
                         strlcpy(busid_table[i].name, busid, BUSID_SIZE);
                         if ((busid_table[i].status != STUB_BUSID_ALLOC) &&
                             (busid_table[i].status != STUB_BUSID_REMOV))
                                 busid_table[i].status = STUB_BUSID_ADDED;
                         ret = 0;
+                        spin_unlock(&busid_table[i].busid_lock);
                         break;
                 }
+                spin_unlock(&busid_table[i].busid_lock);
+        }
 
 out:
         spin_unlock(&busid_table_lock);
@@ -107,6 +131,8 @@ int del_match_busid(char *busid)
         /* found */
         ret = 0;
 
+        spin_lock(&busid_table[idx].busid_lock);
+
         if (busid_table[idx].status == STUB_BUSID_OTHER)
                 memset(busid_table[idx].name, 0, BUSID_SIZE);
 
@@ -114,6 +140,7 @@ int del_match_busid(char *busid)
             (busid_table[idx].status != STUB_BUSID_ADDED))
                 busid_table[idx].status = STUB_BUSID_REMOV;
 
+        spin_unlock(&busid_table[idx].busid_lock);
 out:
         spin_unlock(&busid_table_lock);
 
@@ -126,9 +153,12 @@ static ssize_t match_busid_show(struct device_driver *drv, char *buf)
         char *out = buf;
 
         spin_lock(&busid_table_lock);
-        for (i = 0; i < MAX_BUSID; i++)
+        for (i = 0; i < MAX_BUSID; i++) {
+                spin_lock(&busid_table[i].busid_lock);
                 if (busid_table[i].name[0])
                         out += sprintf(out, "%s ", busid_table[i].name);
+                spin_unlock(&busid_table[i].busid_lock);
+        }
         spin_unlock(&busid_table_lock);
         out += sprintf(out, "\n");
 
@@ -169,6 +199,51 @@ static ssize_t match_busid_store(struct device_driver *dev, const char *buf,
 }
 static DRIVER_ATTR_RW(match_busid);
 
+static int do_rebind(char *busid, struct bus_id_priv *busid_priv)
+{
+        int ret;
+
+        /* device_attach() callers should hold parent lock for USB */
+        if (busid_priv->udev->dev.parent)
+                device_lock(busid_priv->udev->dev.parent);
+        ret = device_attach(&busid_priv->udev->dev);
+        if (busid_priv->udev->dev.parent)
+                device_unlock(busid_priv->udev->dev.parent);
+        if (ret < 0) {
+                dev_err(&busid_priv->udev->dev, "rebind failed\n");
+                return ret;
+        }
+        return 0;
+}
+
+static void stub_device_rebind(void)
+{
+#if IS_MODULE(CONFIG_USBIP_HOST)
+        struct bus_id_priv *busid_priv;
+        int i;
+
+        /* update status to STUB_BUSID_OTHER so probe ignores the device */
+        spin_lock(&busid_table_lock);
+        for (i = 0; i < MAX_BUSID; i++) {
+                if (busid_table[i].name[0] &&
+                    busid_table[i].shutdown_busid) {
+                        busid_priv = &(busid_table[i]);
+                        busid_priv->status = STUB_BUSID_OTHER;
+                }
+        }
+        spin_unlock(&busid_table_lock);
+
+        /* now run rebind - no need to hold locks. driver files are removed */
+        for (i = 0; i < MAX_BUSID; i++) {
+                if (busid_table[i].name[0] &&
+                    busid_table[i].shutdown_busid) {
+                        busid_priv = &(busid_table[i]);
+                        do_rebind(busid_table[i].name, busid_priv);
+                }
+        }
+#endif
+}
+
 static ssize_t rebind_store(struct device_driver *dev, const char *buf,
                                  size_t count)
 {
@@ -186,16 +261,17 @@ static ssize_t rebind_store(struct device_driver *dev, const char *buf,
         if (!bid)
                 return -ENODEV;
 
-        /* device_attach() callers should hold parent lock for USB */
-        if (bid->udev->dev.parent)
-                device_lock(bid->udev->dev.parent);
-        ret = device_attach(&bid->udev->dev);
-        if (bid->udev->dev.parent)
-                device_unlock(bid->udev->dev.parent);
-        if (ret < 0) {
-                dev_err(&bid->udev->dev, "rebind failed\n");
+        /* mark the device for deletion so probe ignores it during rescan */
+        bid->status = STUB_BUSID_OTHER;
+        /* release the busid lock */
+        put_busid_priv(bid);
+
+        ret = do_rebind((char *) buf, bid);
+        if (ret < 0)
                 return ret;
-        }
+
+        /* delete device from busid_table */
+        del_match_busid((char *) buf);
 
         return count;
 }
@@ -317,6 +393,9 @@ static void __exit usbip_host_exit(void)
          */
         usb_deregister_device_driver(&stub_driver);
 
+        /* initiate scan to attach devices */
+        stub_device_rebind();
+
         kmem_cache_destroy(stub_priv_cache);
 }
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index f3bd8e941224..f0be5f35ab28 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -981,6 +981,7 @@ static int vhost_process_iotlb_msg(struct vhost_dev *dev,
 {
         int ret = 0;
 
+        mutex_lock(&dev->mutex);
         vhost_dev_lock_vqs(dev);
         switch (msg->type) {
         case VHOST_IOTLB_UPDATE:
@@ -1016,6 +1017,8 @@ static int vhost_process_iotlb_msg(struct vhost_dev *dev,
         }
 
         vhost_dev_unlock_vqs(dev);
+        mutex_unlock(&dev->mutex);
+
         return ret;
 }
 ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index e1c60899fdbc..a6f9ba85dc4b 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -351,7 +351,7 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
          * physical address */
         phys = xen_bus_to_phys(dev_addr);
 
-        if (((dev_addr + size - 1 > dma_mask)) ||
+        if (((dev_addr + size - 1 <= dma_mask)) ||
             range_straddles_page_boundary(phys, size))
                 xen_destroy_contiguous_region(phys, order);