235 files changed, 2428 insertions, 1552 deletions
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 3f3b7b253445..64fd96eada31 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -332,6 +332,35 @@ err_no_vma:
        return vma ? -ENOMEM : -ESRCH;
 }
+static inline void binder_alloc_set_vma(struct binder_alloc *alloc,
+                struct vm_area_struct *vma)
+{
+        if (vma)
+                alloc->vma_vm_mm = vma->vm_mm;
+        /*
+         * If we see alloc->vma is not NULL, buffer data structures set up
+         * completely. Look at smp_rmb side binder_alloc_get_vma.
+         * We also want to guarantee new alloc->vma_vm_mm is always visible
+         * if alloc->vma is set.
+         */
+        smp_wmb();
+        alloc->vma = vma;
+}
+static inline struct vm_area_struct *binder_alloc_get_vma(
+                struct binder_alloc *alloc)
+{
+        struct vm_area_struct *vma = NULL;
+        if (alloc->vma) {
+                /* Look at description in binder_alloc_set_vma */
+                smp_rmb();
+                vma = alloc->vma;
+        }
+        return vma;
+}
 static struct binder_buffer *binder_alloc_new_buf_locked(
                                struct binder_alloc *alloc,
                                size_t data_size,
@@ -348,7 +377,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
        size_t size, data_offsets_size;
        int ret;
-        if (alloc->vma == NULL) {
+        if (!binder_alloc_get_vma(alloc)) {
                binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
                                   "%d: binder_alloc_buf, no vma\n",
                                   alloc->pid);
@@ -723,9 +752,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
        buffer->free = 1;
        binder_insert_free_buffer(alloc, buffer);
        alloc->free_async_space = alloc->buffer_size / 2;
-        barrier();
+        binder_alloc_set_vma(alloc, vma);
-        alloc->vma = vma;
-        alloc->vma_vm_mm = vma->vm_mm;
        mmgrab(alloc->vma_vm_mm);
        return 0;
@@ -754,10 +781,10 @@ void binder_alloc_deferred_release(struct binder_alloc *alloc)
        int buffers, page_count;
        struct binder_buffer *buffer;
-        BUG_ON(alloc->vma);
        buffers = 0;
        mutex_lock(&alloc->mutex);
+        BUG_ON(alloc->vma);
        while ((n = rb_first(&alloc->allocated_buffers))) {
                buffer = rb_entry(n, struct binder_buffer, rb_node);
@@ -900,7 +927,7 @@ int binder_alloc_get_allocated_count(struct binder_alloc *alloc)
 */
 void binder_alloc_vma_close(struct binder_alloc *alloc)
 {
-        WRITE_ONCE(alloc->vma, NULL);
+        binder_alloc_set_vma(alloc, NULL);
 }
 /**
@@ -935,7 +962,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
        index = page - alloc->pages;
        page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
-        vma = alloc->vma;
+        vma = binder_alloc_get_vma(alloc);
        if (vma) {
                if (!mmget_not_zero(alloc->vma_vm_mm))
                        goto err_mmget;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 599e01bcdef2..a9dd4ea7467d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5359,10 +5359,20 @@ void ata_qc_complete(struct ata_queued_cmd *qc)
 */
 int ata_qc_complete_multiple(struct ata_port *ap, u64 qc_active)
 {
+        u64 done_mask, ap_qc_active = ap->qc_active;
        int nr_done = 0;
-        u64 done_mask;
-        done_mask = ap->qc_active ^ qc_active;
+        /*
+         * If the internal tag is set on ap->qc_active, then we care about
+         * bit0 on the passed in qc_active mask. Move that bit up to match
+         * the internal tag.
+         */
+        if (ap_qc_active & (1ULL << ATA_TAG_INTERNAL)) {
+                qc_active |= (qc_active & 0x01) << ATA_TAG_INTERNAL;
+                qc_active ^= qc_active & 0x01;
+        }
+        done_mask = ap_qc_active ^ qc_active;
        if (unlikely(done_mask & qc_active)) {
                ata_port_err(ap, "illegal qc_active transition (%08llx->%08llx)\n",
diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
index 0943e7065e0e..b3c0498ee433 100644
--- a/drivers/base/firmware_loader/main.c
+++ b/drivers/base/firmware_loader/main.c
@@ -209,21 +209,24 @@ static struct fw_priv *__lookup_fw_priv(const char *fw_name)
 static int alloc_lookup_fw_priv(const char *fw_name,
                                struct firmware_cache *fwc,
                                struct fw_priv **fw_priv, void *dbuf,
-                                size_t size)
+                                size_t size, enum fw_opt opt_flags)
 {
        struct fw_priv *tmp;
        spin_lock(&fwc->lock);
-        tmp = __lookup_fw_priv(fw_name);
+        if (!(opt_flags & FW_OPT_NOCACHE)) {
-        if (tmp) {
+                tmp = __lookup_fw_priv(fw_name);
-                kref_get(&tmp->ref);
+                if (tmp) {
-                spin_unlock(&fwc->lock);
+                        kref_get(&tmp->ref);
-                *fw_priv = tmp;
+                        spin_unlock(&fwc->lock);
-                pr_debug("batched request - sharing the same struct fw_priv and lookup for multiple requests\n");
+                        *fw_priv = tmp;
-                return 1;
+                        pr_debug("batched request - sharing the same struct fw_priv and lookup for multiple requests\n");
+                        return 1;
+                }
        }
        tmp = __allocate_fw_priv(fw_name, fwc, dbuf, size);
-        if (tmp)
+        if (tmp && !(opt_flags & FW_OPT_NOCACHE))
                list_add(&tmp->list, &fwc->head);
        spin_unlock(&fwc->lock);
@@ -493,7 +496,8 @@ int assign_fw(struct firmware *fw, struct device *device,
 */
 static int
 _request_firmware_prepare(struct firmware **firmware_p, const char *name,
-                          struct device *device, void *dbuf, size_t size)
+                          struct device *device, void *dbuf, size_t size,
+                          enum fw_opt opt_flags)
 {
        struct firmware *firmware;
        struct fw_priv *fw_priv;
@@ -511,7 +515,8 @@ _request_firmware_prepare(struct firmware **firmware_p, const char *name,
                return 0; /* assigned */
        }
-        ret = alloc_lookup_fw_priv(name, &fw_cache, &fw_priv, dbuf, size);
+        ret = alloc_lookup_fw_priv(name, &fw_cache, &fw_priv, dbuf, size,
+                                  opt_flags);
        /*
         * bind with 'priv' now to avoid warning in failure path
@@ -571,7 +576,8 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
                goto out;
        }
-        ret = _request_firmware_prepare(&fw, name, device, buf, size);
+        ret = _request_firmware_prepare(&fw, name, device, buf, size,
+                                        opt_flags);
        if (ret <= 0) /* error or already assigned */
                goto out;
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 48f622728ce6..f2b6f4da1034 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3467,6 +3467,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                                          (struct floppy_struct **)&outparam);
                if (ret)
                        return ret;
+                memcpy(&inparam.g, outparam,
+                                offsetof(struct floppy_struct, name));
+                outparam = &inparam.g;
                break;
        case FDMSGON:
                UDP->flags |= FTD_MSG;
diff --git a/drivers/block/null_blk.h b/drivers/block/null_blk.h
index d81781f22dba..34e0030f0592 100644
--- a/drivers/block/null_blk.h
+++ b/drivers/block/null_blk.h
@@ -87,10 +87,10 @@ struct nullb {
 #ifdef CONFIG_BLK_DEV_ZONED
 int null_zone_init(struct nullb_device *dev);
 void null_zone_exit(struct nullb_device *dev);
-blk_status_t null_zone_report(struct nullb *nullb,
+blk_status_t null_zone_report(struct nullb *nullb, struct bio *bio);
-                                            struct nullb_cmd *cmd);
+void null_zone_write(struct nullb_cmd *cmd, sector_t sector,
-void null_zone_write(struct nullb_cmd *cmd);
+                        unsigned int nr_sectors);
-void null_zone_reset(struct nullb_cmd *cmd);
+void null_zone_reset(struct nullb_cmd *cmd, sector_t sector);
 #else
 static inline int null_zone_init(struct nullb_device *dev)
 {
@@ -98,11 +98,14 @@ static inline int null_zone_init(struct nullb_device *dev)
 }
 static inline void null_zone_exit(struct nullb_device *dev) {}
 static inline blk_status_t null_zone_report(struct nullb *nullb,
-                                            struct nullb_cmd *cmd)
+                                            struct bio *bio)
 {
        return BLK_STS_NOTSUPP;
 }
-static inline void null_zone_write(struct nullb_cmd *cmd) {}
+static inline void null_zone_write(struct nullb_cmd *cmd, sector_t sector,
-static inline void null_zone_reset(struct nullb_cmd *cmd) {}
+                                   unsigned int nr_sectors)
+{
+}
+static inline void null_zone_reset(struct nullb_cmd *cmd, sector_t sector) {}
 #endif /* CONFIG_BLK_DEV_ZONED */
 #endif /* __NULL_BLK_H */
diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
index 6127e3ff7b4b..093b614d6524 100644
--- a/drivers/block/null_blk_main.c
+++ b/drivers/block/null_blk_main.c
@@ -1157,16 +1157,33 @@ static void null_restart_queue_async(struct nullb *nullb)
        }
 }
+static bool cmd_report_zone(struct nullb *nullb, struct nullb_cmd *cmd)
+{
+        struct nullb_device *dev = cmd->nq->dev;
+        if (dev->queue_mode == NULL_Q_BIO) {
+                if (bio_op(cmd->bio) == REQ_OP_ZONE_REPORT) {
+                        cmd->error = null_zone_report(nullb, cmd->bio);
+                        return true;
+                }
+        } else {
+                if (req_op(cmd->rq) == REQ_OP_ZONE_REPORT) {
+                        cmd->error = null_zone_report(nullb, cmd->rq->bio);
+                        return true;
+                }
+        }
+        return false;
+}
 static blk_status_t null_handle_cmd(struct nullb_cmd *cmd)
 {
        struct nullb_device *dev = cmd->nq->dev;
        struct nullb *nullb = dev->nullb;
        int err = 0;
-        if (req_op(cmd->rq) == REQ_OP_ZONE_REPORT) {
+        if (cmd_report_zone(nullb, cmd))
-                cmd->error = null_zone_report(nullb, cmd);
                goto out;
-        }
        if (test_bit(NULLB_DEV_FL_THROTTLED, &dev->flags)) {
                struct request *rq = cmd->rq;
@@ -1234,10 +1251,24 @@ static blk_status_t null_handle_cmd(struct nullb_cmd *cmd)
        cmd->error = errno_to_blk_status(err);
        if (!cmd->error && dev->zoned) {
-                if (req_op(cmd->rq) == REQ_OP_WRITE)
+                sector_t sector;
-                        null_zone_write(cmd);
+                unsigned int nr_sectors;
-                else if (req_op(cmd->rq) == REQ_OP_ZONE_RESET)
+                int op;
-                        null_zone_reset(cmd);
+                if (dev->queue_mode == NULL_Q_BIO) {
+                        op = bio_op(cmd->bio);
+                        sector = cmd->bio->bi_iter.bi_sector;
+                        nr_sectors = cmd->bio->bi_iter.bi_size >> 9;
+                } else {
+                        op = req_op(cmd->rq);
+                        sector = blk_rq_pos(cmd->rq);
+                        nr_sectors = blk_rq_sectors(cmd->rq);
+                }
+                if (op == REQ_OP_WRITE)
+                        null_zone_write(cmd, sector, nr_sectors);
+                else if (op == REQ_OP_ZONE_RESET)
+                        null_zone_reset(cmd, sector);
        }
 out:
        /* Complete IO by inline, softirq or timer */
diff --git a/drivers/block/null_blk_zoned.c b/drivers/block/null_blk_zoned.c
index a979ca00d7be..7c6b86d98700 100644
--- a/drivers/block/null_blk_zoned.c
+++ b/drivers/block/null_blk_zoned.c
@@ -48,8 +48,8 @@ void null_zone_exit(struct nullb_device *dev)
        kvfree(dev->zones);
 }
-static void null_zone_fill_rq(struct nullb_device *dev, struct request *rq,
+static void null_zone_fill_bio(struct nullb_device *dev, struct bio *bio,
-                              unsigned int zno, unsigned int nr_zones)
+                               unsigned int zno, unsigned int nr_zones)
 {
        struct blk_zone_report_hdr *hdr = NULL;
        struct bio_vec bvec;
@@ -57,7 +57,7 @@ static void null_zone_fill_rq(struct nullb_device *dev, struct request *rq,
        void *addr;
        unsigned int zones_to_cpy;
-        bio_for_each_segment(bvec, rq->bio, iter) {
+        bio_for_each_segment(bvec, bio, iter) {
                addr = kmap_atomic(bvec.bv_page);
                zones_to_cpy = bvec.bv_len / sizeof(struct blk_zone);
@@ -84,29 +84,24 @@ static void null_zone_fill_rq(struct nullb_device *dev, struct request *rq,
        }
 }
-blk_status_t null_zone_report(struct nullb *nullb,
+blk_status_t null_zone_report(struct nullb *nullb, struct bio *bio)
-                                     struct nullb_cmd *cmd)
 {
        struct nullb_device *dev = nullb->dev;
-        struct request *rq = cmd->rq;
+        unsigned int zno = null_zone_no(dev, bio->bi_iter.bi_sector);
-        unsigned int zno = null_zone_no(dev, blk_rq_pos(rq));
        unsigned int nr_zones = dev->nr_zones - zno;
-        unsigned int max_zones = (blk_rq_bytes(rq) /
+        unsigned int max_zones;
-                                        sizeof(struct blk_zone)) - 1;
+        max_zones = (bio->bi_iter.bi_size / sizeof(struct blk_zone)) - 1;
        nr_zones = min_t(unsigned int, nr_zones, max_zones);
+        null_zone_fill_bio(nullb->dev, bio, zno, nr_zones);
-        null_zone_fill_rq(nullb->dev, rq, zno, nr_zones);
        return BLK_STS_OK;
 }
-void null_zone_write(struct nullb_cmd *cmd)
+void null_zone_write(struct nullb_cmd *cmd, sector_t sector,
+                     unsigned int nr_sectors)
 {
        struct nullb_device *dev = cmd->nq->dev;
-        struct request *rq = cmd->rq;
-        sector_t sector = blk_rq_pos(rq);
-        unsigned int rq_sectors = blk_rq_sectors(rq);
        unsigned int zno = null_zone_no(dev, sector);
        struct blk_zone *zone = &dev->zones[zno];
@@ -118,7 +113,7 @@ void null_zone_write(struct nullb_cmd *cmd)
        case BLK_ZONE_COND_EMPTY:
        case BLK_ZONE_COND_IMP_OPEN:
                /* Writes must be at the write pointer position */
-                if (blk_rq_pos(rq) != zone->wp) {
+                if (sector != zone->wp) {
                        cmd->error = BLK_STS_IOERR;
                        break;
                }
@@ -126,7 +121,7 @@ void null_zone_write(struct nullb_cmd *cmd)
                if (zone->cond == BLK_ZONE_COND_EMPTY)
                        zone->cond = BLK_ZONE_COND_IMP_OPEN;
-                zone->wp += rq_sectors;
+                zone->wp += nr_sectors;
                if (zone->wp == zone->start + zone->len)
                        zone->cond = BLK_ZONE_COND_FULL;
                break;
@@ -137,11 +132,10 @@ void null_zone_write(struct nullb_cmd *cmd)
        }
 }
-void null_zone_reset(struct nullb_cmd *cmd)
+void null_zone_reset(struct nullb_cmd *cmd, sector_t sector)
 {
        struct nullb_device *dev = cmd->nq->dev;
-        struct request *rq = cmd->rq;
+        unsigned int zno = null_zone_no(dev, sector);
-        unsigned int zno = null_zone_no(dev, blk_rq_pos(rq));
        struct blk_zone *zone = &dev->zones[zno];
        zone->cond = BLK_ZONE_COND_EMPTY;
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 963bb0309e25..ea6238ed5c0e 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -543,6 +543,8 @@ static void hci_uart_tty_close(struct tty_struct *tty)
        }
        clear_bit(HCI_UART_PROTO_SET, &hu->flags);
+        percpu_free_rwsem(&hu->proto_lock);
        kfree(hu);
 }
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index a3397664f800..97d6856c9c0f 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -59,8 +59,6 @@ enum bt_states {
        BT_STATE_RESET3,
        BT_STATE_RESTART,
        BT_STATE_PRINTME,
-        BT_STATE_CAPABILITIES_BEGIN,
-        BT_STATE_CAPABILITIES_END,
        BT_STATE_LONG_BUSY      /* BT doesn't get hosed :-) */
 };
@@ -86,7 +84,6 @@ struct si_sm_data {
        int             error_retries;  /* end of "common" fields */
        int             nonzero_status; /* hung BMCs stay all 0 */
        enum bt_states  complete;       /* to divert the state machine */
-        int             BT_CAP_outreqs;
        long            BT_CAP_req2rsp;
        int             BT_CAP_retries; /* Recommended retries */
 };
@@ -137,8 +134,6 @@ static char *state2txt(unsigned char state)
        case BT_STATE_RESET3:           return("RESET3");
        case BT_STATE_RESTART:          return("RESTART");
        case BT_STATE_LONG_BUSY:        return("LONG_BUSY");
-        case BT_STATE_CAPABILITIES_BEGIN: return("CAP_BEGIN");
-        case BT_STATE_CAPABILITIES_END: return("CAP_END");
        }
        return("BAD STATE");
 }
@@ -185,7 +180,6 @@ static unsigned int bt_init_data(struct si_sm_data *bt, struct si_sm_io *io)
        bt->complete = BT_STATE_IDLE;   /* end here */
        bt->BT_CAP_req2rsp = BT_NORMAL_TIMEOUT * USEC_PER_SEC;
        bt->BT_CAP_retries = BT_NORMAL_RETRY_LIMIT;
-        /* BT_CAP_outreqs == zero is a flag to read BT Capabilities */
        return 3; /* We claim 3 bytes of space; ought to check SPMI table */
 }
@@ -451,7 +445,7 @@ static enum si_sm_result error_recovery(struct si_sm_data *bt,
 static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
 {
-        unsigned char status, BT_CAP[8];
+        unsigned char status;
        static enum bt_states last_printed = BT_STATE_PRINTME;
        int i;
@@ -504,12 +498,6 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
                if (status & BT_H_BUSY)         /* clear a leftover H_BUSY */
                        BT_CONTROL(BT_H_BUSY);
-                bt->timeout = bt->BT_CAP_req2rsp;
-                /* Read BT capabilities if it hasn't been done yet */
-                if (!bt->BT_CAP_outreqs)
-                        BT_STATE_CHANGE(BT_STATE_CAPABILITIES_BEGIN,
-                                        SI_SM_CALL_WITHOUT_DELAY);
                BT_SI_SM_RETURN(SI_SM_IDLE);
        case BT_STATE_XACTION_START:
@@ -614,37 +602,6 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
                BT_STATE_CHANGE(BT_STATE_XACTION_START,
                                SI_SM_CALL_WITH_DELAY);
-        /*
-         * Get BT Capabilities, using timing of upper level state machine.
-         * Set outreqs to prevent infinite loop on timeout.
-         */
-        case BT_STATE_CAPABILITIES_BEGIN:
-                bt->BT_CAP_outreqs = 1;
-                {
-                        unsigned char GetBT_CAP[] = { 0x18, 0x36 };
-                        bt->state = BT_STATE_IDLE;
-                        bt_start_transaction(bt, GetBT_CAP, sizeof(GetBT_CAP));
-                }
-                bt->complete = BT_STATE_CAPABILITIES_END;
-                BT_STATE_CHANGE(BT_STATE_XACTION_START,
-                                SI_SM_CALL_WITH_DELAY);
-        case BT_STATE_CAPABILITIES_END:
-                i = bt_get_result(bt, BT_CAP, sizeof(BT_CAP));
-                bt_init_data(bt, bt->io);
-                if ((i == 8) && !BT_CAP[2]) {
-                        bt->BT_CAP_outreqs = BT_CAP[3];
-                        bt->BT_CAP_req2rsp = BT_CAP[6] * USEC_PER_SEC;
-                        bt->BT_CAP_retries = BT_CAP[7];
-                } else
-                        printk(KERN_WARNING "IPMI BT: using default values\n");
-                if (!bt->BT_CAP_outreqs)
-                        bt->BT_CAP_outreqs = 1;
-                printk(KERN_WARNING "IPMI BT: req2rsp=%ld secs retries=%d\n",
-                        bt->BT_CAP_req2rsp / USEC_PER_SEC, bt->BT_CAP_retries);
-                bt->timeout = bt->BT_CAP_req2rsp;
-                return SI_SM_CALL_WITHOUT_DELAY;
        default:        /* should never occur */
                return error_recovery(bt,
                                      status,
@@ -655,6 +612,11 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time)
 static int bt_detect(struct si_sm_data *bt)
 {
+        unsigned char GetBT_CAP[] = { 0x18, 0x36 };
+        unsigned char BT_CAP[8];
+        enum si_sm_result smi_result;
+        int rv;
        /*
         * It's impossible for the BT status and interrupt registers to be
         * all 1's, (assuming a properly functioning, self-initialized BMC)
@@ -665,6 +627,48 @@ static int bt_detect(struct si_sm_data *bt)
        if ((BT_STATUS == 0xFF) && (BT_INTMASK_R == 0xFF))
                return 1;
        reset_flags(bt);
+        /*
+         * Try getting the BT capabilities here.
+         */
+        rv = bt_start_transaction(bt, GetBT_CAP, sizeof(GetBT_CAP));
+        if (rv) {
+                dev_warn(bt->io->dev,
+                         "Can't start capabilities transaction: %d\n", rv);
+                goto out_no_bt_cap;
+        }
+        smi_result = SI_SM_CALL_WITHOUT_DELAY;
+        for (;;) {
+                if (smi_result == SI_SM_CALL_WITH_DELAY ||
+                    smi_result == SI_SM_CALL_WITH_TICK_DELAY) {
+                        schedule_timeout_uninterruptible(1);
+                        smi_result = bt_event(bt, jiffies_to_usecs(1));
+                } else if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
+                        smi_result = bt_event(bt, 0);
+                } else
+                        break;
+        }
+        rv = bt_get_result(bt, BT_CAP, sizeof(BT_CAP));
+        bt_init_data(bt, bt->io);
+        if (rv < 8) {
+                dev_warn(bt->io->dev, "bt cap response too short: %d\n", rv);
+                goto out_no_bt_cap;
+        }
+        if (BT_CAP[2]) {
+                dev_warn(bt->io->dev, "Error fetching bt cap: %x\n", BT_CAP[2]);
+out_no_bt_cap:
+                dev_warn(bt->io->dev, "using default values\n");
+        } else {
+                bt->BT_CAP_req2rsp = BT_CAP[6] * USEC_PER_SEC;
+                bt->BT_CAP_retries = BT_CAP[7];
+        }
+        dev_info(bt->io->dev, "req2rsp=%ld secs retries=%d\n",
+                 bt->BT_CAP_req2rsp / USEC_PER_SEC, bt->BT_CAP_retries);
        return 0;
 }
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 51832b8a2c62..7fc9612070a1 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3381,39 +3381,45 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
        rv = handlers->start_processing(send_info, intf);
        if (rv)
-                goto out;
+                goto out_err;
        rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i);
        if (rv) {
                dev_err(si_dev, "Unable to get the device id: %d\n", rv);
-                goto out;
+                goto out_err_started;
        }
        mutex_lock(&intf->bmc_reg_mutex);
        rv = __scan_channels(intf, &id);
        mutex_unlock(&intf->bmc_reg_mutex);
+        if (rv)
+                goto out_err_bmc_reg;
- out:
+        /*
-        if (rv) {
+         * Keep memory order straight for RCU readers.  Make
-                ipmi_bmc_unregister(intf);
+         * sure everything else is committed to memory before
-                list_del_rcu(&intf->link);
+         * setting intf_num to mark the interface valid.
-                mutex_unlock(&ipmi_interfaces_mutex);
+         */
-                synchronize_srcu(&ipmi_interfaces_srcu);
+        smp_wmb();
-                cleanup_srcu_struct(&intf->users_srcu);
+        intf->intf_num = i;
-                kref_put(&intf->refcount, intf_free);
+        mutex_unlock(&ipmi_interfaces_mutex);
-        } else {
-                /*
-                 * Keep memory order straight for RCU readers.  Make
-                 * sure everything else is committed to memory before
-                 * setting intf_num to mark the interface valid.
-                 */
-                smp_wmb();
-                intf->intf_num = i;
-                mutex_unlock(&ipmi_interfaces_mutex);
-                /* After this point the interface is legal to use. */
+        /* After this point the interface is legal to use. */
-                call_smi_watchers(i, intf->si_dev);
+        call_smi_watchers(i, intf->si_dev);
-        }
+        return 0;
+ out_err_bmc_reg:
+        ipmi_bmc_unregister(intf);
+ out_err_started:
+        if (intf->handlers->shutdown)
+                intf->handlers->shutdown(intf->send_info);
+ out_err:
+        list_del_rcu(&intf->link);
+        mutex_unlock(&ipmi_interfaces_mutex);
+        synchronize_srcu(&ipmi_interfaces_srcu);
+        cleanup_srcu_struct(&intf->users_srcu);
+        kref_put(&intf->refcount, intf_free);
        return rv;
 }
@@ -3504,7 +3510,8 @@ void ipmi_unregister_smi(struct ipmi_smi *intf)
        }
        srcu_read_unlock(&intf->users_srcu, index);
-        intf->handlers->shutdown(intf->send_info);
+        if (intf->handlers->shutdown)
+                intf->handlers->shutdown(intf->send_info);
        cleanup_smi_msgs(intf);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 90ec010bffbd..5faa917df1b6 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2083,18 +2083,9 @@ static int try_smi_init(struct smi_info *new_smi)
                 si_to_str[new_smi->io.si_type]);
        WARN_ON(new_smi->io.dev->init_name != NULL);
-        kfree(init_name);
-        return 0;
-out_err:
-        if (new_smi->intf) {
-                ipmi_unregister_smi(new_smi->intf);
-                new_smi->intf = NULL;
-        }
+ out_err:
        kfree(init_name);
        return rv;
 }
@@ -2227,6 +2218,8 @@ static void shutdown_smi(void *send_info)
        kfree(smi_info->si_sm);
        smi_info->si_sm = NULL;
+        smi_info->intf = NULL;
 }
 /*
@@ -2240,10 +2233,8 @@ static void cleanup_one_si(struct smi_info *smi_info)
        list_del(&smi_info->link);
-        if (smi_info->intf) {
+        if (smi_info->intf)
                ipmi_unregister_smi(smi_info->intf);
-                smi_info->intf = NULL;
-        }
        if (smi_info->pdev) {
                if (smi_info->pdev_registered)
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index 18e4650c233b..29e67a80fb20 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -181,6 +181,8 @@ struct ssif_addr_info {
        struct device *dev;
        struct i2c_client *client;
+        struct i2c_client *added_client;
        struct mutex clients_mutex;
        struct list_head clients;
@@ -1214,18 +1216,11 @@ static void shutdown_ssif(void *send_info)
                complete(&ssif_info->wake_thread);
                kthread_stop(ssif_info->thread);
        }
-        /*
-         * No message can be outstanding now, we have removed the
-         * upper layer and it permitted us to do so.
-         */
-        kfree(ssif_info);
 }
 static int ssif_remove(struct i2c_client *client)
 {
        struct ssif_info *ssif_info = i2c_get_clientdata(client);
-        struct ipmi_smi *intf;
        struct ssif_addr_info *addr_info;
        if (!ssif_info)
@@ -1235,9 +1230,7 @@ static int ssif_remove(struct i2c_client *client)
         * After this point, we won't deliver anything asychronously
         * to the message handler.  We can unregister ourself.
         */
-        intf = ssif_info->intf;
+        ipmi_unregister_smi(ssif_info->intf);
-        ssif_info->intf = NULL;
-        ipmi_unregister_smi(intf);
        list_for_each_entry(addr_info, &ssif_infos, link) {
                if (addr_info->client == client) {
@@ -1246,6 +1239,8 @@ static int ssif_remove(struct i2c_client *client)
                }
        }
+        kfree(ssif_info);
        return 0;
 }
@@ -1648,15 +1643,9 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
 out:
        if (rv) {
-                /*
+                if (addr_info)
-                 * Note that if addr_info->client is assigned, we
+                        addr_info->client = NULL;
-                 * leave it.  The i2c client hangs around even if we
-                 * return a failure here, and the failure here is not
-                 * propagated back to the i2c code.  This seems to be
-                 * design intent, strange as it may be.  But if we
-                 * don't leave it, ssif_platform_remove will not remove
-                 * the client like it should.
-                 */
                dev_err(&client->dev, "Unable to start IPMI SSIF: %d\n", rv);
                kfree(ssif_info);
        }
@@ -1676,7 +1665,8 @@ static int ssif_adapter_handler(struct device *adev, void *opaque)
        if (adev->type != &i2c_adapter_type)
                return 0;
-        i2c_new_device(to_i2c_adapter(adev), &addr_info->binfo);
+        addr_info->added_client = i2c_new_device(to_i2c_adapter(adev),
+                                                 &addr_info->binfo);
        if (!addr_info->adapter_name)
                return 1; /* Only try the first I2C adapter by default. */
@@ -1849,7 +1839,7 @@ static int ssif_platform_remove(struct platform_device *dev)
                return 0;
        mutex_lock(&ssif_infos_mutex);
-        i2c_unregister_device(addr_info->client);
+        i2c_unregister_device(addr_info->added_client);
        list_del(&addr_info->link);
        kfree(addr_info);
diff --git a/drivers/char/ipmi/kcs_bmc.c b/drivers/char/ipmi/kcs_bmc.c
index bb882ab161fe..e6124bd548df 100644
--- a/drivers/char/ipmi/kcs_bmc.c
+++ b/drivers/char/ipmi/kcs_bmc.c
@@ -16,6 +16,8 @@
 #include "kcs_bmc.h"
+#define DEVICE_NAME "ipmi-kcs"
 #define KCS_MSG_BUFSIZ    1000
 #define KCS_ZERO_DATA     0
@@ -429,8 +431,6 @@ struct kcs_bmc *kcs_bmc_alloc(struct device *dev, int sizeof_priv, u32 channel)
        if (!kcs_bmc)
                return NULL;
-        dev_set_name(dev, "ipmi-kcs%u", channel);
        spin_lock_init(&kcs_bmc->lock);
        kcs_bmc->channel = channel;
@@ -444,7 +444,8 @@ struct kcs_bmc *kcs_bmc_alloc(struct device *dev, int sizeof_priv, u32 channel)
                return NULL;
        kcs_bmc->miscdev.minor = MISC_DYNAMIC_MINOR;
-        kcs_bmc->miscdev.name = dev_name(dev);
+        kcs_bmc->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "%s%u",
+                                               DEVICE_NAME, channel);
        kcs_bmc->miscdev.fops = &kcs_bmc_fops;
        return kcs_bmc;
diff --git a/drivers/clk/x86/clk-pmc-atom.c b/drivers/clk/x86/clk-pmc-atom.c
index 08ef69945ffb..d977193842df 100644
--- a/drivers/clk/x86/clk-pmc-atom.c
+++ b/drivers/clk/x86/clk-pmc-atom.c
@@ -55,6 +55,7 @@ struct clk_plt_data {
        u8 nparents;
        struct clk_plt *clks[PMC_CLK_NUM];
        struct clk_lookup *mclk_lookup;
+        struct clk_lookup *ether_clk_lookup;
 };
 /* Return an index in parent table */
@@ -186,13 +187,6 @@ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
        pclk->reg = base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
        spin_lock_init(&pclk->lock);
-        /*
-         * If the clock was already enabled by the firmware mark it as critical
-         * to avoid it being gated by the clock framework if no driver owns it.
-         */
-        if (plt_clk_is_enabled(&pclk->hw))
-                init.flags |= CLK_IS_CRITICAL;
        ret = devm_clk_hw_register(&pdev->dev, &pclk->hw);
        if (ret) {
                pclk = ERR_PTR(ret);
@@ -351,11 +345,20 @@ static int plt_clk_probe(struct platform_device *pdev)
                goto err_unreg_clk_plt;
        }
+        data->ether_clk_lookup = clkdev_hw_create(&data->clks[4]->hw,
+                                                  "ether_clk", NULL);
+        if (!data->ether_clk_lookup) {
+                err = -ENOMEM;
+                goto err_drop_mclk;
+        }
        plt_clk_free_parent_names_loop(parent_names, data->nparents);
        platform_set_drvdata(pdev, data);
        return 0;
+err_drop_mclk:
+        clkdev_drop(data->mclk_lookup);
 err_unreg_clk_plt:
        plt_clk_unregister_loop(data, i);
        plt_clk_unregister_parents(data);
@@ -369,6 +372,7 @@ static int plt_clk_remove(struct platform_device *pdev)
        data = platform_get_drvdata(pdev);
+        clkdev_drop(data->ether_clk_lookup);
        clkdev_drop(data->mclk_lookup);
        plt_clk_unregister_loop(data, PMC_CLK_NUM);
        plt_clk_unregister_parents(data);
diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c
index 218739b961fe..72790d88236d 100644
--- a/drivers/crypto/ccp/psp-dev.c
+++ b/drivers/crypto/ccp/psp-dev.c
@@ -38,6 +38,17 @@ static DEFINE_MUTEX(sev_cmd_mutex);
 static struct sev_misc_dev *misc_dev;
 static struct psp_device *psp_master;
+static int psp_cmd_timeout = 100;
+module_param(psp_cmd_timeout, int, 0644);
+MODULE_PARM_DESC(psp_cmd_timeout, " default timeout value, in seconds, for PSP commands");
+static int psp_probe_timeout = 5;
+module_param(psp_probe_timeout, int, 0644);
+MODULE_PARM_DESC(psp_probe_timeout, " default timeout value, in seconds, during PSP device probe");
+static bool psp_dead;
+static int psp_timeout;
 static struct psp_device *psp_alloc_struct(struct sp_device *sp)
 {
        struct device *dev = sp->dev;
@@ -82,10 +93,19 @@ done:
        return IRQ_HANDLED;
 }
-static void sev_wait_cmd_ioc(struct psp_device *psp, unsigned int *reg)
+static int sev_wait_cmd_ioc(struct psp_device *psp,
+                            unsigned int *reg, unsigned int timeout)
 {
-        wait_event(psp->sev_int_queue, psp->sev_int_rcvd);
+        int ret;
+        ret = wait_event_timeout(psp->sev_int_queue,
+                        psp->sev_int_rcvd, timeout * HZ);
+        if (!ret)
+                return -ETIMEDOUT;
        *reg = ioread32(psp->io_regs + psp->vdata->cmdresp_reg);
+        return 0;
 }
 static int sev_cmd_buffer_len(int cmd)
@@ -133,12 +153,15 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret)
        if (!psp)
                return -ENODEV;
+        if (psp_dead)
+                return -EBUSY;
        /* Get the physical address of the command buffer */
        phys_lsb = data ? lower_32_bits(__psp_pa(data)) : 0;
        phys_msb = data ? upper_32_bits(__psp_pa(data)) : 0;
-        dev_dbg(psp->dev, "sev command id %#x buffer 0x%08x%08x\n",
+        dev_dbg(psp->dev, "sev command id %#x buffer 0x%08x%08x timeout %us\n",
-                cmd, phys_msb, phys_lsb);
+                cmd, phys_msb, phys_lsb, psp_timeout);
        print_hex_dump_debug("(in):  ", DUMP_PREFIX_OFFSET, 16, 2, data,
                             sev_cmd_buffer_len(cmd), false);
@@ -154,7 +177,18 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret)
        iowrite32(reg, psp->io_regs + psp->vdata->cmdresp_reg);
        /* wait for command completion */
-        sev_wait_cmd_ioc(psp, &reg);
+        ret = sev_wait_cmd_ioc(psp, &reg, psp_timeout);
+        if (ret) {
+                if (psp_ret)
+                        *psp_ret = 0;
+                dev_err(psp->dev, "sev command %#x timed out, disabling PSP \n", cmd);
+                psp_dead = true;
+                return ret;
+        }
+        psp_timeout = psp_cmd_timeout;
        if (psp_ret)
                *psp_ret = reg & PSP_CMDRESP_ERR_MASK;
@@ -888,6 +922,8 @@ void psp_pci_init(void)
        psp_master = sp->psp_data;
+        psp_timeout = psp_probe_timeout;
        if (sev_get_api_version())
                goto err;
diff --git a/drivers/dma/mic_x100_dma.c b/drivers/dma/mic_x100_dma.c
index b76cb17d879c..adfd316db1a8 100644
--- a/drivers/dma/mic_x100_dma.c
+++ b/drivers/dma/mic_x100_dma.c
@@ -639,7 +639,7 @@ static struct mic_dma_device *mic_dma_dev_reg(struct mbus_device *mbdev,
        int ret;
        struct device *dev = &mbdev->dev;
-        mic_dma_dev = kzalloc(sizeof(*mic_dma_dev), GFP_KERNEL);
+        mic_dma_dev = devm_kzalloc(dev, sizeof(*mic_dma_dev), GFP_KERNEL);
        if (!mic_dma_dev) {
                ret = -ENOMEM;
                goto alloc_error;
@@ -664,7 +664,6 @@ static struct mic_dma_device *mic_dma_dev_reg(struct mbus_device *mbdev,
 reg_error:
        mic_dma_uninit(mic_dma_dev);
 init_error:
-        kfree(mic_dma_dev);
        mic_dma_dev = NULL;
 alloc_error:
        dev_err(dev, "Error at %s %d ret=%d\n", __func__, __LINE__, ret);
@@ -674,7 +673,6 @@ alloc_error:
 static void mic_dma_dev_unreg(struct mic_dma_device *mic_dma_dev)
 {
        mic_dma_uninit(mic_dma_dev);
-        kfree(mic_dma_dev);
 }
 /* DEBUGFS CODE */
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index d8e159feb573..89110dfc7127 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -90,14 +90,17 @@ config EFI_ARMSTUB
 config EFI_ARMSTUB_DTB_LOADER
        bool "Enable the DTB loader"
        depends on EFI_ARMSTUB
+        default y
        help
          Select this config option to add support for the dtb= command
          line parameter, allowing a device tree blob to be loaded into
          memory from the EFI System Partition by the stub.
-          The device tree is typically provided by the platform or by
+          If the device tree is provided by the platform or by
-          the bootloader, so this option is mostly for development
+          the bootloader this option may not be needed.
-          purposes only.
+          But, for various development reasons and to maintain existing
+          functionality for bootloaders that do not have such support
+          this option is necessary.
 config EFI_BOOTLOADER_CONTROL
        tristate "EFI Bootloader Control"
diff --git a/drivers/fpga/dfl-fme-pr.c b/drivers/fpga/dfl-fme-pr.c
index fc9fd2d0482f..0b840531ef33 100644
--- a/drivers/fpga/dfl-fme-pr.c
+++ b/drivers/fpga/dfl-fme-pr.c
@@ -420,7 +420,7 @@ static int pr_mgmt_init(struct platform_device *pdev,
                /* Create region for each port */
                fme_region = dfl_fme_create_region(pdata, mgr,
                                                   fme_br->br, i);
-                if (!fme_region) {
+                if (IS_ERR(fme_region)) {
                        ret = PTR_ERR(fme_region);
                        goto destroy_region;
                }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
index f8bbbb3a9504..0c791e35acf0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -272,7 +272,7 @@ void amdgpu_amdkfd_gpu_reset(struct kgd_dev *kgd)
 int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
                        void **mem_obj, uint64_t *gpu_addr,
-                        void **cpu_ptr)
+                        void **cpu_ptr, bool mqd_gfx9)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
        struct amdgpu_bo *bo = NULL;
@@ -287,6 +287,10 @@ int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
        bp.flags = AMDGPU_GEM_CREATE_CPU_GTT_USWC;
        bp.type = ttm_bo_type_kernel;
        bp.resv = NULL;
+        if (mqd_gfx9)
+                bp.flags |= AMDGPU_GEM_CREATE_MQD_GFX9;
        r = amdgpu_bo_create(adev, &bp, &bo);
        if (r) {
                dev_err(adev->dev,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
index 2f379c183ed2..cc9aeab5468c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -136,7 +136,7 @@ void amdgpu_amdkfd_gpu_reset(struct kgd_dev *kgd);
 /* Shared API */
 int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
                        void **mem_obj, uint64_t *gpu_addr,
-                        void **cpu_ptr);
+                        void **cpu_ptr, bool mqd_gfx9);
 void free_gtt_mem(struct kgd_dev *kgd, void *mem_obj);
 void get_local_mem_info(struct kgd_dev *kgd,
                        struct kfd_local_mem_info *mem_info);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
index ea3f698aef5e..9803b91f3e77 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c
@@ -685,7 +685,7 @@ static int kgd_hqd_sdma_destroy(struct kgd_dev *kgd, void *mqd,
        while (true) {
                temp = RREG32(sdma_base_addr + mmSDMA0_RLC0_CONTEXT_STATUS);
-                if (temp & SDMA0_STATUS_REG__RB_CMD_IDLE__SHIFT)
+                if (temp & SDMA0_RLC0_CONTEXT_STATUS__IDLE_MASK)
                        break;
                if (time_after(jiffies, end_jiffies))
                        return -ETIME;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index 693ec5ea4950..8816c697b205 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -367,12 +367,14 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                                break;
                        case CHIP_POLARIS10:
                                if (type == CGS_UCODE_ID_SMU) {
-                                        if ((adev->pdev->device == 0x67df) &&
+                                        if (((adev->pdev->device == 0x67df) &&
-                                            ((adev->pdev->revision == 0xe0) ||
+                                             ((adev->pdev->revision == 0xe0) ||
-                                             (adev->pdev->revision == 0xe3) ||
+                                              (adev->pdev->revision == 0xe3) ||
-                                             (adev->pdev->revision == 0xe4) ||
+                                              (adev->pdev->revision == 0xe4) ||
-                                             (adev->pdev->revision == 0xe5) ||
+                                              (adev->pdev->revision == 0xe5) ||
-                                             (adev->pdev->revision == 0xe7) ||
+                                              (adev->pdev->revision == 0xe7) ||
+                                              (adev->pdev->revision == 0xef))) ||
+                                            ((adev->pdev->device == 0x6fdf) &&
                                             (adev->pdev->revision == 0xef))) {
                                                info->is_kicker = true;
                                                strcpy(fw_name, "amdgpu/polaris10_k_smc.bin");
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index b6e9df11115d..b31d121a876b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -39,6 +39,7 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
 {
        struct drm_gem_object *gobj;
        unsigned long size;
+        int r;
        gobj = drm_gem_object_lookup(p->filp, data->handle);
        if (gobj == NULL)
@@ -50,20 +51,26 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
        p->uf_entry.tv.shared = true;
        p->uf_entry.user_pages = NULL;
-        size = amdgpu_bo_size(p->uf_entry.robj);
-        if (size != PAGE_SIZE || (data->offset + 8) > size)
-                return -EINVAL;
-        *offset = data->offset;
        drm_gem_object_put_unlocked(gobj);
+        size = amdgpu_bo_size(p->uf_entry.robj);
+        if (size != PAGE_SIZE || (data->offset + 8) > size) {
+                r = -EINVAL;
+                goto error_unref;
+        }
        if (amdgpu_ttm_tt_get_usermm(p->uf_entry.robj->tbo.ttm)) {
-                amdgpu_bo_unref(&p->uf_entry.robj);
+                r = -EINVAL;
-                return -EINVAL;
+                goto error_unref;
        }
+        *offset = data->offset;
        return 0;
+error_unref:
+        amdgpu_bo_unref(&p->uf_entry.robj);
+        return r;
 }
 static int amdgpu_cs_bo_handles_chunk(struct amdgpu_cs_parser *p,
@@ -1262,10 +1269,10 @@ static int amdgpu_cs_submit(struct amdgpu_cs_parser *p,
 error_abort:
        dma_fence_put(&job->base.s_fence->finished);
        job->base.s_fence = NULL;
+        amdgpu_mn_unlock(p->mn);
 error_unlock:
        amdgpu_job_free(job);
-        amdgpu_mn_unlock(p->mn);
        return r;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 8ab5ccbc14ac..39bf2ce548c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2063,6 +2063,7 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev)
        static enum amd_ip_block_type ip_order[] = {
                AMD_IP_BLOCK_TYPE_GMC,
                AMD_IP_BLOCK_TYPE_COMMON,
+                AMD_IP_BLOCK_TYPE_PSP,
                AMD_IP_BLOCK_TYPE_IH,
        };
@@ -2093,7 +2094,6 @@ static int amdgpu_device_ip_reinit_late_sriov(struct amdgpu_device *adev)
        static enum amd_ip_block_type ip_order[] = {
                AMD_IP_BLOCK_TYPE_SMC,
-                AMD_IP_BLOCK_TYPE_PSP,
                AMD_IP_BLOCK_TYPE_DCE,
                AMD_IP_BLOCK_TYPE_GFX,
                AMD_IP_BLOCK_TYPE_SDMA,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 8843a06360fa..0f41d8647376 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -740,6 +740,7 @@ static const struct pci_device_id pciidlist[] = {
        {0x1002, 0x67CA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
        {0x1002, 0x67CC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
        {0x1002, 0x67CF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
+        {0x1002, 0x6FDF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
        /* Polaris12 */
        {0x1002, 0x6980, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
        {0x1002, 0x6981, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
index e7ca4623cfb9..7c3b634d8d5f 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
@@ -70,6 +70,7 @@ static const struct soc15_reg_golden golden_settings_sdma_4[] = {
        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_IB_CNTL, 0x800f0100, 0x00000100),
        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0x0000fff0, 0x00403000),
        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0),
+        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x00000000),
        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CHICKEN_BITS, 0xfe931f07, 0x02831f07),
        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CLK_CTRL, 0xffffffff, 0x3f000100),
        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GFX_IB_CNTL, 0x800f0100, 0x00000100),
@@ -81,7 +82,8 @@ static const struct soc15_reg_golden golden_settings_sdma_4[] = {
        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_RLC0_RB_WPTR_POLL_CNTL, 0x0000fff0, 0x00403000),
        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_RLC1_IB_CNTL, 0x800f0100, 0x00000100),
        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_RLC1_RB_WPTR_POLL_CNTL, 0x0000fff0, 0x00403000),
-        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_UTCL1_PAGE, 0x000003ff, 0x000003c0)
+        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_UTCL1_PAGE, 0x000003ff, 0x000003c0),
+        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_UTCL1_WATERMK, 0xfc000000, 0x00000000)
 };
 static const struct soc15_reg_golden golden_settings_sdma_vg10[] = {
@@ -109,7 +111,8 @@ static const struct soc15_reg_golden golden_settings_sdma_4_1[] =
        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC0_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000),
        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_IB_CNTL, 0x800f0111, 0x00000100),
        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000),
-        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0)
+        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0),
+        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x00000000)
 };
 static const struct soc15_reg_golden golden_settings_sdma_4_2[] =
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index 1b048715ab8a..29ac74f40dce 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -457,7 +457,8 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd,
        if (kfd->kfd2kgd->init_gtt_mem_allocation(
                        kfd->kgd, size, &kfd->gtt_mem,
-                        &kfd->gtt_start_gpu_addr, &kfd->gtt_start_cpu_ptr)){
+                        &kfd->gtt_start_gpu_addr, &kfd->gtt_start_cpu_ptr,
+                        false)) {
                dev_err(kfd_device, "Could not allocate %d bytes\n", size);
                goto out;
        }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
index 7a61f38c09e6..01494752c36a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
@@ -62,9 +62,20 @@ int kfd_iommu_device_init(struct kfd_dev *kfd)
        struct amd_iommu_device_info iommu_info;
        unsigned int pasid_limit;
        int err;
+        struct kfd_topology_device *top_dev;
-        if (!kfd->device_info->needs_iommu_device)
+        top_dev = kfd_topology_device_by_id(kfd->id);
+        /*
+         * Overwrite ATS capability according to needs_iommu_device to fix
+         * potential missing corresponding bit in CRAT of BIOS.
+         */
+        if (!kfd->device_info->needs_iommu_device) {
+                top_dev->node_props.capability &= ~HSA_CAP_ATS_PRESENT;
                return 0;
+        }
+        top_dev->node_props.capability |= HSA_CAP_ATS_PRESENT;
        iommu_info.flags = 0;
        err = amd_iommu_device_info(kfd->pdev, &iommu_info);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
index f5fc3675f21e..0cedb37cf513 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
@@ -88,7 +88,7 @@ static int init_mqd(struct mqd_manager *mm, void **mqd,
                                ALIGN(sizeof(struct v9_mqd), PAGE_SIZE),
                        &((*mqd_mem_obj)->gtt_mem),
                        &((*mqd_mem_obj)->gpu_addr),
-                        (void *)&((*mqd_mem_obj)->cpu_ptr));
+                        (void *)&((*mqd_mem_obj)->cpu_ptr), true);
        } else
                retval = kfd_gtt_sa_allocate(mm->dev, sizeof(struct v9_mqd),
                                mqd_mem_obj);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index f971710f1c91..92b285ca73aa 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -806,6 +806,7 @@ int kfd_topology_add_device(struct kfd_dev *gpu);
 int kfd_topology_remove_device(struct kfd_dev *gpu);
 struct kfd_topology_device *kfd_topology_device_by_proximity_domain(
                                                uint32_t proximity_domain);
+struct kfd_topology_device *kfd_topology_device_by_id(uint32_t gpu_id);
 struct kfd_dev *kfd_device_by_id(uint32_t gpu_id);
 struct kfd_dev *kfd_device_by_pci_dev(const struct pci_dev *pdev);
 int kfd_topology_enum_kfd_devices(uint8_t idx, struct kfd_dev **kdev);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index bc95d4dfee2e..80f5db4ef75f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -63,22 +63,33 @@ struct kfd_topology_device *kfd_topology_device_by_proximity_domain(
        return device;
 }
-struct kfd_dev *kfd_device_by_id(uint32_t gpu_id)
+struct kfd_topology_device *kfd_topology_device_by_id(uint32_t gpu_id)
 {
-        struct kfd_topology_device *top_dev;
+        struct kfd_topology_device *top_dev = NULL;
-        struct kfd_dev *device = NULL;
+        struct kfd_topology_device *ret = NULL;
        down_read(&topology_lock);
        list_for_each_entry(top_dev, &topology_device_list, list)
                if (top_dev->gpu_id == gpu_id) {
-                        device = top_dev->gpu;
+                        ret = top_dev;
                        break;
                }
        up_read(&topology_lock);
-        return device;
+        return ret;
+}
+struct kfd_dev *kfd_device_by_id(uint32_t gpu_id)
+{
+        struct kfd_topology_device *top_dev;
+        top_dev = kfd_topology_device_by_id(gpu_id);
+        if (!top_dev)
+                return NULL;
+        return top_dev->gpu;
 }
 struct kfd_dev *kfd_device_by_pci_dev(const struct pci_dev *pdev)
diff --git a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
index 14391b06080c..43b82e14007e 100644
--- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
@@ -292,7 +292,7 @@ struct tile_config {
 struct kfd2kgd_calls {
        int (*init_gtt_mem_allocation)(struct kgd_dev *kgd, size_t size,
                                        void **mem_obj, uint64_t *gpu_addr,
-                                        void **cpu_ptr);
+                                        void **cpu_ptr, bool mqd_gfx9);
        void (*free_gtt_mem)(struct kgd_dev *kgd, void *mem_obj);
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 3eb061e11e2e..018fcdb353d2 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -2067,7 +2067,7 @@ static void __drm_state_dump(struct drm_device *dev, struct drm_printer *p,
        struct drm_connector *connector;
        struct drm_connector_list_iter conn_iter;
-        if (!drm_core_check_feature(dev, DRIVER_ATOMIC))
+        if (!drm_drv_uses_atomic_modeset(dev))
                return;
        list_for_each_entry(plane, &config->plane_list, head) {
diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index 6f28fe58f169..373bd4c2b698 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -151,7 +151,7 @@ int drm_debugfs_init(struct drm_minor *minor, int minor_id,
                return ret;
        }
-        if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
+        if (drm_drv_uses_atomic_modeset(dev)) {
                ret = drm_atomic_debugfs_init(minor);
                if (ret) {
                        DRM_ERROR("Failed to create atomic debugfs files\n");
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 4b0dd20bccb8..16ec93b75dbf 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -2370,7 +2370,6 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
 {
        int c, o;
        struct drm_connector *connector;
-        const struct drm_connector_helper_funcs *connector_funcs;
        int my_score, best_score, score;
        struct drm_fb_helper_crtc **crtcs, *crtc;
        struct drm_fb_helper_connector *fb_helper_conn;
@@ -2399,8 +2398,6 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
        if (drm_has_preferred_mode(fb_helper_conn, width, height))
                my_score++;
-        connector_funcs = connector->helper_private;
        /*
         * select a crtc for this connector and then attempt to configure
         * remaining connectors
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 72afa518edd9..94c1089ecf59 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -3210,6 +3210,7 @@ static int init_bxt_mmio_info(struct intel_gvt *gvt)
        MMIO_D(BXT_DSI_PLL_ENABLE, D_BXT);
        MMIO_D(GEN9_CLKGATE_DIS_0, D_BXT);
+        MMIO_D(GEN9_CLKGATE_DIS_4, D_BXT);
        MMIO_D(HSW_TVIDEO_DIP_GCP(TRANSCODER_A), D_BXT);
        MMIO_D(HSW_TVIDEO_DIP_GCP(TRANSCODER_B), D_BXT);
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index a45f46d8537f..9ad89e38f6c0 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -32,6 +32,7 @@
 #include <linux/device.h>
 #include <linux/mm.h>
 #include <linux/mmu_context.h>
+#include <linux/sched/mm.h>
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/rbtree.h>
@@ -1792,16 +1793,21 @@ static int kvmgt_rw_gpa(unsigned long handle, unsigned long gpa,
        info = (struct kvmgt_guest_info *)handle;
        kvm = info->kvm;
-        if (kthread)
+        if (kthread) {
+                if (!mmget_not_zero(kvm->mm))
+                        return -EFAULT;
                use_mm(kvm->mm);
+        }
        idx = srcu_read_lock(&kvm->srcu);
        ret = write ? kvm_write_guest(kvm, gpa, buf, len) :
                      kvm_read_guest(kvm, gpa, buf, len);
        srcu_read_unlock(&kvm->srcu, idx);
-        if (kthread)
+        if (kthread) {
                unuse_mm(kvm->mm);
+                mmput(kvm->mm);
+        }
        return ret;
 }
@@ -1827,6 +1833,8 @@ static bool kvmgt_is_valid_gfn(unsigned long handle, unsigned long gfn)
 {
        struct kvmgt_guest_info *info;
        struct kvm *kvm;
+        int idx;
+        bool ret;
        if (!handle_valid(handle))
                return false;
@@ -1834,8 +1842,11 @@ static bool kvmgt_is_valid_gfn(unsigned long handle, unsigned long gfn)
        info = (struct kvmgt_guest_info *)handle;
        kvm = info->kvm;
-        return kvm_is_visible_gfn(kvm, gfn);
+        idx = srcu_read_lock(&kvm->srcu);
+        ret = kvm_is_visible_gfn(kvm, gfn);
+        srcu_read_unlock(&kvm->srcu, idx);
+        return ret;
 }
 struct intel_gvt_mpt kvmgt_mpt = {
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index 994366035364..9bb9a85c992c 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -244,6 +244,34 @@ void intel_vgpu_reset_mmio(struct intel_vgpu *vgpu, bool dmlr)
                /* set the bit 0:2(Core C-State ) to C0 */
                vgpu_vreg_t(vgpu, GEN6_GT_CORE_STATUS) = 0;
+                if (IS_BROXTON(vgpu->gvt->dev_priv)) {
+                        vgpu_vreg_t(vgpu, BXT_P_CR_GT_DISP_PWRON) &=
+                                    ~(BIT(0) | BIT(1));
+                        vgpu_vreg_t(vgpu, BXT_PORT_CL1CM_DW0(DPIO_PHY0)) &=
+                                    ~PHY_POWER_GOOD;
+                        vgpu_vreg_t(vgpu, BXT_PORT_CL1CM_DW0(DPIO_PHY1)) &=
+                                    ~PHY_POWER_GOOD;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL_FAMILY(DPIO_PHY0)) &=
+                                    ~BIT(30);
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL_FAMILY(DPIO_PHY1)) &=
+                                    ~BIT(30);
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_A)) &=
+                                    ~BXT_PHY_LANE_ENABLED;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_A)) |=
+                                    BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                                    BXT_PHY_LANE_POWERDOWN_ACK;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_B)) &=
+                                    ~BXT_PHY_LANE_ENABLED;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_B)) |=
+                                    BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                                    BXT_PHY_LANE_POWERDOWN_ACK;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_C)) &=
+                                    ~BXT_PHY_LANE_ENABLED;
+                        vgpu_vreg_t(vgpu, BXT_PHY_CTL(PORT_C)) |=
+                                    BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                                    BXT_PHY_LANE_POWERDOWN_ACK;
+                }
        } else {
 #define GVT_GEN8_MMIO_RESET_OFFSET              (0x44200)
                /* only reset the engine related, so starting with 0x44200
diff --git a/drivers/gpu/drm/i915/gvt/opregion.c b/drivers/gpu/drm/i915/gvt/opregion.c
index fa75a2eead90..b0d3a43ccd03 100644
--- a/drivers/gpu/drm/i915/gvt/opregion.c
+++ b/drivers/gpu/drm/i915/gvt/opregion.c
@@ -42,8 +42,6 @@
 #define DEVICE_TYPE_EFP3   0x20
 #define DEVICE_TYPE_EFP4   0x10
-#define DEV_SIZE        38
 struct opregion_header {
        u8 signature[16];
        u32 size;
@@ -63,6 +61,10 @@ struct bdb_data_header {
        u16 size; /* data size */
 } __packed;
+/* For supporting windows guest with opregion, here hardcode the emulated
+ * bdb header version as '186', and the corresponding child_device_config
+ * length should be '33' but not '38'.
+ */
 struct efp_child_device_config {
        u16 handle;
        u16 device_type;
@@ -109,12 +111,6 @@ struct efp_child_device_config {
        u8 mipi_bridge_type; /* 171 */
        u16 device_class_ext;
        u8 dvo_function;
-        u8 dp_usb_type_c:1; /* 195 */
-        u8 skip6:7;
-        u8 dp_usb_type_c_2x_gpio_index; /* 195 */
-        u16 dp_usb_type_c_2x_gpio_pin; /* 195 */
-        u8 iboost_dp:4; /* 196 */
-        u8 iboost_hdmi:4; /* 196 */
 } __packed;
 struct vbt {
@@ -155,7 +151,7 @@ static void virt_vbt_generation(struct vbt *v)
        v->header.bdb_offset = offsetof(struct vbt, bdb_header);
        strcpy(&v->bdb_header.signature[0], "BIOS_DATA_BLOCK");
-        v->bdb_header.version = 186; /* child_dev_size = 38 */
+        v->bdb_header.version = 186; /* child_dev_size = 33 */
        v->bdb_header.header_size = sizeof(v->bdb_header);
        v->bdb_header.bdb_size = sizeof(struct vbt) - sizeof(struct vbt_header)
@@ -169,11 +165,13 @@ static void virt_vbt_generation(struct vbt *v)
        /* child device */
        num_child = 4; /* each port has one child */
+        v->general_definitions.child_dev_size =
+                sizeof(struct efp_child_device_config);
        v->general_definitions_header.id = BDB_GENERAL_DEFINITIONS;
        /* size will include child devices */
        v->general_definitions_header.size =
-                sizeof(struct bdb_general_definitions) + num_child * DEV_SIZE;
+                sizeof(struct bdb_general_definitions) +
-        v->general_definitions.child_dev_size = DEV_SIZE;
+                        num_child * v->general_definitions.child_dev_size;
        /* portA */
        v->child0.handle = DEVICE_TYPE_EFP1;
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index a4e8e3cf74fd..c628be05fbfe 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -281,6 +281,7 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
        intel_vgpu_clean_submission(vgpu);
        intel_vgpu_clean_display(vgpu);
        intel_vgpu_clean_opregion(vgpu);
+        intel_vgpu_reset_ggtt(vgpu, true);
        intel_vgpu_clean_gtt(vgpu);
        intel_gvt_hypervisor_detach_vgpu(vgpu);
        intel_vgpu_free_resource(vgpu);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 4a3c8ee9a973..d2951096bca0 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5079,10 +5079,14 @@ void hsw_disable_ips(const struct intel_crtc_state *crtc_state)
                mutex_lock(&dev_priv->pcu_lock);
                WARN_ON(sandybridge_pcode_write(dev_priv, DISPLAY_IPS_CONTROL, 0));
                mutex_unlock(&dev_priv->pcu_lock);
-                /* wait for pcode to finish disabling IPS, which may take up to 42ms */
+                /*
+                 * Wait for PCODE to finish disabling IPS. The BSpec specified
+                 * 42ms timeout value leads to occasional timeouts so use 100ms
+                 * instead.
+                 */
                if (intel_wait_for_register(dev_priv,
                                            IPS_CTL, IPS_ENABLE, 0,
-                                            42))
+                                            100))
                        DRM_ERROR("Timed out waiting for IPS disable\n");
        } else {
                I915_WRITE(IPS_CTL, 0);
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index c2f10d899329..443dfaefd7a6 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -181,8 +181,9 @@ struct intel_overlay {
        u32 brightness, contrast, saturation;
        u32 old_xscale, old_yscale;
        /* register access */
-        u32 flip_addr;
        struct drm_i915_gem_object *reg_bo;
+        struct overlay_registers __iomem *regs;
+        u32 flip_addr;
        /* flip handling */
        struct i915_gem_active last_flip;
 };
@@ -210,29 +211,6 @@ static void i830_overlay_clock_gating(struct drm_i915_private *dev_priv,
                                  PCI_DEVFN(0, 0), I830_CLOCK_GATE, val);
 }
-static struct overlay_registers __iomem *
-intel_overlay_map_regs(struct intel_overlay *overlay)
-{
-        struct drm_i915_private *dev_priv = overlay->i915;
-        struct overlay_registers __iomem *regs;
-        if (OVERLAY_NEEDS_PHYSICAL(dev_priv))
-                regs = (struct overlay_registers __iomem *)overlay->reg_bo->phys_handle->vaddr;
-        else
-                regs = io_mapping_map_wc(&dev_priv->ggtt.iomap,
-                                         overlay->flip_addr,
-                                         PAGE_SIZE);
-        return regs;
-}
-static void intel_overlay_unmap_regs(struct intel_overlay *overlay,
-                                     struct overlay_registers __iomem *regs)
-{
-        if (!OVERLAY_NEEDS_PHYSICAL(overlay->i915))
-                io_mapping_unmap(regs);
-}
 static void intel_overlay_submit_request(struct intel_overlay *overlay,
                                         struct i915_request *rq,
                                         i915_gem_retire_fn retire)
@@ -784,13 +762,13 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
                                      struct drm_i915_gem_object *new_bo,
                                      struct put_image_params *params)
 {
-        int ret, tmp_width;
+        struct overlay_registers __iomem *regs = overlay->regs;
-        struct overlay_registers __iomem *regs;
-        bool scale_changed = false;
        struct drm_i915_private *dev_priv = overlay->i915;
        u32 swidth, swidthsw, sheight, ostride;
        enum pipe pipe = overlay->crtc->pipe;
+        bool scale_changed = false;
        struct i915_vma *vma;
+        int ret, tmp_width;
        lockdep_assert_held(&dev_priv->drm.struct_mutex);
        WARN_ON(!drm_modeset_is_locked(&dev_priv->drm.mode_config.connection_mutex));
@@ -815,30 +793,19 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
        if (!overlay->active) {
                u32 oconfig;
-                regs = intel_overlay_map_regs(overlay);
-                if (!regs) {
-                        ret = -ENOMEM;
-                        goto out_unpin;
-                }
                oconfig = OCONF_CC_OUT_8BIT;
                if (IS_GEN4(dev_priv))
                        oconfig |= OCONF_CSC_MODE_BT709;
                oconfig |= pipe == 0 ?
                        OCONF_PIPE_A : OCONF_PIPE_B;
                iowrite32(oconfig, &regs->OCONFIG);
-                intel_overlay_unmap_regs(overlay, regs);
                ret = intel_overlay_on(overlay);
                if (ret != 0)
                        goto out_unpin;
        }
-        regs = intel_overlay_map_regs(overlay);
-        if (!regs) {
-                ret = -ENOMEM;
-                goto out_unpin;
-        }
        iowrite32((params->dst_y << 16) | params->dst_x, &regs->DWINPOS);
        iowrite32((params->dst_h << 16) | params->dst_w, &regs->DWINSZ);
@@ -882,8 +849,6 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
        iowrite32(overlay_cmd_reg(params), &regs->OCMD);
-        intel_overlay_unmap_regs(overlay, regs);
        ret = intel_overlay_continue(overlay, vma, scale_changed);
        if (ret)
                goto out_unpin;
@@ -901,7 +866,6 @@ out_pin_section:
 int intel_overlay_switch_off(struct intel_overlay *overlay)
 {
        struct drm_i915_private *dev_priv = overlay->i915;
-        struct overlay_registers __iomem *regs;
        int ret;
        lockdep_assert_held(&dev_priv->drm.struct_mutex);
@@ -918,9 +882,7 @@ int intel_overlay_switch_off(struct intel_overlay *overlay)
        if (ret != 0)
                return ret;
-        regs = intel_overlay_map_regs(overlay);
+        iowrite32(0, &overlay->regs->OCMD);
-        iowrite32(0, &regs->OCMD);
-        intel_overlay_unmap_regs(overlay, regs);
        return intel_overlay_off(overlay);
 }
@@ -1305,7 +1267,6 @@ int intel_overlay_attrs_ioctl(struct drm_device *dev, void *data,
        struct drm_intel_overlay_attrs *attrs = data;
        struct drm_i915_private *dev_priv = to_i915(dev);
        struct intel_overlay *overlay;
-        struct overlay_registers __iomem *regs;
        int ret;
        overlay = dev_priv->overlay;
@@ -1345,15 +1306,7 @@ int intel_overlay_attrs_ioctl(struct drm_device *dev, void *data,
                overlay->contrast   = attrs->contrast;
                overlay->saturation = attrs->saturation;
-                regs = intel_overlay_map_regs(overlay);
+                update_reg_attrs(overlay, overlay->regs);
-                if (!regs) {
-                        ret = -ENOMEM;
-                        goto out_unlock;
-                }
-                update_reg_attrs(overlay, regs);
-                intel_overlay_unmap_regs(overlay, regs);
                if (attrs->flags & I915_OVERLAY_UPDATE_GAMMA) {
                        if (IS_GEN2(dev_priv))
@@ -1386,12 +1339,47 @@ out_unlock:
        return ret;
 }
+static int get_registers(struct intel_overlay *overlay, bool use_phys)
+{
+        struct drm_i915_gem_object *obj;
+        struct i915_vma *vma;
+        int err;
+        obj = i915_gem_object_create_stolen(overlay->i915, PAGE_SIZE);
+        if (obj == NULL)
+                obj = i915_gem_object_create_internal(overlay->i915, PAGE_SIZE);
+        if (IS_ERR(obj))
+                return PTR_ERR(obj);
+        vma = i915_gem_object_ggtt_pin(obj, NULL, 0, 0, PIN_MAPPABLE);
+        if (IS_ERR(vma)) {
+                err = PTR_ERR(vma);
+                goto err_put_bo;
+        }
+        if (use_phys)
+                overlay->flip_addr = sg_dma_address(obj->mm.pages->sgl);
+        else
+                overlay->flip_addr = i915_ggtt_offset(vma);
+        overlay->regs = i915_vma_pin_iomap(vma);
+        i915_vma_unpin(vma);
+        if (IS_ERR(overlay->regs)) {
+                err = PTR_ERR(overlay->regs);
+                goto err_put_bo;
+        }
+        overlay->reg_bo = obj;
+        return 0;
+err_put_bo:
+        i915_gem_object_put(obj);
+        return err;
+}
 void intel_setup_overlay(struct drm_i915_private *dev_priv)
 {
        struct intel_overlay *overlay;
-        struct drm_i915_gem_object *reg_bo;
-        struct overlay_registers __iomem *regs;
-        struct i915_vma *vma = NULL;
        int ret;
        if (!HAS_OVERLAY(dev_priv))
@@ -1401,46 +1389,8 @@ void intel_setup_overlay(struct drm_i915_private *dev_priv)
        if (!overlay)
                return;
-        mutex_lock(&dev_priv->drm.struct_mutex);
-        if (WARN_ON(dev_priv->overlay))
-                goto out_free;
        overlay->i915 = dev_priv;
-        reg_bo = NULL;
-        if (!OVERLAY_NEEDS_PHYSICAL(dev_priv))
-                reg_bo = i915_gem_object_create_stolen(dev_priv, PAGE_SIZE);
-        if (reg_bo == NULL)
-                reg_bo = i915_gem_object_create(dev_priv, PAGE_SIZE);
-        if (IS_ERR(reg_bo))
-                goto out_free;
-        overlay->reg_bo = reg_bo;
-        if (OVERLAY_NEEDS_PHYSICAL(dev_priv)) {
-                ret = i915_gem_object_attach_phys(reg_bo, PAGE_SIZE);
-                if (ret) {
-                        DRM_ERROR("failed to attach phys overlay regs\n");
-                        goto out_free_bo;
-                }
-                overlay->flip_addr = reg_bo->phys_handle->busaddr;
-        } else {
-                vma = i915_gem_object_ggtt_pin(reg_bo, NULL,
-                                               0, PAGE_SIZE, PIN_MAPPABLE);
-                if (IS_ERR(vma)) {
-                        DRM_ERROR("failed to pin overlay register bo\n");
-                        ret = PTR_ERR(vma);
-                        goto out_free_bo;
-                }
-                overlay->flip_addr = i915_ggtt_offset(vma);
-                ret = i915_gem_object_set_to_gtt_domain(reg_bo, true);
-                if (ret) {
-                        DRM_ERROR("failed to move overlay register bo into the GTT\n");
-                        goto out_unpin_bo;
-                }
-        }
-        /* init all values */
        overlay->color_key = 0x0101fe;
        overlay->color_key_enabled = true;
        overlay->brightness = -19;
@@ -1449,44 +1399,51 @@ void intel_setup_overlay(struct drm_i915_private *dev_priv)
        init_request_active(&overlay->last_flip, NULL);
-        regs = intel_overlay_map_regs(overlay);
+        mutex_lock(&dev_priv->drm.struct_mutex);
-        if (!regs)
-                goto out_unpin_bo;
+        ret = get_registers(overlay, OVERLAY_NEEDS_PHYSICAL(dev_priv));
+        if (ret)
+                goto out_free;
+        ret = i915_gem_object_set_to_gtt_domain(overlay->reg_bo, true);
+        if (ret)
+                goto out_reg_bo;
-        memset_io(regs, 0, sizeof(struct overlay_registers));
+        mutex_unlock(&dev_priv->drm.struct_mutex);
-        update_polyphase_filter(regs);
-        update_reg_attrs(overlay, regs);
-        intel_overlay_unmap_regs(overlay, regs);
+        memset_io(overlay->regs, 0, sizeof(struct overlay_registers));
+        update_polyphase_filter(overlay->regs);
+        update_reg_attrs(overlay, overlay->regs);
        dev_priv->overlay = overlay;
-        mutex_unlock(&dev_priv->drm.struct_mutex);
+        DRM_INFO("Initialized overlay support.\n");
-        DRM_INFO("initialized overlay support\n");
        return;
-out_unpin_bo:
+out_reg_bo:
-        if (vma)
+        i915_gem_object_put(overlay->reg_bo);
-                i915_vma_unpin(vma);
-out_free_bo:
-        i915_gem_object_put(reg_bo);
 out_free:
        mutex_unlock(&dev_priv->drm.struct_mutex);
        kfree(overlay);
-        return;
 }
 void intel_cleanup_overlay(struct drm_i915_private *dev_priv)
 {
-        if (!dev_priv->overlay)
+        struct intel_overlay *overlay;
+        overlay = fetch_and_zero(&dev_priv->overlay);
+        if (!overlay)
                return;
-        /* The bo's should be free'd by the generic code already.
+        /*
+         * The bo's should be free'd by the generic code already.
         * Furthermore modesetting teardown happens beforehand so the
-         * hardware should be off already */
+         * hardware should be off already.
-        WARN_ON(dev_priv->overlay->active);
+         */
+        WARN_ON(overlay->active);
+        i915_gem_object_put(overlay->reg_bo);
-        i915_gem_object_put(dev_priv->overlay->reg_bo);
+        kfree(overlay);
-        kfree(dev_priv->overlay);
 }
 #if IS_ENABLED(CONFIG_DRM_I915_CAPTURE_ERROR)
@@ -1498,37 +1455,11 @@ struct intel_overlay_error_state {
        u32 isr;
 };
-static struct overlay_registers __iomem *
-intel_overlay_map_regs_atomic(struct intel_overlay *overlay)
-{
-        struct drm_i915_private *dev_priv = overlay->i915;
-        struct overlay_registers __iomem *regs;
-        if (OVERLAY_NEEDS_PHYSICAL(dev_priv))
-                /* Cast to make sparse happy, but it's wc memory anyway, so
-                 * equivalent to the wc io mapping on X86. */
-                regs = (struct overlay_registers __iomem *)
-                        overlay->reg_bo->phys_handle->vaddr;
-        else
-                regs = io_mapping_map_atomic_wc(&dev_priv->ggtt.iomap,
-                                                overlay->flip_addr);
-        return regs;
-}
-static void intel_overlay_unmap_regs_atomic(struct intel_overlay *overlay,
-                                        struct overlay_registers __iomem *regs)
-{
-        if (!OVERLAY_NEEDS_PHYSICAL(overlay->i915))
-                io_mapping_unmap_atomic(regs);
-}
 struct intel_overlay_error_state *
 intel_overlay_capture_error_state(struct drm_i915_private *dev_priv)
 {
        struct intel_overlay *overlay = dev_priv->overlay;
        struct intel_overlay_error_state *error;
-        struct overlay_registers __iomem *regs;
        if (!overlay || !overlay->active)
                return NULL;
@@ -1541,18 +1472,9 @@ intel_overlay_capture_error_state(struct drm_i915_private *dev_priv)
        error->isr = I915_READ(ISR);
        error->base = overlay->flip_addr;
-        regs = intel_overlay_map_regs_atomic(overlay);
+        memcpy_fromio(&error->regs, overlay->regs, sizeof(error->regs));
-        if (!regs)
-                goto err;
-        memcpy_fromio(&error->regs, regs, sizeof(struct overlay_registers));
-        intel_overlay_unmap_regs_atomic(overlay, regs);
        return error;
-err:
-        kfree(error);
-        return NULL;
 }
 void
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 8412119bd940..5691dfa1db6f 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -1123,17 +1123,21 @@ nv50_mstm_enable(struct nv50_mstm *mstm, u8 dpcd, int state)
        int ret;
        if (dpcd >= 0x12) {
-                ret = drm_dp_dpcd_readb(mstm->mgr.aux, DP_MSTM_CTRL, &dpcd);
+                /* Even if we're enabling MST, start with disabling the
+                 * branching unit to clear any sink-side MST topology state
+                 * that wasn't set by us
+                 */
+                ret = drm_dp_dpcd_writeb(mstm->mgr.aux, DP_MSTM_CTRL, 0);
                if (ret < 0)
                        return ret;
-                dpcd &= ~DP_MST_EN;
+                if (state) {
-                if (state)
+                        /* Now, start initializing */
-                        dpcd |= DP_MST_EN;
+                        ret = drm_dp_dpcd_writeb(mstm->mgr.aux, DP_MSTM_CTRL,
+                                                 DP_MST_EN);
-                ret = drm_dp_dpcd_writeb(mstm->mgr.aux, DP_MSTM_CTRL, dpcd);
+                        if (ret < 0)
-                if (ret < 0)
+                                return ret;
-                        return ret;
+                }
        }
        return nvif_mthd(disp, 0, &args, sizeof(args));
@@ -1142,31 +1146,58 @@ nv50_mstm_enable(struct nv50_mstm *mstm, u8 dpcd, int state)
 int
 nv50_mstm_detect(struct nv50_mstm *mstm, u8 dpcd[8], int allow)
 {
-        int ret, state = 0;
+        struct drm_dp_aux *aux;
+        int ret;
+        bool old_state, new_state;
+        u8 mstm_ctrl;
        if (!mstm)
                return 0;
-        if (dpcd[0] >= 0x12) {
+        mutex_lock(&mstm->mgr.lock);
-                ret = drm_dp_dpcd_readb(mstm->mgr.aux, DP_MSTM_CAP, &dpcd[1]);
+        old_state = mstm->mgr.mst_state;
+        new_state = old_state;
+        aux = mstm->mgr.aux;
+        if (old_state) {
+                /* Just check that the MST hub is still as we expect it */
+                ret = drm_dp_dpcd_readb(aux, DP_MSTM_CTRL, &mstm_ctrl);
+                if (ret < 0 || !(mstm_ctrl & DP_MST_EN)) {
+                        DRM_DEBUG_KMS("Hub gone, disabling MST topology\n");
+                        new_state = false;
+                }
+        } else if (dpcd[0] >= 0x12) {
+                ret = drm_dp_dpcd_readb(aux, DP_MSTM_CAP, &dpcd[1]);
                if (ret < 0)
-                        return ret;
+                        goto probe_error;
                if (!(dpcd[1] & DP_MST_CAP))
                        dpcd[0] = 0x11;
                else
-                        state = allow;
+                        new_state = allow;
+        }
+        if (new_state == old_state) {
+                mutex_unlock(&mstm->mgr.lock);
+                return new_state;
        }
-        ret = nv50_mstm_enable(mstm, dpcd[0], state);
+        ret = nv50_mstm_enable(mstm, dpcd[0], new_state);
        if (ret)
-                return ret;
+                goto probe_error;
+        mutex_unlock(&mstm->mgr.lock);
-        ret = drm_dp_mst_topology_mgr_set_mst(&mstm->mgr, state);
+        ret = drm_dp_mst_topology_mgr_set_mst(&mstm->mgr, new_state);
        if (ret)
                return nv50_mstm_enable(mstm, dpcd[0], 0);
-        return mstm->mgr.mst_state;
+        return new_state;
+probe_error:
+        mutex_unlock(&mstm->mgr.lock);
+        return ret;
 }
 static void
@@ -2074,7 +2105,7 @@ nv50_disp_atomic_state_alloc(struct drm_device *dev)
 static const struct drm_mode_config_funcs
 nv50_disp_func = {
        .fb_create = nouveau_user_framebuffer_create,
-        .output_poll_changed = drm_fb_helper_output_poll_changed,
+        .output_poll_changed = nouveau_fbcon_output_poll_changed,
        .atomic_check = nv50_disp_atomic_check,
        .atomic_commit = nv50_disp_atomic_commit,
        .atomic_state_alloc = nv50_disp_atomic_state_alloc,
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 51932c72334e..247f72cc4d10 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -409,59 +409,45 @@ static struct nouveau_encoder *
 nouveau_connector_ddc_detect(struct drm_connector *connector)
 {
        struct drm_device *dev = connector->dev;
-        struct nouveau_connector *nv_connector = nouveau_connector(connector);
+        struct nouveau_encoder *nv_encoder = NULL, *found = NULL;
-        struct nouveau_drm *drm = nouveau_drm(dev);
-        struct nvkm_gpio *gpio = nvxx_gpio(&drm->client.device);
-        struct nouveau_encoder *nv_encoder = NULL;
        struct drm_encoder *encoder;
-        int i, panel = -ENODEV;
+        int i, ret;
+        bool switcheroo_ddc = false;
-        /* eDP panels need powering on by us (if the VBIOS doesn't default it
-         * to on) before doing any AUX channel transactions.  LVDS panel power
-         * is handled by the SOR itself, and not required for LVDS DDC.
-         */
-        if (nv_connector->type == DCB_CONNECTOR_eDP) {
-                panel = nvkm_gpio_get(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff);
-                if (panel == 0) {
-                        nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 1);
-                        msleep(300);
-                }
-        }
        drm_connector_for_each_possible_encoder(connector, encoder, i) {
                nv_encoder = nouveau_encoder(encoder);
-                if (nv_encoder->dcb->type == DCB_OUTPUT_DP) {
+                switch (nv_encoder->dcb->type) {
-                        int ret = nouveau_dp_detect(nv_encoder);
+                case DCB_OUTPUT_DP:
+                        ret = nouveau_dp_detect(nv_encoder);
                        if (ret == NOUVEAU_DP_MST)
                                return NULL;
-                        if (ret == NOUVEAU_DP_SST)
+                        else if (ret == NOUVEAU_DP_SST)
-                                break;
+                                found = nv_encoder;
-                } else
-                if ((vga_switcheroo_handler_flags() &
+                        break;
-                     VGA_SWITCHEROO_CAN_SWITCH_DDC) &&
+                case DCB_OUTPUT_LVDS:
-                    nv_encoder->dcb->type == DCB_OUTPUT_LVDS &&
+                        switcheroo_ddc = !!(vga_switcheroo_handler_flags() &
-                    nv_encoder->i2c) {
+                                            VGA_SWITCHEROO_CAN_SWITCH_DDC);
-                        int ret;
+                /* fall-through */
-                        vga_switcheroo_lock_ddc(dev->pdev);
+                default:
-                        ret = nvkm_probe_i2c(nv_encoder->i2c, 0x50);
+                        if (!nv_encoder->i2c)
-                        vga_switcheroo_unlock_ddc(dev->pdev);
-                        if (ret)
                                break;
-                } else
-                if (nv_encoder->i2c) {
+                        if (switcheroo_ddc)
+                                vga_switcheroo_lock_ddc(dev->pdev);
                        if (nvkm_probe_i2c(nv_encoder->i2c, 0x50))
-                                break;
+                                found = nv_encoder;
+                        if (switcheroo_ddc)
+                                vga_switcheroo_unlock_ddc(dev->pdev);
+                        break;
                }
+                if (found)
+                        break;
        }
-        /* eDP panel not detected, restore panel power GPIO to previous
+        return found;
-         * state to avoid confusing the SOR for other output types.
-         */
-        if (!nv_encoder && panel == 0)
-                nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, panel);
-        return nv_encoder;
 }
 static struct nouveau_encoder *
@@ -555,12 +541,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
                nv_connector->edid = NULL;
        }
-        /* Outputs are only polled while runtime active, so acquiring a
+        /* Outputs are only polled while runtime active, so resuming the
-         * runtime PM ref here is unnecessary (and would deadlock upon
+         * device here is unnecessary (and would deadlock upon runtime suspend
-         * runtime suspend because it waits for polling to finish).
+         * because it waits for polling to finish). We do however, want to
+         * prevent the autosuspend timer from elapsing during this operation
+         * if possible.
         */
-        if (!drm_kms_helper_is_poll_worker()) {
+        if (drm_kms_helper_is_poll_worker()) {
-                ret = pm_runtime_get_sync(connector->dev->dev);
+                pm_runtime_get_noresume(dev->dev);
+        } else {
+                ret = pm_runtime_get_sync(dev->dev);
                if (ret < 0 && ret != -EACCES)
                        return conn_status;
        }
@@ -638,10 +628,8 @@ detect_analog:
 out:
-        if (!drm_kms_helper_is_poll_worker()) {
+        pm_runtime_mark_last_busy(dev->dev);
-                pm_runtime_mark_last_busy(connector->dev->dev);
+        pm_runtime_put_autosuspend(dev->dev);
-                pm_runtime_put_autosuspend(connector->dev->dev);
-        }
        return conn_status;
 }
@@ -1105,6 +1093,26 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
        const struct nvif_notify_conn_rep_v0 *rep = notify->data;
        const char *name = connector->name;
        struct nouveau_encoder *nv_encoder;
+        int ret;
+        ret = pm_runtime_get(drm->dev->dev);
+        if (ret == 0) {
+                /* We can't block here if there's a pending PM request
+                 * running, as we'll deadlock nouveau_display_fini() when it
+                 * calls nvif_put() on our nvif_notify struct. So, simply
+                 * defer the hotplug event until the device finishes resuming
+                 */
+                NV_DEBUG(drm, "Deferring HPD on %s until runtime resume\n",
+                         name);
+                schedule_work(&drm->hpd_work);
+                pm_runtime_put_noidle(drm->dev->dev);
+                return NVIF_NOTIFY_KEEP;
+        } else if (ret != 1 && ret != -EACCES) {
+                NV_WARN(drm, "HPD on %s dropped due to RPM failure: %d\n",
+                        name, ret);
+                return NVIF_NOTIFY_DROP;
+        }
        if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) {
                NV_DEBUG(drm, "service %s\n", name);
@@ -1122,6 +1130,8 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
                drm_helper_hpd_irq_event(connector->dev);
        }
+        pm_runtime_mark_last_busy(drm->dev->dev);
+        pm_runtime_put_autosuspend(drm->dev->dev);
        return NVIF_NOTIFY_KEEP;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 139368b31916..540c0cbbfcee 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -293,7 +293,7 @@ nouveau_user_framebuffer_create(struct drm_device *dev,
 static const struct drm_mode_config_funcs nouveau_mode_config_funcs = {
        .fb_create = nouveau_user_framebuffer_create,
-        .output_poll_changed = drm_fb_helper_output_poll_changed,
+        .output_poll_changed = nouveau_fbcon_output_poll_changed,
 };
@@ -355,8 +355,6 @@ nouveau_display_hpd_work(struct work_struct *work)
        pm_runtime_get_sync(drm->dev->dev);
        drm_helper_hpd_irq_event(drm->dev);
-        /* enable polling for external displays */
-        drm_kms_helper_poll_enable(drm->dev);
        pm_runtime_mark_last_busy(drm->dev->dev);
        pm_runtime_put_sync(drm->dev->dev);
@@ -379,15 +377,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val,
 {
        struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb);
        struct acpi_bus_event *info = data;
+        int ret;
        if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) {
                if (info->type == ACPI_VIDEO_NOTIFY_PROBE) {
-                        /*
+                        ret = pm_runtime_get(drm->dev->dev);
-                         * This may be the only indication we receive of a
+                        if (ret == 1 || ret == -EACCES) {
-                         * connector hotplug on a runtime suspended GPU,
+                                /* If the GPU is already awake, or in a state
-                         * schedule hpd_work to check.
+                                 * where we can't wake it up, it can handle
-                         */
+                                 * it's own hotplug events.
-                        schedule_work(&drm->hpd_work);
+                                 */
+                                pm_runtime_put_autosuspend(drm->dev->dev);
+                        } else if (ret == 0) {
+                                /* This may be the only indication we receive
+                                 * of a connector hotplug on a runtime
+                                 * suspended GPU, schedule hpd_work to check.
+                                 */
+                                NV_DEBUG(drm, "ACPI requested connector reprobe\n");
+                                schedule_work(&drm->hpd_work);
+                                pm_runtime_put_noidle(drm->dev->dev);
+                        } else {
+                                NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n",
+                                        ret);
+                        }
                        /* acpi-video should not generate keypresses for this */
                        return NOTIFY_BAD;
@@ -411,6 +423,11 @@ nouveau_display_init(struct drm_device *dev)
        if (ret)
                return ret;
+        /* enable connector detection and polling for connectors without HPD
+         * support
+         */
+        drm_kms_helper_poll_enable(dev);
        /* enable hotplug interrupts */
        drm_connector_list_iter_begin(dev, &conn_iter);
        nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
@@ -425,7 +442,7 @@ nouveau_display_init(struct drm_device *dev)
 }
 void
-nouveau_display_fini(struct drm_device *dev, bool suspend)
+nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime)
 {
        struct nouveau_display *disp = nouveau_display(dev);
        struct nouveau_drm *drm = nouveau_drm(dev);
@@ -450,6 +467,9 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
        }
        drm_connector_list_iter_end(&conn_iter);
+        if (!runtime)
+                cancel_work_sync(&drm->hpd_work);
        drm_kms_helper_poll_disable(dev);
        disp->fini(dev);
 }
@@ -618,11 +638,11 @@ nouveau_display_suspend(struct drm_device *dev, bool runtime)
                        }
                }
-                nouveau_display_fini(dev, true);
+                nouveau_display_fini(dev, true, runtime);
                return 0;
        }
-        nouveau_display_fini(dev, true);
+        nouveau_display_fini(dev, true, runtime);
        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                struct nouveau_framebuffer *nouveau_fb;
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.h b/drivers/gpu/drm/nouveau/nouveau_display.h
index 54aa7c3fa42d..ff92b54ce448 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.h
+++ b/drivers/gpu/drm/nouveau/nouveau_display.h
@@ -62,7 +62,7 @@ nouveau_display(struct drm_device *dev)
 int  nouveau_display_create(struct drm_device *dev);
 void nouveau_display_destroy(struct drm_device *dev);
 int  nouveau_display_init(struct drm_device *dev);
-void nouveau_display_fini(struct drm_device *dev, bool suspend);
+void nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime);
 int  nouveau_display_suspend(struct drm_device *dev, bool runtime);
 void nouveau_display_resume(struct drm_device *dev, bool runtime);
 int  nouveau_display_vblank_enable(struct drm_device *, unsigned int);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index c7ec86d6c3c9..74d2283f2c28 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -230,7 +230,7 @@ nouveau_cli_init(struct nouveau_drm *drm, const char *sname,
                mutex_unlock(&drm->master.lock);
        }
        if (ret) {
-                NV_ERROR(drm, "Client allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "Client allocation failed: %d\n", ret);
                goto done;
        }
@@ -240,37 +240,37 @@ nouveau_cli_init(struct nouveau_drm *drm, const char *sname,
                               }, sizeof(struct nv_device_v0),
                               &cli->device);
        if (ret) {
-                NV_ERROR(drm, "Device allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "Device allocation failed: %d\n", ret);
                goto done;
        }
        ret = nvif_mclass(&cli->device.object, mmus);
        if (ret < 0) {
-                NV_ERROR(drm, "No supported MMU class\n");
+                NV_PRINTK(err, cli, "No supported MMU class\n");
                goto done;
        }
        ret = nvif_mmu_init(&cli->device.object, mmus[ret].oclass, &cli->mmu);
        if (ret) {
-                NV_ERROR(drm, "MMU allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "MMU allocation failed: %d\n", ret);
                goto done;
        }
        ret = nvif_mclass(&cli->mmu.object, vmms);
        if (ret < 0) {
-                NV_ERROR(drm, "No supported VMM class\n");
+                NV_PRINTK(err, cli, "No supported VMM class\n");
                goto done;
        }
        ret = nouveau_vmm_init(cli, vmms[ret].oclass, &cli->vmm);
        if (ret) {
-                NV_ERROR(drm, "VMM allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "VMM allocation failed: %d\n", ret);
                goto done;
        }
        ret = nvif_mclass(&cli->mmu.object, mems);
        if (ret < 0) {
-                NV_ERROR(drm, "No supported MEM class\n");
+                NV_PRINTK(err, cli, "No supported MEM class\n");
                goto done;
        }
@@ -592,10 +592,8 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
                pm_runtime_allow(dev->dev);
                pm_runtime_mark_last_busy(dev->dev);
                pm_runtime_put(dev->dev);
-        } else {
-                /* enable polling for external displays */
-                drm_kms_helper_poll_enable(dev);
        }
        return 0;
 fail_dispinit:
@@ -629,7 +627,7 @@ nouveau_drm_unload(struct drm_device *dev)
        nouveau_debugfs_fini(drm);
        if (dev->mode_config.num_crtc)
-                nouveau_display_fini(dev, false);
+                nouveau_display_fini(dev, false, false);
        nouveau_display_destroy(dev);
        nouveau_bios_takedown(dev);
@@ -835,7 +833,6 @@ nouveau_pmops_runtime_suspend(struct device *dev)
                return -EBUSY;
        }
-        drm_kms_helper_poll_disable(drm_dev);
        nouveau_switcheroo_optimus_dsm();
        ret = nouveau_do_suspend(drm_dev, true);
        pci_save_state(pdev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 844498c4267c..0f64c0a1d4b3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -466,6 +466,7 @@ nouveau_fbcon_set_suspend_work(struct work_struct *work)
        console_unlock();
        if (state == FBINFO_STATE_RUNNING) {
+                nouveau_fbcon_hotplug_resume(drm->fbcon);
                pm_runtime_mark_last_busy(drm->dev->dev);
                pm_runtime_put_sync(drm->dev->dev);
        }
@@ -487,6 +488,61 @@ nouveau_fbcon_set_suspend(struct drm_device *dev, int state)
        schedule_work(&drm->fbcon_work);
 }
+void
+nouveau_fbcon_output_poll_changed(struct drm_device *dev)
+{
+        struct nouveau_drm *drm = nouveau_drm(dev);
+        struct nouveau_fbdev *fbcon = drm->fbcon;
+        int ret;
+        if (!fbcon)
+                return;
+        mutex_lock(&fbcon->hotplug_lock);
+        ret = pm_runtime_get(dev->dev);
+        if (ret == 1 || ret == -EACCES) {
+                drm_fb_helper_hotplug_event(&fbcon->helper);
+                pm_runtime_mark_last_busy(dev->dev);
+                pm_runtime_put_autosuspend(dev->dev);
+        } else if (ret == 0) {
+                /* If the GPU was already in the process of suspending before
+                 * this event happened, then we can't block here as we'll
+                 * deadlock the runtime pmops since they wait for us to
+                 * finish. So, just defer this event for when we runtime
+                 * resume again. It will be handled by fbcon_work.
+                 */
+                NV_DEBUG(drm, "fbcon HPD event deferred until runtime resume\n");
+                fbcon->hotplug_waiting = true;
+                pm_runtime_put_noidle(drm->dev->dev);
+        } else {
+                DRM_WARN("fbcon HPD event lost due to RPM failure: %d\n",
+                         ret);
+        }
+        mutex_unlock(&fbcon->hotplug_lock);
+}
+void
+nouveau_fbcon_hotplug_resume(struct nouveau_fbdev *fbcon)
+{
+        struct nouveau_drm *drm;
+        if (!fbcon)
+                return;
+        drm = nouveau_drm(fbcon->helper.dev);
+        mutex_lock(&fbcon->hotplug_lock);
+        if (fbcon->hotplug_waiting) {
+                fbcon->hotplug_waiting = false;
+                NV_DEBUG(drm, "Handling deferred fbcon HPD events\n");
+                drm_fb_helper_hotplug_event(&fbcon->helper);
+        }
+        mutex_unlock(&fbcon->hotplug_lock);
+}
 int
 nouveau_fbcon_init(struct drm_device *dev)
 {
@@ -505,6 +561,7 @@ nouveau_fbcon_init(struct drm_device *dev)
        drm->fbcon = fbcon;
        INIT_WORK(&drm->fbcon_work, nouveau_fbcon_set_suspend_work);
+        mutex_init(&fbcon->hotplug_lock);
        drm_fb_helper_prepare(dev, &fbcon->helper, &nouveau_fbcon_helper_funcs);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.h b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
index a6f192ea3fa6..db9d52047ef8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
@@ -41,6 +41,9 @@ struct nouveau_fbdev {
        struct nvif_object gdi;
        struct nvif_object blit;
        struct nvif_object twod;
+        struct mutex hotplug_lock;
+        bool hotplug_waiting;
 };
 void nouveau_fbcon_restore(void);
@@ -68,6 +71,8 @@ void nouveau_fbcon_set_suspend(struct drm_device *dev, int state);
 void nouveau_fbcon_accel_save_disable(struct drm_device *dev);
 void nouveau_fbcon_accel_restore(struct drm_device *dev);
+void nouveau_fbcon_output_poll_changed(struct drm_device *dev);
+void nouveau_fbcon_hotplug_resume(struct nouveau_fbdev *fbcon);
 extern int nouveau_nofbaccel;
 #endif /* __NV50_FBCON_H__ */
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index 3da5a4305aa4..8f1ce4833230 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -46,12 +46,10 @@ nouveau_switcheroo_set_state(struct pci_dev *pdev,
                pr_err("VGA switcheroo: switched nouveau on\n");
                dev->switch_power_state = DRM_SWITCH_POWER_CHANGING;
                nouveau_pmops_resume(&pdev->dev);
-                drm_kms_helper_poll_enable(dev);
                dev->switch_power_state = DRM_SWITCH_POWER_ON;
        } else {
                pr_err("VGA switcheroo: switched nouveau off\n");
                dev->switch_power_state = DRM_SWITCH_POWER_CHANGING;
-                drm_kms_helper_poll_disable(dev);
                nouveau_switcheroo_optimus_dsm();
                nouveau_pmops_suspend(&pdev->dev);
                dev->switch_power_state = DRM_SWITCH_POWER_OFF;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
index 32fa94a9773f..cbd33e87b799 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
@@ -275,6 +275,7 @@ nvkm_disp_oneinit(struct nvkm_engine *engine)
        struct nvkm_outp *outp, *outt, *pair;
        struct nvkm_conn *conn;
        struct nvkm_head *head;
+        struct nvkm_ior *ior;
        struct nvbios_connE connE;
        struct dcb_output dcbE;
        u8  hpd = 0, ver, hdr;
@@ -399,6 +400,19 @@ nvkm_disp_oneinit(struct nvkm_engine *engine)
                        return ret;
        }
+        /* Enforce identity-mapped SOR assignment for panels, which have
+         * certain bits (ie. backlight controls) wired to a specific SOR.
+         */
+        list_for_each_entry(outp, &disp->outp, head) {
+                if (outp->conn->info.type == DCB_CONNECTOR_LVDS ||
+                    outp->conn->info.type == DCB_CONNECTOR_eDP) {
+                        ior = nvkm_ior_find(disp, SOR, ffs(outp->info.or) - 1);
+                        if (!WARN_ON(!ior))
+                                ior->identity = true;
+                        outp->identity = true;
+                }
+        }
        i = 0;
        list_for_each_entry(head, &disp->head, head)
                i = max(i, head->id + 1);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
index 7c5bed29ffef..5f301e632599 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
@@ -28,6 +28,7 @@
 #include <subdev/bios.h>
 #include <subdev/bios/init.h>
+#include <subdev/gpio.h>
 #include <subdev/i2c.h>
 #include <nvif/event.h>
@@ -412,14 +413,10 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps)
 }
 static void
-nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior)
+nvkm_dp_disable(struct nvkm_outp *outp, struct nvkm_ior *ior)
 {
        struct nvkm_dp *dp = nvkm_dp(outp);
-        /* Prevent link from being retrained if sink sends an IRQ. */
-        atomic_set(&dp->lt.done, 0);
-        ior->dp.nr = 0;
        /* Execute DisableLT script from DP Info Table. */
        nvbios_init(&ior->disp->engine.subdev, dp->info.script[4],
                init.outp = &dp->outp.info;
@@ -428,6 +425,16 @@ nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior)
        );
 }
+static void
+nvkm_dp_release(struct nvkm_outp *outp)
+{
+        struct nvkm_dp *dp = nvkm_dp(outp);
+        /* Prevent link from being retrained if sink sends an IRQ. */
+        atomic_set(&dp->lt.done, 0);
+        dp->outp.ior->dp.nr = 0;
+}
 static int
 nvkm_dp_acquire(struct nvkm_outp *outp)
 {
@@ -491,7 +498,7 @@ done:
        return ret;
 }
-static void
+static bool
 nvkm_dp_enable(struct nvkm_dp *dp, bool enable)
 {
        struct nvkm_i2c_aux *aux = dp->aux;
@@ -505,7 +512,7 @@ nvkm_dp_enable(struct nvkm_dp *dp, bool enable)
                if (!nvkm_rdaux(aux, DPCD_RC00_DPCD_REV, dp->dpcd,
                                sizeof(dp->dpcd)))
-                        return;
+                        return true;
        }
        if (dp->present) {
@@ -515,6 +522,7 @@ nvkm_dp_enable(struct nvkm_dp *dp, bool enable)
        }
        atomic_set(&dp->lt.done, 0);
+        return false;
 }
 static int
@@ -555,9 +563,38 @@ nvkm_dp_fini(struct nvkm_outp *outp)
 static void
 nvkm_dp_init(struct nvkm_outp *outp)
 {
+        struct nvkm_gpio *gpio = outp->disp->engine.subdev.device->gpio;
        struct nvkm_dp *dp = nvkm_dp(outp);
        nvkm_notify_put(&dp->outp.conn->hpd);
-        nvkm_dp_enable(dp, true);
+        /* eDP panels need powering on by us (if the VBIOS doesn't default it
+         * to on) before doing any AUX channel transactions.  LVDS panel power
+         * is handled by the SOR itself, and not required for LVDS DDC.
+         */
+        if (dp->outp.conn->info.type == DCB_CONNECTOR_eDP) {
+                int power = nvkm_gpio_get(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff);
+                if (power == 0)
+                        nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 1);
+                /* We delay here unconditionally, even if already powered,
+                 * because some laptop panels having a significant resume
+                 * delay before the panel begins responding.
+                 *
+                 * This is likely a bit of a hack, but no better idea for
+                 * handling this at the moment.
+                 */
+                msleep(300);
+                /* If the eDP panel can't be detected, we need to restore
+                 * the panel power GPIO to avoid breaking another output.
+                 */
+                if (!nvkm_dp_enable(dp, true) && power == 0)
+                        nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 0);
+        } else {
+                nvkm_dp_enable(dp, true);
+        }
        nvkm_notify_get(&dp->hpd);
 }
@@ -576,6 +613,7 @@ nvkm_dp_func = {
        .fini = nvkm_dp_fini,
        .acquire = nvkm_dp_acquire,
        .release = nvkm_dp_release,
+        .disable = nvkm_dp_disable,
 };
 static int
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
index e0b4e0c5704e..19911211a12a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
@@ -16,6 +16,7 @@ struct nvkm_ior {
        char name[8];
        struct list_head head;
+        bool identity;
        struct nvkm_ior_state {
                struct nvkm_outp *outp;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
index f89c7b977aa5..def005dd5fda 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
@@ -501,11 +501,11 @@ nv50_disp_super_2_0(struct nv50_disp *disp, struct nvkm_head *head)
        nv50_disp_super_ied_off(head, ior, 2);
        /* If we're shutting down the OR's only active head, execute
-         * the output path's release function.
+         * the output path's disable function.
         */
        if (ior->arm.head == (1 << head->id)) {
-                if ((outp = ior->arm.outp) && outp->func->release)
+                if ((outp = ior->arm.outp) && outp->func->disable)
-                        outp->func->release(outp, ior);
+                        outp->func->disable(outp, ior);
        }
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
index be9e7f8c3b23..c62030c96fba 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
@@ -93,6 +93,8 @@ nvkm_outp_release(struct nvkm_outp *outp, u8 user)
        if (ior) {
                outp->acquired &= ~user;
                if (!outp->acquired) {
+                        if (outp->func->release && outp->ior)
+                                outp->func->release(outp);
                        outp->ior->asy.outp = NULL;
                        outp->ior = NULL;
                }
@@ -127,17 +129,26 @@ nvkm_outp_acquire(struct nvkm_outp *outp, u8 user)
        if (proto == UNKNOWN)
                return -ENOSYS;
+        /* Deal with panels requiring identity-mapped SOR assignment. */
+        if (outp->identity) {
+                ior = nvkm_ior_find(outp->disp, SOR, ffs(outp->info.or) - 1);
+                if (WARN_ON(!ior))
+                        return -ENOSPC;
+                return nvkm_outp_acquire_ior(outp, user, ior);
+        }
        /* First preference is to reuse the OR that is currently armed
         * on HW, if any, in order to prevent unnecessary switching.
         */
        list_for_each_entry(ior, &outp->disp->ior, head) {
-                if (!ior->asy.outp && ior->arm.outp == outp)
+                if (!ior->identity && !ior->asy.outp && ior->arm.outp == outp)
                        return nvkm_outp_acquire_ior(outp, user, ior);
        }
        /* Failing that, a completely unused OR is the next best thing. */
        list_for_each_entry(ior, &outp->disp->ior, head) {
-                if (!ior->asy.outp && ior->type == type && !ior->arm.outp &&
+                if (!ior->identity &&
+                    !ior->asy.outp && ior->type == type && !ior->arm.outp &&
                    (ior->func->route.set || ior->id == __ffs(outp->info.or)))
                        return nvkm_outp_acquire_ior(outp, user, ior);
        }
@@ -146,7 +157,7 @@ nvkm_outp_acquire(struct nvkm_outp *outp, u8 user)
         * but will be released during the next modeset.
         */
        list_for_each_entry(ior, &outp->disp->ior, head) {
-                if (!ior->asy.outp && ior->type == type &&
+                if (!ior->identity && !ior->asy.outp && ior->type == type &&
                    (ior->func->route.set || ior->id == __ffs(outp->info.or)))
                        return nvkm_outp_acquire_ior(outp, user, ior);
        }
@@ -245,7 +256,6 @@ nvkm_outp_ctor(const struct nvkm_outp_func *func, struct nvkm_disp *disp,
        outp->index = index;
        outp->info = *dcbE;
        outp->i2c = nvkm_i2c_bus_find(i2c, dcbE->i2c_index);
-        outp->or = ffs(outp->info.or) - 1;
        OUTP_DBG(outp, "type %02x loc %d or %d link %d con %x "
                       "edid %x bus %d head %x",
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
index ea84d7d5741a..6c8aa5cfed9d 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
@@ -13,10 +13,10 @@ struct nvkm_outp {
        struct dcb_output info;
        struct nvkm_i2c_bus *i2c;
-        int or;
        struct list_head head;
        struct nvkm_conn *conn;
+        bool identity;
        /* Assembly state. */
 #define NVKM_OUTP_PRIV 1
@@ -41,7 +41,8 @@ struct nvkm_outp_func {
        void (*init)(struct nvkm_outp *);
        void (*fini)(struct nvkm_outp *);
        int (*acquire)(struct nvkm_outp *);
-        void (*release)(struct nvkm_outp *, struct nvkm_ior *);
+        void (*release)(struct nvkm_outp *);
+        void (*disable)(struct nvkm_outp *, struct nvkm_ior *);
 };
 #define OUTP_MSG(o,l,f,a...) do {                                              \
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
index b80618e35491..17235e940ca9 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
@@ -86,10 +86,8 @@ pmu_load(struct nv50_devinit *init, u8 type, bool post,
        struct nvkm_bios *bios = subdev->device->bios;
        struct nvbios_pmuR pmu;
-        if (!nvbios_pmuRm(bios, type, &pmu)) {
+        if (!nvbios_pmuRm(bios, type, &pmu))
-                nvkm_error(subdev, "VBIOS PMU fuc %02x not found\n", type);
                return -EINVAL;
-        }
        if (!post)
                return 0;
@@ -124,29 +122,30 @@ gm200_devinit_post(struct nvkm_devinit *base, bool post)
                return -EINVAL;
        }
+        /* Upload DEVINIT application from VBIOS onto PMU. */
        ret = pmu_load(init, 0x04, post, &exec, &args);
-        if (ret)
+        if (ret) {
+                nvkm_error(subdev, "VBIOS PMU/DEVINIT not found\n");
                return ret;
+        }
-        /* upload first chunk of init data */
+        /* Upload tables required by opcodes in boot scripts. */
        if (post) {
-                // devinit tables
                u32 pmu = pmu_args(init, args + 0x08, 0x08);
                u32 img = nvbios_rd16(bios, bit_I.offset + 0x14);
                u32 len = nvbios_rd16(bios, bit_I.offset + 0x16);
                pmu_data(init, pmu, img, len);
        }
-        /* upload second chunk of init data */
+        /* Upload boot scripts. */
        if (post) {
-                // devinit boot scripts
                u32 pmu = pmu_args(init, args + 0x08, 0x10);
                u32 img = nvbios_rd16(bios, bit_I.offset + 0x18);
                u32 len = nvbios_rd16(bios, bit_I.offset + 0x1a);
                pmu_data(init, pmu, img, len);
        }
-        /* execute init tables */
+        /* Execute DEVINIT. */
        if (post) {
                nvkm_wr32(device, 0x10a040, 0x00005000);
                pmu_exec(init, exec);
@@ -157,8 +156,11 @@ gm200_devinit_post(struct nvkm_devinit *base, bool post)
                        return -ETIMEDOUT;
        }
-        /* load and execute some other ucode image (bios therm?) */
+        /* Optional: Execute PRE_OS application on PMU, which should at
-        return pmu_load(init, 0x01, post, NULL, NULL);
+         * least take care of fans until a full PMU has been loaded.
+         */
+        pmu_load(init, 0x01, post, NULL, NULL);
+        return 0;
 }
 static const struct nvkm_devinit_func
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
index de269eb482dd..7459def78d50 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
@@ -1423,7 +1423,7 @@ nvkm_vmm_get(struct nvkm_vmm *vmm, u8 page, u64 size, struct nvkm_vma **pvma)
 void
 nvkm_vmm_part(struct nvkm_vmm *vmm, struct nvkm_memory *inst)
 {
-        if (vmm->func->part && inst) {
+        if (inst && vmm->func->part) {
                mutex_lock(&vmm->mutex);
                vmm->func->part(vmm, inst);
                mutex_unlock(&vmm->mutex);
diff --git a/drivers/gpu/drm/pl111/pl111_vexpress.c b/drivers/gpu/drm/pl111/pl111_vexpress.c
index a534b225e31b..5fa0441bb6df 100644
--- a/drivers/gpu/drm/pl111/pl111_vexpress.c
+++ b/drivers/gpu/drm/pl111/pl111_vexpress.c
@@ -111,7 +111,8 @@ static int vexpress_muxfpga_probe(struct platform_device *pdev)
 }
 static const struct of_device_id vexpress_muxfpga_match[] = {
-        { .compatible = "arm,vexpress-muxfpga", }
+        { .compatible = "arm,vexpress-muxfpga", },
+        {}
 };
 static struct platform_driver vexpress_muxfpga_driver = {
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index dd19d674055c..8b0cd08034e0 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -418,7 +418,6 @@ static const struct of_device_id sun4i_drv_of_table[] = {
        { .compatible = "allwinner,sun8i-a33-display-engine" },
        { .compatible = "allwinner,sun8i-a83t-display-engine" },
        { .compatible = "allwinner,sun8i-h3-display-engine" },
-        { .compatible = "allwinner,sun8i-r40-display-engine" },
        { .compatible = "allwinner,sun8i-v3s-display-engine" },
        { .compatible = "allwinner,sun9i-a80-display-engine" },
        { }
diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
index 82502b351aec..a564b5dfe082 100644
--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
@@ -398,7 +398,6 @@ static struct regmap_config sun8i_hdmi_phy_regmap_config = {
 static const struct sun8i_hdmi_phy_variant sun50i_a64_hdmi_phy = {
        .has_phy_clk = true,
-        .has_second_pll = true,
        .phy_init = &sun8i_hdmi_phy_init_h3,
        .phy_disable = &sun8i_hdmi_phy_disable_h3,
        .phy_config = &sun8i_hdmi_phy_config_h3,
diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.c b/drivers/gpu/drm/sun4i/sun8i_mixer.c
index fc3713608f78..cb65b0ed53fd 100644
--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
+++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
@@ -545,22 +545,6 @@ static const struct sun8i_mixer_cfg sun8i_h3_mixer0_cfg = {
        .vi_num         = 1,
 };
-static const struct sun8i_mixer_cfg sun8i_r40_mixer0_cfg = {
-        .ccsc           = 0,
-        .mod_rate       = 297000000,
-        .scaler_mask    = 0xf,
-        .ui_num         = 3,
-        .vi_num         = 1,
-};
-static const struct sun8i_mixer_cfg sun8i_r40_mixer1_cfg = {
-        .ccsc           = 1,
-        .mod_rate       = 297000000,
-        .scaler_mask    = 0x3,
-        .ui_num         = 1,
-        .vi_num         = 1,
-};
 static const struct sun8i_mixer_cfg sun8i_v3s_mixer_cfg = {
        .vi_num = 2,
        .ui_num = 1,
@@ -583,14 +567,6 @@ static const struct of_device_id sun8i_mixer_of_table[] = {
                .data = &sun8i_h3_mixer0_cfg,
        },
        {
-                .compatible = "allwinner,sun8i-r40-de2-mixer-0",
-                .data = &sun8i_r40_mixer0_cfg,
-        },
-        {
-                .compatible = "allwinner,sun8i-r40-de2-mixer-1",
-                .data = &sun8i_r40_mixer1_cfg,
-        },
-        {
                .compatible = "allwinner,sun8i-v3s-de2-mixer",
                .data = &sun8i_v3s_mixer_cfg,
        },
diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
index 55fe398d8290..d5240b777a8f 100644
--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
@@ -253,7 +253,6 @@ static int sun8i_tcon_top_remove(struct platform_device *pdev)
 /* sun4i_drv uses this list to check if a device node is a TCON TOP */
 const struct of_device_id sun8i_tcon_top_of_table[] = {
-        { .compatible = "allwinner,sun8i-r40-tcon-top" },
        { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, sun8i_tcon_top_of_table);
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index dbb62f6eb48a..dd9ffded223b 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -432,9 +432,11 @@ static void udl_fbdev_destroy(struct drm_device *dev,
 {
        drm_fb_helper_unregister_fbi(&ufbdev->helper);
        drm_fb_helper_fini(&ufbdev->helper);
-        drm_framebuffer_unregister_private(&ufbdev->ufb.base);
+        if (ufbdev->ufb.obj) {
-        drm_framebuffer_cleanup(&ufbdev->ufb.base);
+                drm_framebuffer_unregister_private(&ufbdev->ufb.base);
-        drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
+                drm_framebuffer_cleanup(&ufbdev->ufb.base);
+                drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
+        }
 }
 int udl_fbdev_init(struct drm_device *dev)
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index cfb50fedfa2b..a3275fa66b7b 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -297,6 +297,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
        vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0],
                                                       vc4_state->crtc_h);
+        vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
+                               vc4_state->y_scaling[0] == VC4_SCALING_NONE);
        if (num_planes > 1) {
                vc4_state->is_yuv = true;
@@ -312,24 +315,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
                        vc4_get_scaling_mode(vc4_state->src_h[1],
                                             vc4_state->crtc_h);
-                /* YUV conversion requires that scaling be enabled,
+                /* YUV conversion requires that horizontal scaling be enabled,
-                 * even on a plane that's otherwise 1:1.  Choose TPZ
+                 * even on a plane that's otherwise 1:1. Looks like only PPF
-                 * for simplicity.
+                 * works in that case, so let's pick that one.
                 */
-                if (vc4_state->x_scaling[0] == VC4_SCALING_NONE)
+                if (vc4_state->is_unity)
-                        vc4_state->x_scaling[0] = VC4_SCALING_TPZ;
+                        vc4_state->x_scaling[0] = VC4_SCALING_PPF;
-                if (vc4_state->y_scaling[0] == VC4_SCALING_NONE)
-                        vc4_state->y_scaling[0] = VC4_SCALING_TPZ;
        } else {
                vc4_state->x_scaling[1] = VC4_SCALING_NONE;
                vc4_state->y_scaling[1] = VC4_SCALING_NONE;
        }
-        vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
-                               vc4_state->y_scaling[0] == VC4_SCALING_NONE &&
-                               vc4_state->x_scaling[1] == VC4_SCALING_NONE &&
-                               vc4_state->y_scaling[1] == VC4_SCALING_NONE);
        /* No configuring scaling on the cursor plane, since it gets
           non-vblank-synced updates, and scaling requires requires
           LBM changes which have to be vblank-synced.
@@ -672,7 +668,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
                vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5);
        }
-        if (!vc4_state->is_unity) {
+        if (vc4_state->x_scaling[0] != VC4_SCALING_NONE ||
+            vc4_state->x_scaling[1] != VC4_SCALING_NONE ||
+            vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
+            vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
                /* LBM Base Address. */
                if (vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
                    vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 1f134570b759..f0ab6b2313bb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -3729,7 +3729,7 @@ int vmw_validate_single_buffer(struct vmw_private *dev_priv,
 {
        struct vmw_buffer_object *vbo =
                container_of(bo, struct vmw_buffer_object, base);
-        struct ttm_operation_ctx ctx = { interruptible, true };
+        struct ttm_operation_ctx ctx = { interruptible, false };
        int ret;
        if (vbo->pin_count > 0)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 23beff5d8e3c..6a712a8d59e9 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1512,21 +1512,19 @@ static int vmw_kms_check_display_memory(struct drm_device *dev,
                                        struct drm_rect *rects)
 {
        struct vmw_private *dev_priv = vmw_priv(dev);
-        struct drm_mode_config *mode_config = &dev->mode_config;
        struct drm_rect bounding_box = {0};
        u64 total_pixels = 0, pixel_mem, bb_mem;
        int i;
        for (i = 0; i < num_rects; i++) {
                /*
-                 * Currently this check is limiting the topology within max
+                 * For STDU only individual screen (screen target) is limited by
-                 * texture/screentarget size. This should change in future when
+                 * SCREENTARGET_MAX_WIDTH/HEIGHT registers.
-                 * user-space support multiple fb with topology.
                 */
-                if (rects[i].x1 < 0 ||  rects[i].y1 < 0 ||
+                if (dev_priv->active_display_unit == vmw_du_screen_target &&
-                    rects[i].x2 > mode_config->max_width ||
+                    (drm_rect_width(&rects[i]) > dev_priv->stdu_max_width ||
-                    rects[i].y2 > mode_config->max_height) {
+                     drm_rect_height(&rects[i]) > dev_priv->stdu_max_height)) {
-                        DRM_ERROR("Invalid GUI layout.\n");
+                        DRM_ERROR("Screen size not supported.\n");
                        return -EINVAL;
                }
@@ -1615,7 +1613,7 @@ static int vmw_kms_check_topology(struct drm_device *dev,
                struct drm_connector_state *conn_state;
                struct vmw_connector_state *vmw_conn_state;
-                if (!new_crtc_state->enable && old_crtc_state->enable) {
+                if (!new_crtc_state->enable) {
                        rects[i].x1 = 0;
                        rects[i].y1 = 0;
                        rects[i].x2 = 0;
@@ -2216,12 +2214,16 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
        if (dev_priv->assume_16bpp)
                assumed_bpp = 2;
+        max_width  = min(max_width,  dev_priv->texture_max_width);
+        max_height = min(max_height, dev_priv->texture_max_height);
+        /*
+         * For STDU extra limit for a mode on SVGA_REG_SCREENTARGET_MAX_WIDTH/
+         * HEIGHT registers.
+         */
        if (dev_priv->active_display_unit == vmw_du_screen_target) {
                max_width  = min(max_width,  dev_priv->stdu_max_width);
-                max_width  = min(max_width,  dev_priv->texture_max_width);
                max_height = min(max_height, dev_priv->stdu_max_height);
-                max_height = min(max_height, dev_priv->texture_max_height);
        }
        /* Add preferred mode */
@@ -2376,6 +2378,7 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                struct drm_file *file_priv)
 {
        struct vmw_private *dev_priv = vmw_priv(dev);
+        struct drm_mode_config *mode_config = &dev->mode_config;
        struct drm_vmw_update_layout_arg *arg =
                (struct drm_vmw_update_layout_arg *)data;
        void __user *user_rects;
@@ -2421,6 +2424,21 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                drm_rects[i].y1 = curr_rect.y;
                drm_rects[i].x2 = curr_rect.x + curr_rect.w;
                drm_rects[i].y2 = curr_rect.y + curr_rect.h;
+                /*
+                 * Currently this check is limiting the topology within
+                 * mode_config->max (which actually is max texture size
+                 * supported by virtual device). This limit is here to address
+                 * window managers that create a big framebuffer for whole
+                 * topology.
+                 */
+                if (drm_rects[i].x1 < 0 ||  drm_rects[i].y1 < 0 ||
+                    drm_rects[i].x2 > mode_config->max_width ||
+                    drm_rects[i].y2 > mode_config->max_height) {
+                        DRM_ERROR("Invalid GUI layout.\n");
+                        ret = -EINVAL;
+                        goto out_free;
+                }
        }
        ret = vmw_kms_check_display_memory(dev, arg->num_outputs, drm_rects);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index 93f6b96ca7bb..f30e839f7bfd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -1600,31 +1600,6 @@ int vmw_kms_stdu_init_display(struct vmw_private *dev_priv)
        dev_priv->active_display_unit = vmw_du_screen_target;
-        if (dev_priv->capabilities & SVGA_CAP_3D) {
-                /*
-                 * For 3D VMs, display (scanout) buffer size is the smaller of
-                 * max texture and max STDU
-                 */
-                uint32_t max_width, max_height;
-                max_width = min(dev_priv->texture_max_width,
-                                dev_priv->stdu_max_width);
-                max_height = min(dev_priv->texture_max_height,
-                                 dev_priv->stdu_max_height);
-                dev->mode_config.max_width = max_width;
-                dev->mode_config.max_height = max_height;
-        } else {
-                /*
-                 * Given various display aspect ratios, there's no way to
-                 * estimate these using prim_bb_mem.  So just set these to
-                 * something arbitrarily large and we will reject any layout
-                 * that doesn't fit prim_bb_mem later
-                 */
-                dev->mode_config.max_width = 8192;
-                dev->mode_config.max_height = 8192;
-        }
        vmw_kms_create_implicit_placement_property(dev_priv, false);
        for (i = 0; i < VMWGFX_NUM_DISPLAY_UNITS; ++i) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index e125233e074b..80a01cd4c051 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1404,22 +1404,17 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
        *srf_out = NULL;
        if (for_scanout) {
-                uint32_t max_width, max_height;
                if (!svga3dsurface_is_screen_target_format(format)) {
                        DRM_ERROR("Invalid Screen Target surface format.");
                        return -EINVAL;
                }
-                max_width = min(dev_priv->texture_max_width,
+                if (size.width > dev_priv->texture_max_width ||
-                                dev_priv->stdu_max_width);
+                    size.height > dev_priv->texture_max_height) {
-                max_height = min(dev_priv->texture_max_height,
-                                 dev_priv->stdu_max_height);
-                if (size.width > max_width || size.height > max_height) {
                        DRM_ERROR("%ux%u\n, exceeds max surface size %ux%u",
                                  size.width, size.height,
-                                  max_width, max_height);
+                                  dev_priv->texture_max_width,
+                                  dev_priv->texture_max_height);
                        return -EINVAL;
                }
        } else {
@@ -1495,8 +1490,17 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
        if (srf->flags & SVGA3D_SURFACE_BIND_STREAM_OUTPUT)
                srf->res.backup_size += sizeof(SVGA3dDXSOState);
+        /*
+         * Don't set SVGA3D_SURFACE_SCREENTARGET flag for a scanout surface with
+         * size greater than STDU max width/height. This is really a workaround
+         * to support creation of big framebuffer requested by some user-space
+         * for whole topology. That big framebuffer won't really be used for
+         * binding with screen target as during prepare_fb a separate surface is
+         * created so it's safe to ignore SVGA3D_SURFACE_SCREENTARGET flag.
+         */
        if (dev_priv->active_display_unit == vmw_du_screen_target &&
-            for_scanout)
+            for_scanout && size.width <= dev_priv->stdu_max_width &&
+            size.height <= dev_priv->stdu_max_height)
                srf->flags |= SVGA3D_SURFACE_SCREENTARGET;
        /*
diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
index a96bf46bc483..cf2a18571d48 100644
--- a/drivers/gpu/vga/vga_switcheroo.c
+++ b/drivers/gpu/vga/vga_switcheroo.c
@@ -215,6 +215,8 @@ static void vga_switcheroo_enable(void)
                        return;
                client->id = ret | ID_BIT_AUDIO;
+                if (client->ops->gpu_bound)
+                        client->ops->gpu_bound(client->pdev, ret);
        }
        vga_switcheroo_debugfs_init(&vgasr_priv);
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 25b7bd56ae11..1cb41992aaa1 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -335,7 +335,8 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                struct hid_field *field, struct hid_usage *usage,
                unsigned long **bit, int *max)
 {
-        if (usage->hid == (HID_UP_CUSTOM | 0x0003)) {
+        if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
+                        usage->hid == (HID_UP_MSVENDOR | 0x0003)) {
                /* The fn key on Apple USB keyboards */
                set_bit(EV_REP, hi->input->evbit);
                hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
@@ -472,6 +473,12 @@ static const struct hid_device_id apple_devices[] = {
                .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI),
                .driver_data = APPLE_HAS_FN },
+        { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI),
+                .driver_data = APPLE_HAS_FN },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ANSI),
                .driver_data = APPLE_HAS_FN },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ISO),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3da354af7a0a..44564f61e9cc 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1000,7 +1000,7 @@ int hid_open_report(struct hid_device *device)
        parser = vzalloc(sizeof(struct hid_parser));
        if (!parser) {
                ret = -ENOMEM;
-                goto err;
+                goto alloc_err;
        }
        parser->device = device;
@@ -1039,6 +1039,7 @@ int hid_open_report(struct hid_device *device)
                                hid_err(device, "unbalanced delimiter at end of report description\n");
                                goto err;
                        }
+                        kfree(parser->collection_stack);
                        vfree(parser);
                        device->status |= HID_STAT_PARSED;
                        return 0;
@@ -1047,6 +1048,8 @@ int hid_open_report(struct hid_device *device)
        hid_err(device, "item fetching failed at offset %d\n", (int)(end - start));
 err:
+        kfree(parser->collection_stack);
+alloc_err:
        vfree(parser);
        hid_close_report(device);
        return ret;
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 79bdf0c7e351..5146ee029db4 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -88,6 +88,7 @@
 #define USB_DEVICE_ID_ANTON_TOUCH_PAD   0x3101
 #define USB_VENDOR_ID_APPLE             0x05ac
+#define BT_VENDOR_ID_APPLE              0x004c
 #define USB_DEVICE_ID_APPLE_MIGHTYMOUSE 0x0304
 #define USB_DEVICE_ID_APPLE_MAGICMOUSE  0x030d
 #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD       0x030e
@@ -157,6 +158,7 @@
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS   0x0257
 #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI   0x0267
+#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI   0x026c
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0290
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0291
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0292
@@ -528,9 +530,6 @@
 #define I2C_VENDOR_ID_HANTICK           0x0911
 #define I2C_PRODUCT_ID_HANTICK_5288     0x5288
-#define I2C_VENDOR_ID_RAYD              0x2386
-#define I2C_PRODUCT_ID_RAYD_3118        0x3118
 #define USB_VENDOR_ID_HANWANG           0x0b57
 #define USB_DEVICE_ID_HANWANG_TABLET_FIRST      0x5000
 #define USB_DEVICE_ID_HANWANG_TABLET_LAST       0x8fff
@@ -950,6 +949,7 @@
 #define USB_DEVICE_ID_SAITEK_RUMBLEPAD  0xff17
 #define USB_DEVICE_ID_SAITEK_PS1000     0x0621
 #define USB_DEVICE_ID_SAITEK_RAT7_OLD   0x0ccb
+#define USB_DEVICE_ID_SAITEK_RAT7_CONTAGION     0x0ccd
 #define USB_DEVICE_ID_SAITEK_RAT7       0x0cd7
 #define USB_DEVICE_ID_SAITEK_RAT9       0x0cfa
 #define USB_DEVICE_ID_SAITEK_MMO7       0x0cd0
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 4e94ea3e280a..a481eaf39e88 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1582,6 +1582,7 @@ static struct hid_input *hidinput_allocate(struct hid_device *hid,
        input_dev->dev.parent = &hid->dev;
        hidinput->input = input_dev;
+        hidinput->application = application;
        list_add_tail(&hidinput->list, &hid->inputs);
        INIT_LIST_HEAD(&hidinput->reports);
@@ -1677,8 +1678,7 @@ static struct hid_input *hidinput_match_application(struct hid_report *report)
        struct hid_input *hidinput;
        list_for_each_entry(hidinput, &hid->inputs, list) {
-                if (hidinput->report &&
+                if (hidinput->application == report->application)
-                    hidinput->report->application == report->application)
                        return hidinput;
        }
@@ -1815,6 +1815,7 @@ void hidinput_disconnect(struct hid_device *hid)
                        input_unregister_device(hidinput->input);
                else
                        input_free_device(hidinput->input);
+                kfree(hidinput->name);
                kfree(hidinput);
        }
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 40fbb7c52723..da954f3f4da7 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1375,7 +1375,8 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
                                     struct hid_usage *usage,
                                     enum latency_mode latency,
                                     bool surface_switch,
-                                     bool button_switch)
+                                     bool button_switch,
+                                     bool *inputmode_found)
 {
        struct mt_device *td = hid_get_drvdata(hdev);
        struct mt_class *cls = &td->mtclass;
@@ -1387,6 +1388,14 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
        switch (usage->hid) {
        case HID_DG_INPUTMODE:
+                /*
+                 * Some elan panels wrongly declare 2 input mode features,
+                 * and silently ignore when we set the value in the second
+                 * field. Skip the second feature and hope for the best.
+                 */
+                if (*inputmode_found)
+                        return false;
                if (cls->quirks & MT_QUIRK_FORCE_GET_FEATURE) {
                        report_len = hid_report_len(report);
                        buf = hid_alloc_report_buf(report, GFP_KERNEL);
@@ -1402,6 +1411,7 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
                }
                field->value[index] = td->inputmode_value;
+                *inputmode_found = true;
                return true;
        case HID_DG_CONTACTMAX:
@@ -1439,6 +1449,7 @@ static void mt_set_modes(struct hid_device *hdev, enum latency_mode latency,
        struct hid_usage *usage;
        int i, j;
        bool update_report;
+        bool inputmode_found = false;
        rep_enum = &hdev->report_enum[HID_FEATURE_REPORT];
        list_for_each_entry(rep, &rep_enum->report_list, list) {
@@ -1457,7 +1468,8 @@ static void mt_set_modes(struct hid_device *hdev, enum latency_mode latency,
                                                             usage,
                                                             latency,
                                                             surface_switch,
-                                                             button_switch))
+                                                             button_switch,
+                                                             &inputmode_found))
                                        update_report = true;
                        }
                }
@@ -1685,6 +1697,9 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
         */
        hdev->quirks |= HID_QUIRK_INPUT_PER_APP;
+        if (id->group != HID_GROUP_MULTITOUCH_WIN_8)
+                hdev->quirks |= HID_QUIRK_MULTI_INPUT;
        timer_setup(&td->release_timer, mt_expired_timeout, 0);
        ret = hid_parse(hdev);
diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
index 39e642686ff0..683861f324e3 100644
--- a/drivers/hid/hid-saitek.c
+++ b/drivers/hid/hid-saitek.c
@@ -183,6 +183,8 @@ static const struct hid_device_id saitek_devices[] = {
                .driver_data = SAITEK_RELEASE_MODE_RAT7 },
        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7),
                .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_CONTAGION),
+                .driver_data = SAITEK_RELEASE_MODE_RAT7 },
        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT9),
                .driver_data = SAITEK_RELEASE_MODE_RAT7 },
        { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9),
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 50af72baa5ca..2b63487057c2 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -579,6 +579,28 @@ void sensor_hub_device_close(struct hid_sensor_hub_device *hsdev)
 }
 EXPORT_SYMBOL_GPL(sensor_hub_device_close);
+static __u8 *sensor_hub_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+                unsigned int *rsize)
+{
+        /*
+         * Checks if the report descriptor of Thinkpad Helix 2 has a logical
+         * minimum for magnetic flux axis greater than the maximum.
+         */
+        if (hdev->product == USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA &&
+                *rsize == 2558 && rdesc[913] == 0x17 && rdesc[914] == 0x40 &&
+                rdesc[915] == 0x81 && rdesc[916] == 0x08 &&
+                rdesc[917] == 0x00 && rdesc[918] == 0x27 &&
+                rdesc[921] == 0x07 && rdesc[922] == 0x00) {
+                /* Sets negative logical minimum for mag x, y and z */
+                rdesc[914] = rdesc[935] = rdesc[956] = 0xc0;
+                rdesc[915] = rdesc[936] = rdesc[957] = 0x7e;
+                rdesc[916] = rdesc[937] = rdesc[958] = 0xf7;
+                rdesc[917] = rdesc[938] = rdesc[959] = 0xff;
+        }
+        return rdesc;
+}
 static int sensor_hub_probe(struct hid_device *hdev,
                                const struct hid_device_id *id)
 {
@@ -743,6 +765,7 @@ static struct hid_driver sensor_hub_driver = {
        .probe = sensor_hub_probe,
        .remove = sensor_hub_remove,
        .raw_event = sensor_hub_raw_event,
+        .report_fixup = sensor_hub_report_fixup,
 #ifdef CONFIG_PM
        .suspend = sensor_hub_suspend,
        .resume = sensor_hub_resume,
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 2ce194a84868..f3076659361a 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -170,8 +170,6 @@ static const struct i2c_hid_quirks {
                I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
        { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
                I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
-        { I2C_VENDOR_ID_RAYD, I2C_PRODUCT_ID_RAYD_3118,
-                I2C_HID_QUIRK_RESEND_REPORT_DESCR },
        { USB_VENDOR_ID_SIS_TOUCH, USB_DEVICE_ID_SIS10FB_TOUCH,
                I2C_HID_QUIRK_RESEND_REPORT_DESCR },
        { 0, 0 }
@@ -1235,11 +1233,16 @@ static int i2c_hid_resume(struct device *dev)
        pm_runtime_enable(dev);
        enable_irq(client->irq);
-        ret = i2c_hid_hwreset(client);
+        /* Instead of resetting device, simply powers the device on. This
+         * solves "incomplete reports" on Raydium devices 2386:3118 and
+         * 2386:4B33
+         */
+        ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
        if (ret)
                return ret;
-        /* RAYDIUM device (2386:3118) need to re-send report descr cmd
+        /* Some devices need to re-send report descr cmd
         * after resume, after this it will be back normal.
         * otherwise it issues too many incomplete reports.
         */
diff --git a/drivers/hid/intel-ish-hid/ipc/hw-ish.h b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
index 97869b7410eb..da133716bed0 100644
--- a/drivers/hid/intel-ish-hid/ipc/hw-ish.h
+++ b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
@@ -29,6 +29,7 @@
 #define CNL_Ax_DEVICE_ID        0x9DFC
 #define GLK_Ax_DEVICE_ID        0x31A2
 #define CNL_H_DEVICE_ID         0xA37C
+#define SPT_H_DEVICE_ID         0xA135
 #define REVISION_ID_CHT_A0      0x6
 #define REVISION_ID_CHT_Ax_SI   0x0
diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
index 050f9872f5c0..a1125a5c7965 100644
--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
@@ -38,6 +38,7 @@ static const struct pci_device_id ish_pci_tbl[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_Ax_DEVICE_ID)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, GLK_Ax_DEVICE_ID)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_H_DEVICE_ID)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, SPT_H_DEVICE_ID)},
        {0, }
 };
 MODULE_DEVICE_TABLE(pci, ish_pci_tbl);
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index b1b548a21f91..c71cc857b649 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -1291,6 +1291,9 @@ static ssize_t vmbus_chan_attr_show(struct kobject *kobj,
        if (!attribute->show)
                return -EIO;
+        if (chan->state != CHANNEL_OPENED_STATE)
+                return -EINVAL;
        return attribute->show(chan, buf);
 }
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index 944f5b63aecd..78603b78cf41 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -207,8 +207,6 @@ superio_exit(int ioreg)
 #define NUM_FAN         7
-#define TEMP_SOURCE_VIRTUAL     0x1f
 /* Common and NCT6775 specific data */
 /* Voltage min/max registers for nr=7..14 are in bank 5 */
@@ -299,8 +297,9 @@ static const u16 NCT6775_REG_PWM_READ[] = {
 static const u16 NCT6775_REG_FAN[] = { 0x630, 0x632, 0x634, 0x636, 0x638 };
 static const u16 NCT6775_REG_FAN_MIN[] = { 0x3b, 0x3c, 0x3d };
-static const u16 NCT6775_REG_FAN_PULSES[] = { 0x641, 0x642, 0x643, 0x644, 0 };
+static const u16 NCT6775_REG_FAN_PULSES[NUM_FAN] = {
-static const u16 NCT6775_FAN_PULSE_SHIFT[] = { 0, 0, 0, 0, 0, 0 };
+        0x641, 0x642, 0x643, 0x644 };
+static const u16 NCT6775_FAN_PULSE_SHIFT[NUM_FAN] = { };
 static const u16 NCT6775_REG_TEMP[] = {
        0x27, 0x150, 0x250, 0x62b, 0x62c, 0x62d };
@@ -373,6 +372,7 @@ static const char *const nct6775_temp_label[] = {
 };
 #define NCT6775_TEMP_MASK       0x001ffffe
+#define NCT6775_VIRT_TEMP_MASK  0x00000000
 static const u16 NCT6775_REG_TEMP_ALTERNATE[32] = {
        [13] = 0x661,
@@ -425,8 +425,8 @@ static const u8 NCT6776_PWM_MODE_MASK[] = { 0x01, 0, 0, 0, 0, 0 };
 static const u16 NCT6776_REG_FAN_MIN[] = {
        0x63a, 0x63c, 0x63e, 0x640, 0x642, 0x64a, 0x64c };
-static const u16 NCT6776_REG_FAN_PULSES[] = {
+static const u16 NCT6776_REG_FAN_PULSES[NUM_FAN] = {
-        0x644, 0x645, 0x646, 0x647, 0x648, 0x649, 0 };
+        0x644, 0x645, 0x646, 0x647, 0x648, 0x649 };
 static const u16 NCT6776_REG_WEIGHT_DUTY_BASE[] = {
        0x13e, 0x23e, 0x33e, 0x83e, 0x93e, 0xa3e };
@@ -461,6 +461,7 @@ static const char *const nct6776_temp_label[] = {
 };
 #define NCT6776_TEMP_MASK       0x007ffffe
+#define NCT6776_VIRT_TEMP_MASK  0x00000000
 static const u16 NCT6776_REG_TEMP_ALTERNATE[32] = {
        [14] = 0x401,
@@ -501,9 +502,9 @@ static const s8 NCT6779_BEEP_BITS[] = {
        30, 31 };                       /* intrusion0, intrusion1 */
 static const u16 NCT6779_REG_FAN[] = {
-        0x4b0, 0x4b2, 0x4b4, 0x4b6, 0x4b8, 0x4ba, 0x660 };
+        0x4c0, 0x4c2, 0x4c4, 0x4c6, 0x4c8, 0x4ca, 0x4ce };
-static const u16 NCT6779_REG_FAN_PULSES[] = {
+static const u16 NCT6779_REG_FAN_PULSES[NUM_FAN] = {
-        0x644, 0x645, 0x646, 0x647, 0x648, 0x649, 0 };
+        0x644, 0x645, 0x646, 0x647, 0x648, 0x649 };
 static const u16 NCT6779_REG_CRITICAL_PWM_ENABLE[] = {
        0x136, 0x236, 0x336, 0x836, 0x936, 0xa36, 0xb36 };
@@ -559,7 +560,9 @@ static const char *const nct6779_temp_label[] = {
 };
 #define NCT6779_TEMP_MASK       0x07ffff7e
+#define NCT6779_VIRT_TEMP_MASK  0x00000000
 #define NCT6791_TEMP_MASK       0x87ffff7e
+#define NCT6791_VIRT_TEMP_MASK  0x80000000
 static const u16 NCT6779_REG_TEMP_ALTERNATE[32]
        = { 0x490, 0x491, 0x492, 0x493, 0x494, 0x495, 0, 0,
@@ -638,6 +641,7 @@ static const char *const nct6792_temp_label[] = {
 };
 #define NCT6792_TEMP_MASK       0x9fffff7e
+#define NCT6792_VIRT_TEMP_MASK  0x80000000
 static const char *const nct6793_temp_label[] = {
        "",
@@ -675,6 +679,7 @@ static const char *const nct6793_temp_label[] = {
 };
 #define NCT6793_TEMP_MASK       0xbfff037e
+#define NCT6793_VIRT_TEMP_MASK  0x80000000
 static const char *const nct6795_temp_label[] = {
        "",
@@ -712,6 +717,7 @@ static const char *const nct6795_temp_label[] = {
 };
 #define NCT6795_TEMP_MASK       0xbfffff7e
+#define NCT6795_VIRT_TEMP_MASK  0x80000000
 static const char *const nct6796_temp_label[] = {
        "",
@@ -724,8 +730,8 @@ static const char *const nct6796_temp_label[] = {
        "AUXTIN4",
        "SMBUSMASTER 0",
        "SMBUSMASTER 1",
-        "",
+        "Virtual_TEMP",
-        "",
+        "Virtual_TEMP",
        "",
        "",
        "",
@@ -748,7 +754,8 @@ static const char *const nct6796_temp_label[] = {
        "Virtual_TEMP"
 };
-#define NCT6796_TEMP_MASK       0xbfff03fe
+#define NCT6796_TEMP_MASK       0xbfff0ffe
+#define NCT6796_VIRT_TEMP_MASK  0x80000c00
 /* NCT6102D/NCT6106D specific data */
@@ -779,8 +786,8 @@ static const u16 NCT6106_REG_TEMP_CONFIG[] = {
 static const u16 NCT6106_REG_FAN[] = { 0x20, 0x22, 0x24 };
 static const u16 NCT6106_REG_FAN_MIN[] = { 0xe0, 0xe2, 0xe4 };
-static const u16 NCT6106_REG_FAN_PULSES[] = { 0xf6, 0xf6, 0xf6, 0, 0 };
+static const u16 NCT6106_REG_FAN_PULSES[] = { 0xf6, 0xf6, 0xf6 };
-static const u16 NCT6106_FAN_PULSE_SHIFT[] = { 0, 2, 4, 0, 0 };
+static const u16 NCT6106_FAN_PULSE_SHIFT[] = { 0, 2, 4 };
 static const u8 NCT6106_REG_PWM_MODE[] = { 0xf3, 0xf3, 0xf3 };
 static const u8 NCT6106_PWM_MODE_MASK[] = { 0x01, 0x02, 0x04 };
@@ -917,6 +924,11 @@ static unsigned int fan_from_reg16(u16 reg, unsigned int divreg)
        return 1350000U / (reg << divreg);
 }
+static unsigned int fan_from_reg_rpm(u16 reg, unsigned int divreg)
+{
+        return reg;
+}
 static u16 fan_to_reg(u32 fan, unsigned int divreg)
 {
        if (!fan)
@@ -969,6 +981,7 @@ struct nct6775_data {
        u16 reg_temp_config[NUM_TEMP];
        const char * const *temp_label;
        u32 temp_mask;
+        u32 virt_temp_mask;
        u16 REG_CONFIG;
        u16 REG_VBAT;
@@ -1276,11 +1289,11 @@ static bool is_word_sized(struct nct6775_data *data, u16 reg)
        case nct6795:
        case nct6796:
                return reg == 0x150 || reg == 0x153 || reg == 0x155 ||
-                  ((reg & 0xfff0) == 0x4b0 && (reg & 0x000f) < 0x0b) ||
+                  (reg & 0xfff0) == 0x4c0 ||
                  reg == 0x402 ||
                  reg == 0x63a || reg == 0x63c || reg == 0x63e ||
                  reg == 0x640 || reg == 0x642 || reg == 0x64a ||
-                  reg == 0x64c || reg == 0x660 ||
+                  reg == 0x64c ||
                  reg == 0x73 || reg == 0x75 || reg == 0x77 || reg == 0x79 ||
                  reg == 0x7b || reg == 0x7d;
        }
@@ -1558,7 +1571,7 @@ static void nct6775_update_pwm(struct device *dev)
                reg = nct6775_read_value(data, data->REG_WEIGHT_TEMP_SEL[i]);
                data->pwm_weight_temp_sel[i] = reg & 0x1f;
                /* If weight is disabled, report weight source as 0 */
-                if (j == 1 && !(reg & 0x80))
+                if (!(reg & 0x80))
                        data->pwm_weight_temp_sel[i] = 0;
                /* Weight temp data */
@@ -1682,9 +1695,13 @@ static struct nct6775_data *nct6775_update_device(struct device *dev)
                        if (data->has_fan_min & BIT(i))
                                data->fan_min[i] = nct6775_read_value(data,
                                           data->REG_FAN_MIN[i]);
-                        data->fan_pulses[i] =
-                          (nct6775_read_value(data, data->REG_FAN_PULSES[i])
+                        if (data->REG_FAN_PULSES[i]) {
-                                >> data->FAN_PULSE_SHIFT[i]) & 0x03;
+                                data->fan_pulses[i] =
+                                  (nct6775_read_value(data,
+                                                      data->REG_FAN_PULSES[i])
+                                   >> data->FAN_PULSE_SHIFT[i]) & 0x03;
+                        }
                        nct6775_select_fan_div(dev, data, i, reg);
                }
@@ -3639,6 +3656,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->temp_label = nct6776_temp_label;
                data->temp_mask = NCT6776_TEMP_MASK;
+                data->virt_temp_mask = NCT6776_VIRT_TEMP_MASK;
                data->REG_VBAT = NCT6106_REG_VBAT;
                data->REG_DIODE = NCT6106_REG_DIODE;
@@ -3717,6 +3735,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->temp_label = nct6775_temp_label;
                data->temp_mask = NCT6775_TEMP_MASK;
+                data->virt_temp_mask = NCT6775_VIRT_TEMP_MASK;
                data->REG_CONFIG = NCT6775_REG_CONFIG;
                data->REG_VBAT = NCT6775_REG_VBAT;
@@ -3789,6 +3808,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->temp_label = nct6776_temp_label;
                data->temp_mask = NCT6776_TEMP_MASK;
+                data->virt_temp_mask = NCT6776_VIRT_TEMP_MASK;
                data->REG_CONFIG = NCT6775_REG_CONFIG;
                data->REG_VBAT = NCT6775_REG_VBAT;
@@ -3853,7 +3873,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->ALARM_BITS = NCT6779_ALARM_BITS;
                data->BEEP_BITS = NCT6779_BEEP_BITS;
-                data->fan_from_reg = fan_from_reg13;
+                data->fan_from_reg = fan_from_reg_rpm;
                data->fan_from_reg_min = fan_from_reg13;
                data->target_temp_mask = 0xff;
                data->tolerance_mask = 0x07;
@@ -3861,6 +3881,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->temp_label = nct6779_temp_label;
                data->temp_mask = NCT6779_TEMP_MASK;
+                data->virt_temp_mask = NCT6779_VIRT_TEMP_MASK;
                data->REG_CONFIG = NCT6775_REG_CONFIG;
                data->REG_VBAT = NCT6775_REG_VBAT;
@@ -3933,7 +3954,7 @@ static int nct6775_probe(struct platform_device *pdev)
                data->ALARM_BITS = NCT6791_ALARM_BITS;
                data->BEEP_BITS = NCT6779_BEEP_BITS;
-                data->fan_from_reg = fan_from_reg13;
+                data->fan_from_reg = fan_from_reg_rpm;
                data->fan_from_reg_min = fan_from_reg13;
                data->target_temp_mask = 0xff;
                data->tolerance_mask = 0x07;
@@ -3944,22 +3965,27 @@ static int nct6775_probe(struct platform_device *pdev)
                case nct6791:
                        data->temp_label = nct6779_temp_label;
                        data->temp_mask = NCT6791_TEMP_MASK;
+                        data->virt_temp_mask = NCT6791_VIRT_TEMP_MASK;
                        break;
                case nct6792:
                        data->temp_label = nct6792_temp_label;
                        data->temp_mask = NCT6792_TEMP_MASK;
+                        data->virt_temp_mask = NCT6792_VIRT_TEMP_MASK;
                        break;
                case nct6793:
                        data->temp_label = nct6793_temp_label;
                        data->temp_mask = NCT6793_TEMP_MASK;
+                        data->virt_temp_mask = NCT6793_VIRT_TEMP_MASK;
                        break;
                case nct6795:
                        data->temp_label = nct6795_temp_label;
                        data->temp_mask = NCT6795_TEMP_MASK;
+                        data->virt_temp_mask = NCT6795_VIRT_TEMP_MASK;
                        break;
                case nct6796:
                        data->temp_label = nct6796_temp_label;
                        data->temp_mask = NCT6796_TEMP_MASK;
+                        data->virt_temp_mask = NCT6796_VIRT_TEMP_MASK;
                        break;
                }
@@ -4143,7 +4169,7 @@ static int nct6775_probe(struct platform_device *pdev)
                 * for each fan reflects a different temperature, and there
                 * are no duplicates.
                 */
-                if (src != TEMP_SOURCE_VIRTUAL) {
+                if (!(data->virt_temp_mask & BIT(src))) {
                        if (mask & BIT(src))
                                continue;
                        mask |= BIT(src);
diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
index 7589f2ad1dae..631360b14ca7 100644
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
@@ -187,12 +187,15 @@ static int st_lsm6dsx_set_fifo_odr(struct st_lsm6dsx_sensor *sensor,
 int st_lsm6dsx_update_watermark(struct st_lsm6dsx_sensor *sensor, u16 watermark)
 {
-        u16 fifo_watermark = ~0, cur_watermark, sip = 0, fifo_th_mask;
+        u16 fifo_watermark = ~0, cur_watermark, fifo_th_mask;
        struct st_lsm6dsx_hw *hw = sensor->hw;
        struct st_lsm6dsx_sensor *cur_sensor;
        int i, err, data;
        __le16 wdata;
+        if (!hw->sip)
+                return 0;
        for (i = 0; i < ST_LSM6DSX_ID_MAX; i++) {
                cur_sensor = iio_priv(hw->iio_devs[i]);
@@ -203,14 +206,10 @@ int st_lsm6dsx_update_watermark(struct st_lsm6dsx_sensor *sensor, u16 watermark)
                                                       : cur_sensor->watermark;
                fifo_watermark = min_t(u16, fifo_watermark, cur_watermark);
-                sip += cur_sensor->sip;
        }
-        if (!sip)
+        fifo_watermark = max_t(u16, fifo_watermark, hw->sip);
-                return 0;
+        fifo_watermark = (fifo_watermark / hw->sip) * hw->sip;
-        fifo_watermark = max_t(u16, fifo_watermark, sip);
-        fifo_watermark = (fifo_watermark / sip) * sip;
        fifo_watermark = fifo_watermark * hw->settings->fifo_ops.th_wl;
        err = regmap_read(hw->regmap, hw->settings->fifo_ops.fifo_th.addr + 1,
diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c
index 54e383231d1e..c31b9633f32d 100644
--- a/drivers/iio/temperature/maxim_thermocouple.c
+++ b/drivers/iio/temperature/maxim_thermocouple.c
@@ -258,7 +258,6 @@ static int maxim_thermocouple_remove(struct spi_device *spi)
 static const struct spi_device_id maxim_thermocouple_id[] = {
        {"max6675", MAX6675},
        {"max31855", MAX31855},
-        {"max31856", MAX31855},
        {},
 };
 MODULE_DEVICE_TABLE(spi, maxim_thermocouple_id);
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f72677291b69..a36c94930c31 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -724,6 +724,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
        dgid = (union ib_gid *) &addr->sib_addr;
        pkey = ntohs(addr->sib_pkey);
+        mutex_lock(&lock);
        list_for_each_entry(cur_dev, &dev_list, list) {
                for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) {
                        if (!rdma_cap_af_ib(cur_dev->device, p))
@@ -750,18 +751,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
                                        cma_dev = cur_dev;
                                        sgid = gid;
                                        id_priv->id.port_num = p;
+                                        goto found;
                                }
                        }
                }
        }
+        mutex_unlock(&lock);
-        if (!cma_dev)
+        return -ENODEV;
-                return -ENODEV;
 found:
        cma_attach_to_dev(id_priv, cma_dev);
-        addr = (struct sockaddr_ib *) cma_src_addr(id_priv);
+        mutex_unlock(&lock);
-        memcpy(&addr->sib_addr, &sgid, sizeof sgid);
+        addr = (struct sockaddr_ib *)cma_src_addr(id_priv);
+        memcpy(&addr->sib_addr, &sgid, sizeof(sgid));
        cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);
        return 0;
 }
diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
index 6eb64c6f0802..c4118bcd5103 100644
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -882,6 +882,8 @@ static int __uverbs_cleanup_ufile(struct ib_uverbs_file *ufile,
                WARN_ON(uverbs_try_lock_object(obj, UVERBS_LOOKUP_WRITE));
                if (!uverbs_destroy_uobject(obj, reason))
                        ret = 0;
+                else
+                        atomic_set(&obj->usecnt, 0);
        }
        return ret;
 }
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ec8fb289621f..5f437d1570fb 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -124,6 +124,8 @@ static DEFINE_MUTEX(mut);
 static DEFINE_IDR(ctx_idr);
 static DEFINE_IDR(multicast_idr);
+static const struct file_operations ucma_fops;
 static inline struct ucma_context *_ucma_find_context(int id,
                                                      struct ucma_file *file)
 {
@@ -1581,6 +1583,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file,
        f = fdget(cmd.fd);
        if (!f.file)
                return -ENOENT;
+        if (f.file->f_op != &ucma_fops) {
+                ret = -EINVAL;
+                goto file_put;
+        }
        /* Validate current fd and prevent destruction of id. */
        ctx = ucma_get_ctx(f.file->private_data, cmd.id);
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 823beca448e1..6d974e2363df 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -1050,7 +1050,7 @@ static void ib_uverbs_add_one(struct ib_device *device)
        uverbs_dev->num_comp_vectors = device->num_comp_vectors;
        if (ib_uverbs_create_uapi(device, uverbs_dev))
-                goto err;
+                goto err_uapi;
        cdev_init(&uverbs_dev->cdev, NULL);
        uverbs_dev->cdev.owner = THIS_MODULE;
@@ -1077,11 +1077,10 @@ static void ib_uverbs_add_one(struct ib_device *device)
 err_class:
        device_destroy(uverbs_class, uverbs_dev->cdev.dev);
 err_cdev:
        cdev_del(&uverbs_dev->cdev);
+err_uapi:
        clear_bit(devnum, dev_map);
 err:
        if (atomic_dec_and_test(&uverbs_dev->refcount))
                ib_uverbs_comp_dev(uverbs_dev);
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index bbfb86eb2d24..bc2b9e038439 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -833,6 +833,8 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
                                "Failed to destroy Shadow QP");
                        return rc;
                }
+                bnxt_qplib_free_qp_res(&rdev->qplib_res,
+                                       &rdev->qp1_sqp->qplib_qp);
                mutex_lock(&rdev->qp_lock);
                list_del(&rdev->qp1_sqp->list);
                atomic_dec(&rdev->qp_count);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index e426b990c1dd..6ad0d46ab879 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -196,7 +196,7 @@ static int bnxt_qplib_alloc_qp_hdr_buf(struct bnxt_qplib_res *res,
                                       struct bnxt_qplib_qp *qp)
 {
        struct bnxt_qplib_q *rq = &qp->rq;
-        struct bnxt_qplib_q *sq = &qp->rq;
+        struct bnxt_qplib_q *sq = &qp->sq;
        int rc = 0;
        if (qp->sq_hdr_buf_size && sq->hwq.max_elements) {
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index b3203afa3b1d..347fe18b1a41 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1685,6 +1685,12 @@ static void flush_qp(struct c4iw_qp *qhp)
        schp = to_c4iw_cq(qhp->ibqp.send_cq);
        if (qhp->ibqp.uobject) {
+                /* for user qps, qhp->wq.flushed is protected by qhp->mutex */
+                if (qhp->wq.flushed)
+                        return;
+                qhp->wq.flushed = 1;
                t4_set_wq_in_error(&qhp->wq, 0);
                t4_set_cq_in_error(&rchp->cq);
                spin_lock_irqsave(&rchp->comp_handler_lock, flag);
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index eec83757d55f..6c967dde58e7 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -893,14 +893,11 @@ static int trigger_sbr(struct hfi1_devdata *dd)
                }
        /*
-         * A secondary bus reset (SBR) issues a hot reset to our device.
+         * This is an end around to do an SBR during probe time. A new API needs
-         * The following routine does a 1s wait after the reset is dropped
+         * to be implemented to have cleaner interface but this fixes the
-         * per PCI Trhfa (recovery time).  PCIe 3.0 section 6.6.1 -
+         * current brokenness
-         * Conventional Reset, paragraph 3, line 35 also says that a 1s
-         * delay after a reset is required.  Per spec requirements,
-         * the link is either working or not after that point.
         */
-        return pci_reset_bus(dev);
+        return pci_bridge_secondary_bus_reset(dev->bus->self);
 }
 /*
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ca0f1ee26091..0bbeaaae47e0 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -517,9 +517,11 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
        props->page_size_cap       = dev->dev->caps.page_size_cap;
        props->max_qp              = dev->dev->quotas.qp;
        props->max_qp_wr           = dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE;
-        props->max_send_sge        = dev->dev->caps.max_sq_sg;
+        props->max_send_sge =
-        props->max_recv_sge        = dev->dev->caps.max_rq_sg;
+                min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg);
-        props->max_sge_rd          = MLX4_MAX_SGE_RD;
+        props->max_recv_sge =
+                min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg);
+        props->max_sge_rd = MLX4_MAX_SGE_RD;
        props->max_cq              = dev->dev->quotas.cq;
        props->max_cqe             = dev->dev->caps.max_cqes;
        props->max_mr              = dev->dev->quotas.mpt;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index ea01b8dd2be6..3d5424f335cb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1027,12 +1027,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id,
        skb_queue_head_init(&skqueue);
+        netif_tx_lock_bh(p->dev);
        spin_lock_irq(&priv->lock);
        set_bit(IPOIB_FLAG_OPER_UP, &p->flags);
        if (p->neigh)
                while ((skb = __skb_dequeue(&p->neigh->queue)))
                        __skb_queue_tail(&skqueue, skb);
        spin_unlock_irq(&priv->lock);
+        netif_tx_unlock_bh(p->dev);
        while ((skb = __skb_dequeue(&skqueue))) {
                skb->dev = p->dev;
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index f266c81f396f..0481223b1deb 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -332,7 +332,7 @@ static int crypt_iv_essiv_init(struct crypt_config *cc)
        int err;
        desc->tfm = essiv->hash_tfm;
-        desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+        desc->flags = 0;
        err = crypto_shash_digest(desc, cc->key, cc->key_size, essiv->salt);
        shash_desc_zero(desc);
@@ -606,7 +606,7 @@ static int crypt_iv_lmk_one(struct crypt_config *cc, u8 *iv,
        int i, r;
        desc->tfm = lmk->hash_tfm;
-        desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+        desc->flags = 0;
        r = crypto_shash_init(desc);
        if (r)
@@ -768,7 +768,7 @@ static int crypt_iv_tcw_whitening(struct crypt_config *cc,
        /* calculate crc32 for every 32bit part and xor it */
        desc->tfm = tcw->crc32_tfm;
-        desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+        desc->flags = 0;
        for (i = 0; i < 4; i++) {
                r = crypto_shash_init(desc);
                if (r)
@@ -1251,7 +1251,7 @@ static void crypt_alloc_req_skcipher(struct crypt_config *cc,
         * requests if driver request queue is full.
         */
        skcipher_request_set_callback(ctx->r.req,
-            CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
+            CRYPTO_TFM_REQ_MAY_BACKLOG,
            kcryptd_async_done, dmreq_of_req(cc, ctx->r.req));
 }
@@ -1268,7 +1268,7 @@ static void crypt_alloc_req_aead(struct crypt_config *cc,
         * requests if driver request queue is full.
         */
        aead_request_set_callback(ctx->r.req_aead,
-            CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
+            CRYPTO_TFM_REQ_MAY_BACKLOG,
            kcryptd_async_done, dmreq_of_req(cc, ctx->r.req_aead));
 }
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 378878599466..89ccb64342de 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -532,7 +532,7 @@ static void section_mac(struct dm_integrity_c *ic, unsigned section, __u8 result
        unsigned j, size;
        desc->tfm = ic->journal_mac;
-        desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+        desc->flags = 0;
        r = crypto_shash_init(desc);
        if (unlikely(r)) {
@@ -676,7 +676,7 @@ static void complete_journal_encrypt(struct crypto_async_request *req, int err)
 static bool do_crypt(bool encrypt, struct skcipher_request *req, struct journal_completion *comp)
 {
        int r;
-        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
+        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
                                      complete_journal_encrypt, comp);
        if (likely(encrypt))
                r = crypto_skcipher_encrypt(req);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index cae689de75fd..5ba067fa0c72 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2010-2011 Neil Brown
- * Copyright (C) 2010-2017 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2010-2018 Red Hat, Inc. All rights reserved.
 *
 * This file is released under the GPL.
 */
@@ -29,9 +29,6 @@
 */
 #define MIN_RAID456_JOURNAL_SPACE (4*2048)
-/* Global list of all raid sets */
-static LIST_HEAD(raid_sets);
 static bool devices_handle_discard_safely = false;
 /*
@@ -227,7 +224,6 @@ struct rs_layout {
 struct raid_set {
        struct dm_target *ti;
-        struct list_head list;
        uint32_t stripe_cache_entries;
        unsigned long ctr_flags;
@@ -273,19 +269,6 @@ static void rs_config_restore(struct raid_set *rs, struct rs_layout *l)
        mddev->new_chunk_sectors = l->new_chunk_sectors;
 }
-/* Find any raid_set in active slot for @rs on global list */
-static struct raid_set *rs_find_active(struct raid_set *rs)
-{
-        struct raid_set *r;
-        struct mapped_device *md = dm_table_get_md(rs->ti->table);
-        list_for_each_entry(r, &raid_sets, list)
-                if (r != rs && dm_table_get_md(r->ti->table) == md)
-                        return r;
-        return NULL;
-}
 /* raid10 algorithms (i.e. formats) */
 #define ALGORITHM_RAID10_DEFAULT        0
 #define ALGORITHM_RAID10_NEAR           1
@@ -764,7 +747,6 @@ static struct raid_set *raid_set_alloc(struct dm_target *ti, struct raid_type *r
        mddev_init(&rs->md);
-        INIT_LIST_HEAD(&rs->list);
        rs->raid_disks = raid_devs;
        rs->delta_disks = 0;
@@ -782,9 +764,6 @@ static struct raid_set *raid_set_alloc(struct dm_target *ti, struct raid_type *r
        for (i = 0; i < raid_devs; i++)
                md_rdev_init(&rs->dev[i].rdev);
-        /* Add @rs to global list. */
-        list_add(&rs->list, &raid_sets);
        /*
         * Remaining items to be initialized by further RAID params:
         *  rs->md.persistent
@@ -797,7 +776,7 @@ static struct raid_set *raid_set_alloc(struct dm_target *ti, struct raid_type *r
        return rs;
 }
-/* Free all @rs allocations and remove it from global list. */
+/* Free all @rs allocations */
 static void raid_set_free(struct raid_set *rs)
 {
        int i;
@@ -815,8 +794,6 @@ static void raid_set_free(struct raid_set *rs)
                        dm_put_device(rs->ti, rs->dev[i].data_dev);
        }
-        list_del(&rs->list);
        kfree(rs);
 }
@@ -2649,7 +2626,7 @@ static int rs_adjust_data_offsets(struct raid_set *rs)
                return 0;
        }
-        /* HM FIXME: get InSync raid_dev? */
+        /* HM FIXME: get In_Sync raid_dev? */
        rdev = &rs->dev[0].rdev;
        if (rs->delta_disks < 0) {
@@ -3149,6 +3126,11 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
                rs_set_new(rs);
        } else if (rs_is_recovering(rs)) {
+                /* Rebuild particular devices */
+                if (test_bit(__CTR_FLAG_REBUILD, &rs->ctr_flags)) {
+                        set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
+                        rs_setup_recovery(rs, MaxSector);
+                }
                /* A recovering raid set may be resized */
                ; /* skip setup rs */
        } else if (rs_is_reshaping(rs)) {
@@ -3242,6 +3224,8 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
        /* Start raid set read-only and assumed clean to change in raid_resume() */
        rs->md.ro = 1;
        rs->md.in_sync = 1;
+        /* Keep array frozen */
        set_bit(MD_RECOVERY_FROZEN, &rs->md.recovery);
        /* Has to be held on running the array */
@@ -3265,7 +3249,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
        rs->callbacks.congested_fn = raid_is_congested;
        dm_table_add_target_callbacks(ti->table, &rs->callbacks);
-        /* If raid4/5/6 journal mode explictely requested (only possible with journal dev) -> set it */
+        /* If raid4/5/6 journal mode explicitly requested (only possible with journal dev) -> set it */
        if (test_bit(__CTR_FLAG_JOURNAL_MODE, &rs->ctr_flags)) {
                r = r5c_journal_mode_set(&rs->md, rs->journal_dev.mode);
                if (r) {
@@ -3350,32 +3334,53 @@ static int raid_map(struct dm_target *ti, struct bio *bio)
        return DM_MAPIO_SUBMITTED;
 }
-/* Return string describing the current sync action of @mddev */
+/* Return sync state string for @state */
-static const char *decipher_sync_action(struct mddev *mddev, unsigned long recovery)
+enum sync_state { st_frozen, st_reshape, st_resync, st_check, st_repair, st_recover, st_idle };
+static const char *sync_str(enum sync_state state)
+{
+        /* Has to be in above sync_state order! */
+        static const char *sync_strs[] = {
+                "frozen",
+                "reshape",
+                "resync",
+                "check",
+                "repair",
+                "recover",
+                "idle"
+        };
+        return __within_range(state, 0, ARRAY_SIZE(sync_strs) - 1) ? sync_strs[state] : "undef";
+};
+/* Return enum sync_state for @mddev derived from @recovery flags */
+static const enum sync_state decipher_sync_action(struct mddev *mddev, unsigned long recovery)
 {
        if (test_bit(MD_RECOVERY_FROZEN, &recovery))
-                return "frozen";
+                return st_frozen;
-        /* The MD sync thread can be done with io but still be running */
+        /* The MD sync thread can be done with io or be interrupted but still be running */
        if (!test_bit(MD_RECOVERY_DONE, &recovery) &&
            (test_bit(MD_RECOVERY_RUNNING, &recovery) ||
             (!mddev->ro && test_bit(MD_RECOVERY_NEEDED, &recovery)))) {
                if (test_bit(MD_RECOVERY_RESHAPE, &recovery))
-                        return "reshape";
+                        return st_reshape;
                if (test_bit(MD_RECOVERY_SYNC, &recovery)) {
                        if (!test_bit(MD_RECOVERY_REQUESTED, &recovery))
-                                return "resync";
+                                return st_resync;
-                        else if (test_bit(MD_RECOVERY_CHECK, &recovery))
+                        if (test_bit(MD_RECOVERY_CHECK, &recovery))
-                                return "check";
+                                return st_check;
-                        return "repair";
+                        return st_repair;
                }
                if (test_bit(MD_RECOVERY_RECOVER, &recovery))
-                        return "recover";
+                        return st_recover;
+                if (mddev->reshape_position != MaxSector)
+                        return st_reshape;
        }
-        return "idle";
+        return st_idle;
 }
 /*
@@ -3409,6 +3414,7 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                                sector_t resync_max_sectors)
 {
        sector_t r;
+        enum sync_state state;
        struct mddev *mddev = &rs->md;
        clear_bit(RT_FLAG_RS_IN_SYNC, &rs->runtime_flags);
@@ -3419,20 +3425,14 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                set_bit(RT_FLAG_RS_IN_SYNC, &rs->runtime_flags);
        } else {
-                if (!test_bit(__CTR_FLAG_NOSYNC, &rs->ctr_flags) &&
+                state = decipher_sync_action(mddev, recovery);
-                    !test_bit(MD_RECOVERY_INTR, &recovery) &&
-                    (test_bit(MD_RECOVERY_NEEDED, &recovery) ||
+                if (state == st_idle && !test_bit(MD_RECOVERY_INTR, &recovery))
-                     test_bit(MD_RECOVERY_RESHAPE, &recovery) ||
-                     test_bit(MD_RECOVERY_RUNNING, &recovery)))
-                        r = mddev->curr_resync_completed;
-                else
                        r = mddev->recovery_cp;
+                else
+                        r = mddev->curr_resync_completed;
-                if (r >= resync_max_sectors &&
+                if (state == st_idle && r >= resync_max_sectors) {
-                    (!test_bit(MD_RECOVERY_REQUESTED, &recovery) ||
-                     (!test_bit(MD_RECOVERY_FROZEN, &recovery) &&
-                      !test_bit(MD_RECOVERY_NEEDED, &recovery) &&
-                      !test_bit(MD_RECOVERY_RUNNING, &recovery)))) {
                        /*
                         * Sync complete.
                         */
@@ -3440,24 +3440,20 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                        if (test_bit(MD_RECOVERY_RECOVER, &recovery))
                                set_bit(RT_FLAG_RS_IN_SYNC, &rs->runtime_flags);
-                } else if (test_bit(MD_RECOVERY_RECOVER, &recovery)) {
+                } else if (state == st_recover)
                        /*
                         * In case we are recovering, the array is not in sync
                         * and health chars should show the recovering legs.
                         */
                        ;
+                else if (state == st_resync)
-                } else if (test_bit(MD_RECOVERY_SYNC, &recovery) &&
-                           !test_bit(MD_RECOVERY_REQUESTED, &recovery)) {
                        /*
                         * If "resync" is occurring, the raid set
                         * is or may be out of sync hence the health
                         * characters shall be 'a'.
                         */
                        set_bit(RT_FLAG_RS_RESYNCING, &rs->runtime_flags);
+                else if (state == st_reshape)
-                } else if (test_bit(MD_RECOVERY_RESHAPE, &recovery) &&
-                           !test_bit(MD_RECOVERY_REQUESTED, &recovery)) {
                        /*
                         * If "reshape" is occurring, the raid set
                         * is or may be out of sync hence the health
@@ -3465,7 +3461,7 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                         */
                        set_bit(RT_FLAG_RS_RESYNCING, &rs->runtime_flags);
-                } else if (test_bit(MD_RECOVERY_REQUESTED, &recovery)) {
+                else if (state == st_check || state == st_repair)
                        /*
                         * If "check" or "repair" is occurring, the raid set has
                         * undergone an initial sync and the health characters
@@ -3473,12 +3469,12 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                         */
                        set_bit(RT_FLAG_RS_IN_SYNC, &rs->runtime_flags);
-                } else {
+                else {
                        struct md_rdev *rdev;
                        /*
                         * We are idle and recovery is needed, prevent 'A' chars race
-                         * caused by components still set to in-sync by constrcuctor.
+                         * caused by components still set to in-sync by constructor.
                         */
                        if (test_bit(MD_RECOVERY_NEEDED, &recovery))
                                set_bit(RT_FLAG_RS_RESYNCING, &rs->runtime_flags);
@@ -3542,7 +3538,7 @@ static void raid_status(struct dm_target *ti, status_type_t type,
                progress = rs_get_progress(rs, recovery, resync_max_sectors);
                resync_mismatches = (mddev->last_sync_action && !strcasecmp(mddev->last_sync_action, "check")) ?
                                    atomic64_read(&mddev->resync_mismatches) : 0;
-                sync_action = decipher_sync_action(&rs->md, recovery);
+                sync_action = sync_str(decipher_sync_action(&rs->md, recovery));
                /* HM FIXME: do we want another state char for raid0? It shows 'D'/'A'/'-' now */
                for (i = 0; i < rs->raid_disks; i++)
@@ -3892,14 +3888,13 @@ static int rs_start_reshape(struct raid_set *rs)
        struct mddev *mddev = &rs->md;
        struct md_personality *pers = mddev->pers;
+        /* Don't allow the sync thread to work until the table gets reloaded. */
+        set_bit(MD_RECOVERY_WAIT, &mddev->recovery);
        r = rs_setup_reshape(rs);
        if (r)
                return r;
-        /* Need to be resumed to be able to start reshape, recovery is frozen until raid_resume() though */
-        if (test_and_clear_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags))
-                mddev_resume(mddev);
        /*
         * Check any reshape constraints enforced by the personalility
         *
@@ -3923,10 +3918,6 @@ static int rs_start_reshape(struct raid_set *rs)
                }
        }
-        /* Suspend because a resume will happen in raid_resume() */
-        set_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags);
-        mddev_suspend(mddev);
        /*
         * Now reshape got set up, update superblocks to
         * reflect the fact so that a table reload will
@@ -3947,29 +3938,6 @@ static int raid_preresume(struct dm_target *ti)
        if (test_and_set_bit(RT_FLAG_RS_PRERESUMED, &rs->runtime_flags))
                return 0;
-        if (!test_bit(__CTR_FLAG_REBUILD, &rs->ctr_flags)) {
-                struct raid_set *rs_active = rs_find_active(rs);
-                if (rs_active) {
-                        /*
-                         * In case no rebuilds have been requested
-                         * and an active table slot exists, copy
-                         * current resynchonization completed and
-                         * reshape position pointers across from
-                         * suspended raid set in the active slot.
-                         *
-                         * This resumes the new mapping at current
-                         * offsets to continue recover/reshape without
-                         * necessarily redoing a raid set partially or
-                         * causing data corruption in case of a reshape.
-                         */
-                        if (rs_active->md.curr_resync_completed != MaxSector)
-                                mddev->curr_resync_completed = rs_active->md.curr_resync_completed;
-                        if (rs_active->md.reshape_position != MaxSector)
-                                mddev->reshape_position = rs_active->md.reshape_position;
-                }
-        }
        /*
         * The superblocks need to be updated on disk if the
         * array is new or new devices got added (thus zeroed
@@ -4046,7 +4014,7 @@ static void raid_resume(struct dm_target *ti)
 static struct target_type raid_target = {
        .name = "raid",
-        .version = {1, 13, 2},
+        .version = {1, 14, 0},
        .module = THIS_MODULE,
        .ctr = raid_ctr,
        .dtr = raid_dtr,
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 72142021b5c9..74f6770c70b1 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -189,6 +189,12 @@ struct dm_pool_metadata {
        sector_t data_block_size;
        /*
+         * We reserve a section of the metadata for commit overhead.
+         * All reported space does *not* include this.
+         */
+        dm_block_t metadata_reserve;
+        /*
         * Set if a transaction has to be aborted but the attempt to roll back
         * to the previous (good) transaction failed.  The only pool metadata
         * operation possible in this state is the closing of the device.
@@ -816,6 +822,22 @@ static int __commit_transaction(struct dm_pool_metadata *pmd)
        return dm_tm_commit(pmd->tm, sblock);
 }
+static void __set_metadata_reserve(struct dm_pool_metadata *pmd)
+{
+        int r;
+        dm_block_t total;
+        dm_block_t max_blocks = 4096; /* 16M */
+        r = dm_sm_get_nr_blocks(pmd->metadata_sm, &total);
+        if (r) {
+                DMERR("could not get size of metadata device");
+                pmd->metadata_reserve = max_blocks;
+        } else {
+                sector_div(total, 10);
+                pmd->metadata_reserve = min(max_blocks, total);
+        }
+}
 struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev,
                                               sector_t data_block_size,
                                               bool format_device)
@@ -849,6 +871,8 @@ struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev,
                return ERR_PTR(r);
        }
+        __set_metadata_reserve(pmd);
        return pmd;
 }
@@ -1820,6 +1844,13 @@ int dm_pool_get_free_metadata_block_count(struct dm_pool_metadata *pmd,
        down_read(&pmd->root_lock);
        if (!pmd->fail_io)
                r = dm_sm_get_nr_free(pmd->metadata_sm, result);
+        if (!r) {
+                if (*result < pmd->metadata_reserve)
+                        *result = 0;
+                else
+                        *result -= pmd->metadata_reserve;
+        }
        up_read(&pmd->root_lock);
        return r;
@@ -1932,8 +1963,11 @@ int dm_pool_resize_metadata_dev(struct dm_pool_metadata *pmd, dm_block_t new_cou
        int r = -EINVAL;
        down_write(&pmd->root_lock);
-        if (!pmd->fail_io)
+        if (!pmd->fail_io) {
                r = __resize_space_map(pmd->metadata_sm, new_count);
+                if (!r)
+                        __set_metadata_reserve(pmd);
+        }
        up_write(&pmd->root_lock);
        return r;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 7bd60a150f8f..aaf1ad481ee8 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -200,7 +200,13 @@ struct dm_thin_new_mapping;
 enum pool_mode {
        PM_WRITE,               /* metadata may be changed */
        PM_OUT_OF_DATA_SPACE,   /* metadata may be changed, though data may not be allocated */
+        /*
+         * Like READ_ONLY, except may switch back to WRITE on metadata resize. Reported as READ_ONLY.
+         */
+        PM_OUT_OF_METADATA_SPACE,
        PM_READ_ONLY,           /* metadata may not be changed */
        PM_FAIL,                /* all I/O fails */
 };
@@ -1371,7 +1377,35 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
 static void requeue_bios(struct pool *pool);
-static void check_for_space(struct pool *pool)
+static bool is_read_only_pool_mode(enum pool_mode mode)
+{
+        return (mode == PM_OUT_OF_METADATA_SPACE || mode == PM_READ_ONLY);
+}
+static bool is_read_only(struct pool *pool)
+{
+        return is_read_only_pool_mode(get_pool_mode(pool));
+}
+static void check_for_metadata_space(struct pool *pool)
+{
+        int r;
+        const char *ooms_reason = NULL;
+        dm_block_t nr_free;
+        r = dm_pool_get_free_metadata_block_count(pool->pmd, &nr_free);
+        if (r)
+                ooms_reason = "Could not get free metadata blocks";
+        else if (!nr_free)
+                ooms_reason = "No free metadata blocks";
+        if (ooms_reason && !is_read_only(pool)) {
+                DMERR("%s", ooms_reason);
+                set_pool_mode(pool, PM_OUT_OF_METADATA_SPACE);
+        }
+}
+static void check_for_data_space(struct pool *pool)
 {
        int r;
        dm_block_t nr_free;
@@ -1397,14 +1431,16 @@ static int commit(struct pool *pool)
 {
        int r;
-        if (get_pool_mode(pool) >= PM_READ_ONLY)
+        if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE)
                return -EINVAL;
        r = dm_pool_commit_metadata(pool->pmd);
        if (r)
                metadata_operation_failed(pool, "dm_pool_commit_metadata", r);
-        else
+        else {
-                check_for_space(pool);
+                check_for_metadata_space(pool);
+                check_for_data_space(pool);
+        }
        return r;
 }
@@ -1470,6 +1506,19 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                return r;
        }
+        r = dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks);
+        if (r) {
+                metadata_operation_failed(pool, "dm_pool_get_free_metadata_block_count", r);
+                return r;
+        }
+        if (!free_blocks) {
+                /* Let's commit before we use up the metadata reserve. */
+                r = commit(pool);
+                if (r)
+                        return r;
+        }
        return 0;
 }
@@ -1501,6 +1550,7 @@ static blk_status_t should_error_unserviceable_bio(struct pool *pool)
        case PM_OUT_OF_DATA_SPACE:
                return pool->pf.error_if_no_space ? BLK_STS_NOSPC : 0;
+        case PM_OUT_OF_METADATA_SPACE:
        case PM_READ_ONLY:
        case PM_FAIL:
                return BLK_STS_IOERR;
@@ -2464,8 +2514,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                error_retry_list(pool);
                break;
+        case PM_OUT_OF_METADATA_SPACE:
        case PM_READ_ONLY:
-                if (old_mode != new_mode)
+                if (!is_read_only_pool_mode(old_mode))
                        notify_of_pool_mode_change(pool, "read-only");
                dm_pool_metadata_read_only(pool->pmd);
                pool->process_bio = process_bio_read_only;
@@ -3403,6 +3454,10 @@ static int maybe_resize_metadata_dev(struct dm_target *ti, bool *need_commit)
                DMINFO("%s: growing the metadata device from %llu to %llu blocks",
                       dm_device_name(pool->pool_md),
                       sb_metadata_dev_size, metadata_dev_size);
+                if (get_pool_mode(pool) == PM_OUT_OF_METADATA_SPACE)
+                        set_pool_mode(pool, PM_WRITE);
                r = dm_pool_resize_metadata_dev(pool->pmd, metadata_dev_size);
                if (r) {
                        metadata_operation_failed(pool, "dm_pool_resize_metadata_dev", r);
@@ -3707,7 +3762,7 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv,
        struct pool_c *pt = ti->private;
        struct pool *pool = pt->pool;
-        if (get_pool_mode(pool) >= PM_READ_ONLY) {
+        if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE) {
                DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode",
                      dm_device_name(pool->pool_md));
                return -EOPNOTSUPP;
@@ -3781,6 +3836,7 @@ static void pool_status(struct dm_target *ti, status_type_t type,
        dm_block_t nr_blocks_data;
        dm_block_t nr_blocks_metadata;
        dm_block_t held_root;
+        enum pool_mode mode;
        char buf[BDEVNAME_SIZE];
        char buf2[BDEVNAME_SIZE];
        struct pool_c *pt = ti->private;
@@ -3851,9 +3907,10 @@ static void pool_status(struct dm_target *ti, status_type_t type,
                else
                        DMEMIT("- ");
-                if (pool->pf.mode == PM_OUT_OF_DATA_SPACE)
+                mode = get_pool_mode(pool);
+                if (mode == PM_OUT_OF_DATA_SPACE)
                        DMEMIT("out_of_data_space ");
-                else if (pool->pf.mode == PM_READ_ONLY)
+                else if (is_read_only_pool_mode(mode))
                        DMEMIT("ro ");
                else
                        DMEMIT("rw ");
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index 12decdbd722d..fc65f0dedf7f 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -99,10 +99,26 @@ static int verity_hash_update(struct dm_verity *v, struct ahash_request *req,
 {
        struct scatterlist sg;
-        sg_init_one(&sg, data, len);
+        if (likely(!is_vmalloc_addr(data))) {
-        ahash_request_set_crypt(req, &sg, NULL, len);
+                sg_init_one(&sg, data, len);
+                ahash_request_set_crypt(req, &sg, NULL, len);
-        return crypto_wait_req(crypto_ahash_update(req), wait);
+                return crypto_wait_req(crypto_ahash_update(req), wait);
+        } else {
+                do {
+                        int r;
+                        size_t this_step = min_t(size_t, len, PAGE_SIZE - offset_in_page(data));
+                        flush_kernel_vmap_range((void *)data, this_step);
+                        sg_init_table(&sg, 1);
+                        sg_set_page(&sg, vmalloc_to_page(data), this_step, offset_in_page(data));
+                        ahash_request_set_crypt(req, &sg, NULL, this_step);
+                        r = crypto_wait_req(crypto_ahash_update(req), wait);
+                        if (unlikely(r))
+                                return r;
+                        data += this_step;
+                        len -= this_step;
+                } while (len);
+                return 0;
+        }
 }
 /*
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index e11ab12fbdf2..800986a79704 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -528,8 +528,8 @@ static int usbhs_omap_get_dt_pdata(struct device *dev,
 }
 static const struct of_device_id usbhs_child_match_table[] = {
-        { .compatible = "ti,omap-ehci", },
+        { .compatible = "ti,ehci-omap", },
-        { .compatible = "ti,omap-ohci", },
+        { .compatible = "ti,ohci-omap3", },
        { }
 };
@@ -855,6 +855,7 @@ static struct platform_driver usbhs_omap_driver = {
                .pm             = &usbhsomap_dev_pm_ops,
                .of_match_table = usbhs_omap_dt_ids,
        },
+        .probe          = usbhs_omap_probe,
        .remove         = usbhs_omap_remove,
 };
@@ -864,9 +865,9 @@ MODULE_ALIAS("platform:" USBHS_DRIVER_NAME);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("usb host common core driver for omap EHCI and OHCI");
-static int __init omap_usbhs_drvinit(void)
+static int omap_usbhs_drvinit(void)
 {
-        return platform_driver_probe(&usbhs_omap_driver, usbhs_omap_probe);
+        return platform_driver_register(&usbhs_omap_driver);
 }
 /*
@@ -878,7 +879,7 @@ static int __init omap_usbhs_drvinit(void)
 */
 fs_initcall_sync(omap_usbhs_drvinit);
-static void __exit omap_usbhs_drvexit(void)
+static void omap_usbhs_drvexit(void)
 {
        platform_driver_unregister(&usbhs_omap_driver);
 }
diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c
index eeb7eef62174..38f90e179927 100644
--- a/drivers/misc/hmc6352.c
+++ b/drivers/misc/hmc6352.c
@@ -27,6 +27,7 @@
 #include <linux/err.h>
 #include <linux/delay.h>
 #include <linux/sysfs.h>
+#include <linux/nospec.h>
 static DEFINE_MUTEX(compass_mutex);
@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count,
                return ret;
        if (val >= strlen(map))
                return -EINVAL;
+        val = array_index_nospec(val, strlen(map));
        mutex_lock(&compass_mutex);
        ret = compass_command(c, map[val]);
        mutex_unlock(&compass_mutex);
diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index 8f82bb9d11e2..b8aaa684c397 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -2131,7 +2131,7 @@ static int ibmvmc_init_crq_queue(struct crq_server_adapter *adapter)
        retrc = plpar_hcall_norets(H_REG_CRQ,
                                   vdev->unit_address,
                                   queue->msg_token, PAGE_SIZE);
-        retrc = rc;
+        rc = retrc;
        if (rc == H_RESOURCE)
                rc = ibmvmc_reset_crq_queue(adapter);
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 7bba62a72921..fc3872fe7b25 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -521,17 +521,15 @@ int mei_cldev_enable(struct mei_cl_device *cldev)
        cl = cldev->cl;
+        mutex_lock(&bus->device_lock);
        if (cl->state == MEI_FILE_UNINITIALIZED) {
-                mutex_lock(&bus->device_lock);
                ret = mei_cl_link(cl);
-                mutex_unlock(&bus->device_lock);
                if (ret)
-                        return ret;
+                        goto out;
                /* update pointers */
                cl->cldev = cldev;
        }
-        mutex_lock(&bus->device_lock);
        if (mei_cl_is_connected(cl)) {
                ret = 0;
                goto out;
@@ -616,9 +614,8 @@ int mei_cldev_disable(struct mei_cl_device *cldev)
        if (err < 0)
                dev_err(bus->dev, "Could not disconnect from the ME client\n");
-out:
        mei_cl_bus_module_put(cldev);
+out:
        /* Flush queues and remove any pending read */
        mei_cl_flush_queues(cl, NULL);
        mei_cl_unlink(cl);
@@ -876,12 +873,13 @@ static void mei_cl_bus_dev_release(struct device *dev)
        mei_me_cl_put(cldev->me_cl);
        mei_dev_bus_put(cldev->bus);
+        mei_cl_unlink(cldev->cl);
        kfree(cldev->cl);
        kfree(cldev);
 }
 static const struct device_type mei_cl_device_type = {
-        .release        = mei_cl_bus_dev_release,
+        .release = mei_cl_bus_dev_release,
 };
 /**
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 4ab6251d418e..ebdcf0b450e2 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -1767,7 +1767,7 @@ out:
                }
        }
-        rets = buf->size;
+        rets = len;
 err:
        cl_dbg(dev, cl, "rpm: autosuspend\n");
        pm_runtime_mark_last_busy(dev->dev);
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 09e233d4c0de..e56f3e72d57a 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -1161,15 +1161,18 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                props_res = (struct hbm_props_response *)mei_msg;
-                if (props_res->status) {
+                if (props_res->status == MEI_HBMS_CLIENT_NOT_FOUND) {
+                        dev_dbg(dev->dev, "hbm: properties response: %d CLIENT_NOT_FOUND\n",
+                                props_res->me_addr);
+                } else if (props_res->status) {
                        dev_err(dev->dev, "hbm: properties response: wrong status = %d %s\n",
                                props_res->status,
                                mei_hbm_status_str(props_res->status));
                        return -EPROTO;
+                } else {
+                        mei_hbm_me_cl_add(dev, props_res);
                }
-                mei_hbm_me_cl_add(dev, props_res);
                /* request property for the next client */
                if (mei_hbm_prop_req(dev, props_res->me_addr + 1))
                        return -EIO;
diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
index 09cb89645d06..2cfec33178c1 100644
--- a/drivers/mmc/host/meson-mx-sdio.c
+++ b/drivers/mmc/host/meson-mx-sdio.c
@@ -517,19 +517,23 @@ static struct mmc_host_ops meson_mx_mmc_ops = {
 static struct platform_device *meson_mx_mmc_slot_pdev(struct device *parent)
 {
        struct device_node *slot_node;
+        struct platform_device *pdev;
        /*
         * TODO: the MMC core framework currently does not support
         * controllers with multiple slots properly. So we only register
         * the first slot for now
         */
-        slot_node = of_find_compatible_node(parent->of_node, NULL, "mmc-slot");
+        slot_node = of_get_compatible_child(parent->of_node, "mmc-slot");
        if (!slot_node) {
                dev_warn(parent, "no 'mmc-slot' sub-node found\n");
                return ERR_PTR(-ENOENT);
        }
-        return of_platform_device_create(slot_node, NULL, parent);
+        pdev = of_platform_device_create(slot_node, NULL, parent);
+        of_node_put(slot_node);
+        return pdev;
 }
 static int meson_mx_mmc_add_host(struct meson_mx_mmc_host *host)
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 071693ebfe18..68760d4a5d3d 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -2177,6 +2177,7 @@ static int omap_hsmmc_remove(struct platform_device *pdev)
        dma_release_channel(host->tx_chan);
        dma_release_channel(host->rx_chan);
+        dev_pm_clear_wake_irq(host->dev);
        pm_runtime_dont_use_autosuspend(host->dev);
        pm_runtime_put_sync(host->dev);
        pm_runtime_disable(host->dev);
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index cbfafc453274..270d3c9580c5 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -39,13 +39,23 @@ static int m25p80_read_reg(struct spi_nor *nor, u8 code, u8 *val, int len)
        struct spi_mem_op op = SPI_MEM_OP(SPI_MEM_OP_CMD(code, 1),
                                          SPI_MEM_OP_NO_ADDR,
                                          SPI_MEM_OP_NO_DUMMY,
-                                          SPI_MEM_OP_DATA_IN(len, val, 1));
+                                          SPI_MEM_OP_DATA_IN(len, NULL, 1));
+        void *scratchbuf;
        int ret;
+        scratchbuf = kmalloc(len, GFP_KERNEL);
+        if (!scratchbuf)
+                return -ENOMEM;
+        op.data.buf.in = scratchbuf;
        ret = spi_mem_exec_op(flash->spimem, &op);
        if (ret < 0)
                dev_err(&flash->spimem->spi->dev, "error %d reading %x\n", ret,
                        code);
+        else
+                memcpy(val, scratchbuf, len);
+        kfree(scratchbuf);
        return ret;
 }
@@ -56,9 +66,19 @@ static int m25p80_write_reg(struct spi_nor *nor, u8 opcode, u8 *buf, int len)
        struct spi_mem_op op = SPI_MEM_OP(SPI_MEM_OP_CMD(opcode, 1),
                                          SPI_MEM_OP_NO_ADDR,
                                          SPI_MEM_OP_NO_DUMMY,
-                                          SPI_MEM_OP_DATA_OUT(len, buf, 1));
+                                          SPI_MEM_OP_DATA_OUT(len, NULL, 1));
+        void *scratchbuf;
+        int ret;
-        return spi_mem_exec_op(flash->spimem, &op);
+        scratchbuf = kmemdup(buf, len, GFP_KERNEL);
+        if (!scratchbuf)
+                return -ENOMEM;
+        op.data.buf.out = scratchbuf;
+        ret = spi_mem_exec_op(flash->spimem, &op);
+        kfree(scratchbuf);
+        return ret;
 }
 static ssize_t m25p80_write(struct spi_nor *nor, loff_t to, size_t len,
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 52e2cb35fc79..99c460facd5e 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -873,8 +873,11 @@ static int mtd_part_of_parse(struct mtd_info *master,
        int ret, err = 0;
        np = mtd_get_of_node(master);
-        if (!mtd_is_partition(master))
+        if (mtd_is_partition(master))
+                of_node_get(np);
+        else
                np = of_get_child_by_name(np, "partitions");
        of_property_for_each_string(np, "compatible", prop, compat) {
                parser = mtd_part_get_compatible_parser(compat);
                if (!parser)
diff --git a/drivers/mtd/nand/raw/denali.c b/drivers/mtd/nand/raw/denali.c
index 67b2065e7a19..b864b93dd289 100644
--- a/drivers/mtd/nand/raw/denali.c
+++ b/drivers/mtd/nand/raw/denali.c
@@ -596,6 +596,12 @@ static int denali_dma_xfer(struct denali_nand_info *denali, void *buf,
        }
        iowrite32(DMA_ENABLE__FLAG, denali->reg + DMA_ENABLE);
+        /*
+         * The ->setup_dma() hook kicks DMA by using the data/command
+         * interface, which belongs to a different AXI port from the
+         * register interface.  Read back the register to avoid a race.
+         */
+        ioread32(denali->reg + DMA_ENABLE);
        denali_reset_irq(denali);
        denali->setup_dma(denali, dma_addr, page, write);
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 7af4d6213ee5..bc2ef5209783 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -1547,7 +1547,7 @@ static void marvell_nfc_parse_instructions(struct nand_chip *chip,
        for (op_id = 0; op_id < subop->ninstrs; op_id++) {
                unsigned int offset, naddrs;
                const u8 *addrs;
-                int len = nand_subop_get_data_len(subop, op_id);
+                int len;
                instr = &subop->instrs[op_id];
@@ -1593,6 +1593,7 @@ static void marvell_nfc_parse_instructions(struct nand_chip *chip,
                                nfc_op->ndcb[0] |=
                                        NDCB0_CMD_XTYPE(XTYPE_MONOLITHIC_RW) |
                                        NDCB0_LEN_OVRD;
+                                len = nand_subop_get_data_len(subop, op_id);
                                nfc_op->ndcb[3] |= round_up(len, FIFO_DEPTH);
                        }
                        nfc_op->data_delay_ns = instr->delay_ns;
@@ -1606,6 +1607,7 @@ static void marvell_nfc_parse_instructions(struct nand_chip *chip,
                                nfc_op->ndcb[0] |=
                                        NDCB0_CMD_XTYPE(XTYPE_MONOLITHIC_RW) |
                                        NDCB0_LEN_OVRD;
+                                len = nand_subop_get_data_len(subop, op_id);
                                nfc_op->ndcb[3] |= round_up(len, FIFO_DEPTH);
                        }
                        nfc_op->data_delay_ns = instr->delay_ns;
diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
index 9375cef22420..3d27616d9c85 100644
--- a/drivers/net/appletalk/ipddp.c
+++ b/drivers/net/appletalk/ipddp.c
@@ -283,8 +283,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                case SIOCFINDIPDDPRT:
                        spin_lock_bh(&ipddp_route_lock);
                        rp = __ipddp_find_route(&rcp);
-                        if (rp)
+                        if (rp) {
-                                memcpy(&rcp2, rp, sizeof(rcp2));
+                                memset(&rcp2, 0, sizeof(rcp2));
+                                rcp2.ip    = rp->ip;
+                                rcp2.at    = rp->at;
+                                rcp2.flags = rp->flags;
+                        }
                        spin_unlock_bh(&ipddp_route_lock);
                        if (rp) {
diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h
index 7c791c1da4b9..bef01331266f 100644
--- a/drivers/net/dsa/mv88e6xxx/global1.h
+++ b/drivers/net/dsa/mv88e6xxx/global1.h
@@ -128,7 +128,7 @@
 #define MV88E6XXX_G1_ATU_OP_GET_CLR_VIOLATION           0x7000
 #define MV88E6XXX_G1_ATU_OP_AGE_OUT_VIOLATION           BIT(7)
 #define MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION            BIT(6)
-#define MV88E6XXX_G1_ATU_OP_MISS_VIOLTATION             BIT(5)
+#define MV88E6XXX_G1_ATU_OP_MISS_VIOLATION              BIT(5)
 #define MV88E6XXX_G1_ATU_OP_FULL_VIOLATION              BIT(4)
 /* Offset 0x0C: ATU Data Register */
diff --git a/drivers/net/dsa/mv88e6xxx/global1_atu.c b/drivers/net/dsa/mv88e6xxx/global1_atu.c
index 307410898fc9..5200e4bdce93 100644
--- a/drivers/net/dsa/mv88e6xxx/global1_atu.c
+++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c
@@ -349,7 +349,7 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
                chip->ports[entry.portvec].atu_member_violation++;
        }
-        if (val & MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION) {
+        if (val & MV88E6XXX_G1_ATU_OP_MISS_VIOLATION) {
                dev_err_ratelimited(chip->dev,
                                    "ATU miss violation for %pM portvec %x\n",
                                    entry.mac, entry.portvec);
diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 17f12c18d225..7635c38e77dd 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -459,12 +459,12 @@ static void ena_com_handle_admin_completion(struct ena_com_admin_queue *admin_qu
        cqe = &admin_queue->cq.entries[head_masked];
        /* Go over all the completions */
-        while ((cqe->acq_common_descriptor.flags &
+        while ((READ_ONCE(cqe->acq_common_descriptor.flags) &
                        ENA_ADMIN_ACQ_COMMON_DESC_PHASE_MASK) == phase) {
                /* Do not read the rest of the completion entry before the
                 * phase bit was validated
                 */
-                rmb();
+                dma_rmb();
                ena_com_handle_single_admin_completion(admin_queue, cqe);
                head_masked++;
@@ -627,17 +627,10 @@ static u32 ena_com_reg_bar_read32(struct ena_com_dev *ena_dev, u16 offset)
        mmio_read_reg |= mmio_read->seq_num &
                        ENA_REGS_MMIO_REG_READ_REQ_ID_MASK;
-        /* make sure read_resp->req_id get updated before the hw can write
+        writel(mmio_read_reg, ena_dev->reg_bar + ENA_REGS_MMIO_REG_READ_OFF);
-         * there
-         */
-        wmb();
-        writel_relaxed(mmio_read_reg,
-                       ena_dev->reg_bar + ENA_REGS_MMIO_REG_READ_OFF);
-        mmiowb();
        for (i = 0; i < timeout; i++) {
-                if (read_resp->req_id == mmio_read->seq_num)
+                if (READ_ONCE(read_resp->req_id) == mmio_read->seq_num)
                        break;
                udelay(1);
@@ -1796,8 +1789,13 @@ void ena_com_aenq_intr_handler(struct ena_com_dev *dev, void *data)
        aenq_common = &aenq_e->aenq_common_desc;
        /* Go over all the events */
-        while ((aenq_common->flags & ENA_ADMIN_AENQ_COMMON_DESC_PHASE_MASK) ==
+        while ((READ_ONCE(aenq_common->flags) &
-               phase) {
+                ENA_ADMIN_AENQ_COMMON_DESC_PHASE_MASK) == phase) {
+                /* Make sure the phase bit (ownership) is as expected before
+                 * reading the rest of the descriptor.
+                 */
+                dma_rmb();
                pr_debug("AENQ! Group[%x] Syndrom[%x] timestamp: [%llus]\n",
                         aenq_common->group, aenq_common->syndrom,
                         (u64)aenq_common->timestamp_low +
diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.c b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
index ea149c134e15..1c682b76190f 100644
--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
@@ -51,6 +51,11 @@ static inline struct ena_eth_io_rx_cdesc_base *ena_com_get_next_rx_cdesc(
        if (desc_phase != expected_phase)
                return NULL;
+        /* Make sure we read the rest of the descriptor after the phase bit
+         * has been read
+         */
+        dma_rmb();
        return cdesc;
 }
@@ -493,6 +498,7 @@ int ena_com_tx_comp_req_id_get(struct ena_com_io_cq *io_cq, u16 *req_id)
        if (cdesc_phase != expected_phase)
                return -EAGAIN;
+        dma_rmb();
        if (unlikely(cdesc->req_id >= io_cq->q_depth)) {
                pr_err("Invalid req id %d\n", cdesc->req_id);
                return -EINVAL;
diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.h b/drivers/net/ethernet/amazon/ena/ena_eth_com.h
index 6fdc753d9483..2f7657227cfe 100644
--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.h
+++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.h
@@ -107,8 +107,7 @@ static inline int ena_com_sq_empty_space(struct ena_com_io_sq *io_sq)
        return io_sq->q_depth - 1 - cnt;
 }
-static inline int ena_com_write_sq_doorbell(struct ena_com_io_sq *io_sq,
+static inline int ena_com_write_sq_doorbell(struct ena_com_io_sq *io_sq)
-                                            bool relaxed)
 {
        u16 tail;
@@ -117,10 +116,7 @@ static inline int ena_com_write_sq_doorbell(struct ena_com_io_sq *io_sq,
        pr_debug("write submission queue doorbell for queue: %d tail: %d\n",
                 io_sq->qid, tail);
-        if (relaxed)
+        writel(tail, io_sq->db_addr);
-                writel_relaxed(tail, io_sq->db_addr);
-        else
-                writel(tail, io_sq->db_addr);
        return 0;
 }
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index c673ac2df65b..29b5774dd32d 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -76,7 +76,7 @@ MODULE_DEVICE_TABLE(pci, ena_pci_tbl);
 static int ena_rss_init_default(struct ena_adapter *adapter);
 static void check_for_admin_com_state(struct ena_adapter *adapter);
-static void ena_destroy_device(struct ena_adapter *adapter);
+static void ena_destroy_device(struct ena_adapter *adapter, bool graceful);
 static int ena_restore_device(struct ena_adapter *adapter);
 static void ena_tx_timeout(struct net_device *dev)
@@ -461,7 +461,7 @@ static inline int ena_alloc_rx_page(struct ena_ring *rx_ring,
                return -ENOMEM;
        }
-        dma = dma_map_page(rx_ring->dev, page, 0, PAGE_SIZE,
+        dma = dma_map_page(rx_ring->dev, page, 0, ENA_PAGE_SIZE,
                           DMA_FROM_DEVICE);
        if (unlikely(dma_mapping_error(rx_ring->dev, dma))) {
                u64_stats_update_begin(&rx_ring->syncp);
@@ -478,7 +478,7 @@ static inline int ena_alloc_rx_page(struct ena_ring *rx_ring,
        rx_info->page_offset = 0;
        ena_buf = &rx_info->ena_buf;
        ena_buf->paddr = dma;
-        ena_buf->len = PAGE_SIZE;
+        ena_buf->len = ENA_PAGE_SIZE;
        return 0;
 }
@@ -495,7 +495,7 @@ static void ena_free_rx_page(struct ena_ring *rx_ring,
                return;
        }
-        dma_unmap_page(rx_ring->dev, ena_buf->paddr, PAGE_SIZE,
+        dma_unmap_page(rx_ring->dev, ena_buf->paddr, ENA_PAGE_SIZE,
                       DMA_FROM_DEVICE);
        __free_page(page);
@@ -551,14 +551,9 @@ static int ena_refill_rx_bufs(struct ena_ring *rx_ring, u32 num)
                            rx_ring->qid, i, num);
        }
-        if (likely(i)) {
+        /* ena_com_write_sq_doorbell issues a wmb() */
-                /* Add memory barrier to make sure the desc were written before
+        if (likely(i))
-                 * issue a doorbell
+                ena_com_write_sq_doorbell(rx_ring->ena_com_io_sq);
-                 */
-                wmb();
-                ena_com_write_sq_doorbell(rx_ring->ena_com_io_sq, true);
-                mmiowb();
-        }
        rx_ring->next_to_use = next_to_use;
@@ -916,10 +911,10 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
        do {
                dma_unmap_page(rx_ring->dev,
                               dma_unmap_addr(&rx_info->ena_buf, paddr),
-                               PAGE_SIZE, DMA_FROM_DEVICE);
+                               ENA_PAGE_SIZE, DMA_FROM_DEVICE);
                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, rx_info->page,
-                                rx_info->page_offset, len, PAGE_SIZE);
+                                rx_info->page_offset, len, ENA_PAGE_SIZE);
                netif_dbg(rx_ring->adapter, rx_status, rx_ring->netdev,
                          "rx skb updated. len %d. data_len %d\n",
@@ -1900,7 +1895,7 @@ static int ena_close(struct net_device *netdev)
                          "Destroy failure, restarting device\n");
                ena_dump_stats_to_dmesg(adapter);
                /* rtnl lock already obtained in dev_ioctl() layer */
-                ena_destroy_device(adapter);
+                ena_destroy_device(adapter, false);
                ena_restore_device(adapter);
        }
@@ -2112,12 +2107,6 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
        tx_ring->next_to_use = ENA_TX_RING_IDX_NEXT(next_to_use,
                tx_ring->ring_size);
-        /* This WMB is aimed to:
-         * 1 - perform smp barrier before reading next_to_completion
-         * 2 - make sure the desc were written before trigger DB
-         */
-        wmb();
        /* stop the queue when no more space available, the packet can have up
         * to sgl_size + 2. one for the meta descriptor and one for header
         * (if the header is larger than tx_max_header_size).
@@ -2136,10 +2125,11 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 * stop the queue but meanwhile clean_tx_irq updates
                 * next_to_completion and terminates.
                 * The queue will remain stopped forever.
-                 * To solve this issue this function perform rmb, check
+                 * To solve this issue add a mb() to make sure that
-                 * the wakeup condition and wake up the queue if needed.
+                 * netif_tx_stop_queue() write is vissible before checking if
+                 * there is additional space in the queue.
                 */
-                smp_rmb();
+                smp_mb();
                if (ena_com_sq_empty_space(tx_ring->ena_com_io_sq)
                                > ENA_TX_WAKEUP_THRESH) {
@@ -2151,8 +2141,10 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        if (netif_xmit_stopped(txq) || !skb->xmit_more) {
-                /* trigger the dma engine */
+                /* trigger the dma engine. ena_com_write_sq_doorbell()
-                ena_com_write_sq_doorbell(tx_ring->ena_com_io_sq, false);
+                 * has a mb
+                 */
+                ena_com_write_sq_doorbell(tx_ring->ena_com_io_sq);
                u64_stats_update_begin(&tx_ring->syncp);
                tx_ring->tx_stats.doorbells++;
                u64_stats_update_end(&tx_ring->syncp);
@@ -2550,12 +2542,15 @@ err_disable_msix:
        return rc;
 }
-static void ena_destroy_device(struct ena_adapter *adapter)
+static void ena_destroy_device(struct ena_adapter *adapter, bool graceful)
 {
        struct net_device *netdev = adapter->netdev;
        struct ena_com_dev *ena_dev = adapter->ena_dev;
        bool dev_up;
+        if (!test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
+                return;
        netif_carrier_off(netdev);
        del_timer_sync(&adapter->timer_service);
@@ -2563,7 +2558,8 @@ static void ena_destroy_device(struct ena_adapter *adapter)
        dev_up = test_bit(ENA_FLAG_DEV_UP, &adapter->flags);
        adapter->dev_up_before_reset = dev_up;
-        ena_com_set_admin_running_state(ena_dev, false);
+        if (!graceful)
+                ena_com_set_admin_running_state(ena_dev, false);
        if (test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
                ena_down(adapter);
@@ -2591,6 +2587,7 @@ static void ena_destroy_device(struct ena_adapter *adapter)
        adapter->reset_reason = ENA_REGS_RESET_NORMAL;
        clear_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
+        clear_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
 }
 static int ena_restore_device(struct ena_adapter *adapter)
@@ -2635,6 +2632,7 @@ static int ena_restore_device(struct ena_adapter *adapter)
                }
        }
+        set_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
        mod_timer(&adapter->timer_service, round_jiffies(jiffies + HZ));
        dev_err(&pdev->dev, "Device reset completed successfully\n");
@@ -2665,7 +2663,7 @@ static void ena_fw_reset_device(struct work_struct *work)
                return;
        }
        rtnl_lock();
-        ena_destroy_device(adapter);
+        ena_destroy_device(adapter, false);
        ena_restore_device(adapter);
        rtnl_unlock();
 }
@@ -3409,30 +3407,24 @@ static void ena_remove(struct pci_dev *pdev)
                netdev->rx_cpu_rmap = NULL;
        }
 #endif /* CONFIG_RFS_ACCEL */
-        unregister_netdev(netdev);
        del_timer_sync(&adapter->timer_service);
        cancel_work_sync(&adapter->reset_task);
-        /* Reset the device only if the device is running. */
+        unregister_netdev(netdev);
-        if (test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
-                ena_com_dev_reset(ena_dev, adapter->reset_reason);
-        ena_free_mgmnt_irq(adapter);
+        /* If the device is running then we want to make sure the device will be
+         * reset to make sure no more events will be issued by the device.
+         */
+        if (test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
+                set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
-        ena_disable_msix(adapter);
+        rtnl_lock();
+        ena_destroy_device(adapter, true);
+        rtnl_unlock();
        free_netdev(netdev);
-        ena_com_mmio_reg_read_request_destroy(ena_dev);
-        ena_com_abort_admin_commands(ena_dev);
-        ena_com_wait_for_abort_completion(ena_dev);
-        ena_com_admin_destroy(ena_dev);
        ena_com_rss_destroy(ena_dev);
        ena_com_delete_debug_area(ena_dev);
@@ -3467,7 +3459,7 @@ static int ena_suspend(struct pci_dev *pdev,  pm_message_t state)
                        "ignoring device reset request as the device is being suspended\n");
                clear_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
        }
-        ena_destroy_device(adapter);
+        ena_destroy_device(adapter, true);
        rtnl_unlock();
        return 0;
 }
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index f1972b5ab650..7c7ae56c52cf 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -355,4 +355,15 @@ void ena_dump_stats_to_buf(struct ena_adapter *adapter, u8 *buf);
 int ena_get_sset_count(struct net_device *netdev, int sset);
+/* The ENA buffer length fields is 16 bit long. So when PAGE_SIZE == 64kB the
+ * driver passas 0.
+ * Since the max packet size the ENA handles is ~9kB limit the buffer length to
+ * 16kB.
+ */
+#if PAGE_SIZE > SZ_16K
+#define ENA_PAGE_SIZE SZ_16K
+#else
+#define ENA_PAGE_SIZE PAGE_SIZE
+#endif
 #endif /* !(ENA_H) */
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index cecbb1d1f587..177587f9c3f1 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -8027,7 +8027,7 @@ static int bnxt_change_mac_addr(struct net_device *dev, void *p)
        if (ether_addr_equal(addr->sa_data, dev->dev_addr))
                return 0;
-        rc = bnxt_approve_mac(bp, addr->sa_data);
+        rc = bnxt_approve_mac(bp, addr->sa_data, true);
        if (rc)
                return rc;
@@ -8827,14 +8827,19 @@ static int bnxt_init_mac_addr(struct bnxt *bp)
        } else {
 #ifdef CONFIG_BNXT_SRIOV
                struct bnxt_vf_info *vf = &bp->vf;
+                bool strict_approval = true;
                if (is_valid_ether_addr(vf->mac_addr)) {
                        /* overwrite netdev dev_addr with admin VF MAC */
                        memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN);
+                        /* Older PF driver or firmware may not approve this
+                         * correctly.
+                         */
+                        strict_approval = false;
                } else {
                        eth_hw_addr_random(bp->dev);
                }
-                rc = bnxt_approve_mac(bp, bp->dev->dev_addr);
+                rc = bnxt_approve_mac(bp, bp->dev->dev_addr, strict_approval);
 #endif
        }
        return rc;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index fcd085a9853a..3962f6fd543c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -1104,7 +1104,7 @@ update_vf_mac_exit:
        mutex_unlock(&bp->hwrm_cmd_lock);
 }
-int bnxt_approve_mac(struct bnxt *bp, u8 *mac)
+int bnxt_approve_mac(struct bnxt *bp, u8 *mac, bool strict)
 {
        struct hwrm_func_vf_cfg_input req = {0};
        int rc = 0;
@@ -1122,12 +1122,13 @@ int bnxt_approve_mac(struct bnxt *bp, u8 *mac)
        memcpy(req.dflt_mac_addr, mac, ETH_ALEN);
        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
 mac_done:
-        if (rc) {
+        if (rc && strict) {
                rc = -EADDRNOTAVAIL;
                netdev_warn(bp->dev, "VF MAC address %pM not approved by the PF\n",
                            mac);
+                return rc;
        }
-        return rc;
+        return 0;
 }
 #else
@@ -1144,7 +1145,7 @@ void bnxt_update_vf_mac(struct bnxt *bp)
 {
 }
-int bnxt_approve_mac(struct bnxt *bp, u8 *mac)
+int bnxt_approve_mac(struct bnxt *bp, u8 *mac, bool strict)
 {
        return 0;
 }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
index e9b20cd19881..2eed9eda1195 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
@@ -39,5 +39,5 @@ int bnxt_sriov_configure(struct pci_dev *pdev, int num_vfs);
 void bnxt_sriov_disable(struct bnxt *);
 void bnxt_hwrm_exec_fwd_req(struct bnxt *);
 void bnxt_update_vf_mac(struct bnxt *);
-int bnxt_approve_mac(struct bnxt *, u8 *);
+int bnxt_approve_mac(struct bnxt *, u8 *, bool);
 #endif
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 16e4ef7d7185..f1a86b422617 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -3837,6 +3837,13 @@ static const struct macb_config at91sam9260_config = {
        .init = macb_init,
 };
+static const struct macb_config sama5d3macb_config = {
+        .caps = MACB_CAPS_SG_DISABLED
+              | MACB_CAPS_USRIO_HAS_CLKEN | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII,
+        .clk_init = macb_clk_init,
+        .init = macb_init,
+};
 static const struct macb_config pc302gem_config = {
        .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE,
        .dma_burst_length = 16,
@@ -3904,6 +3911,7 @@ static const struct of_device_id macb_dt_ids[] = {
        { .compatible = "cdns,gem", .data = &pc302gem_config },
        { .compatible = "atmel,sama5d2-gem", .data = &sama5d2_config },
        { .compatible = "atmel,sama5d3-gem", .data = &sama5d3_config },
+        { .compatible = "atmel,sama5d3-macb", .data = &sama5d3macb_config },
        { .compatible = "atmel,sama5d4-gem", .data = &sama5d4_config },
        { .compatible = "cdns,at91rm9200-emac", .data = &emac_config },
        { .compatible = "cdns,emac", .data = &emac_config },
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index ff92ab1daeb8..1e9d882c04ef 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -4500,7 +4500,7 @@ int be_cmd_get_profile_config(struct be_adapter *adapter,
                                port_res->max_vfs += le16_to_cpu(pcie->num_vfs);
                        }
                }
-                return status;
+                goto err;
        }
        pcie = be_get_pcie_desc(resp->func_param, desc_count,
diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c
index c8c7ad2eff77..9b5a68b65432 100644
--- a/drivers/net/ethernet/hp/hp100.c
+++ b/drivers/net/ethernet/hp/hp100.c
@@ -2634,7 +2634,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin)
                /* Wait for link to drop */
                time = jiffies + (HZ / 10);
                do {
-                        if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
+                        if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
                                break;
                        if (!in_interrupt())
                                schedule_timeout_interruptible(1);
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 7a637b51c7d2..e08301d833e2 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -274,6 +274,7 @@ ltq_etop_hw_init(struct net_device *dev)
                struct ltq_etop_chan *ch = &priv->ch[i];
                ch->idx = ch->dma.nr = i;
+                ch->dma.dev = &priv->pdev->dev;
                if (IS_TX(i)) {
                        ltq_dma_alloc_tx(&ch->dma);
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index 28500417843e..702fec82d806 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -58,6 +58,8 @@ static struct {
 */
 static void mvpp2_mac_config(struct net_device *dev, unsigned int mode,
                             const struct phylink_link_state *state);
+static void mvpp2_mac_link_up(struct net_device *dev, unsigned int mode,
+                              phy_interface_t interface, struct phy_device *phy);
 /* Queue modes */
 #define MVPP2_QDIST_SINGLE_MODE 0
@@ -3142,6 +3144,7 @@ static void mvpp2_start_dev(struct mvpp2_port *port)
                mvpp22_mode_reconfigure(port);
        if (port->phylink) {
+                netif_carrier_off(port->dev);
                phylink_start(port->phylink);
        } else {
                /* Phylink isn't used as of now for ACPI, so the MAC has to be
@@ -3150,9 +3153,10 @@ static void mvpp2_start_dev(struct mvpp2_port *port)
                 */
                struct phylink_link_state state = {
                        .interface = port->phy_interface,
-                        .link = 1,
                };
                mvpp2_mac_config(port->dev, MLO_AN_INBAND, &state);
+                mvpp2_mac_link_up(port->dev, MLO_AN_INBAND, port->phy_interface,
+                                  NULL);
        }
        netif_tx_start_all_queues(port->dev);
@@ -4495,10 +4499,6 @@ static void mvpp2_mac_config(struct net_device *dev, unsigned int mode,
                return;
        }
-        netif_tx_stop_all_queues(port->dev);
-        if (!port->has_phy)
-                netif_carrier_off(port->dev);
        /* Make sure the port is disabled when reconfiguring the mode */
        mvpp2_port_disable(port);
@@ -4523,16 +4523,7 @@ static void mvpp2_mac_config(struct net_device *dev, unsigned int mode,
        if (port->priv->hw_version == MVPP21 && port->flags & MVPP2_F_LOOPBACK)
                mvpp2_port_loopback_set(port, state);
-        /* If the port already was up, make sure it's still in the same state */
+        mvpp2_port_enable(port);
-        if (state->link || !port->has_phy) {
-                mvpp2_port_enable(port);
-                mvpp2_egress_enable(port);
-                mvpp2_ingress_enable(port);
-                if (!port->has_phy)
-                        netif_carrier_on(dev);
-                netif_tx_wake_all_queues(dev);
-        }
 }
 static void mvpp2_mac_link_up(struct net_device *dev, unsigned int mode,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
index b994b80d5714..37ba7c78859d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
@@ -132,11 +132,11 @@ void mlx5_add_device(struct mlx5_interface *intf, struct mlx5_priv *priv)
        delayed_event_start(priv);
        dev_ctx->context = intf->add(dev);
-        set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
-        if (intf->attach)
-                set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
        if (dev_ctx->context) {
+                set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
+                if (intf->attach)
+                        set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
                spin_lock_irq(&priv->ctx_lock);
                list_add_tail(&dev_ctx->list, &priv->ctx_list);
@@ -211,12 +211,17 @@ static void mlx5_attach_interface(struct mlx5_interface *intf, struct mlx5_priv
        if (intf->attach) {
                if (test_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state))
                        goto out;
-                intf->attach(dev, dev_ctx->context);
+                if (intf->attach(dev, dev_ctx->context))
+                        goto out;
                set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
        } else {
                if (test_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state))
                        goto out;
                dev_ctx->context = intf->add(dev);
+                if (!dev_ctx->context)
+                        goto out;
                set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
        }
@@ -391,16 +396,17 @@ void mlx5_remove_dev_by_protocol(struct mlx5_core_dev *dev, int protocol)
                }
 }
-static u16 mlx5_gen_pci_id(struct mlx5_core_dev *dev)
+static u32 mlx5_gen_pci_id(struct mlx5_core_dev *dev)
 {
-        return (u16)((dev->pdev->bus->number << 8) |
+        return (u32)((pci_domain_nr(dev->pdev->bus) << 16) |
+                     (dev->pdev->bus->number << 8) |
                     PCI_SLOT(dev->pdev->devfn));
 }
 /* Must be called with intf_mutex held */
 struct mlx5_core_dev *mlx5_get_next_phys_dev(struct mlx5_core_dev *dev)
 {
-        u16 pci_id = mlx5_gen_pci_id(dev);
+        u32 pci_id = mlx5_gen_pci_id(dev);
        struct mlx5_core_dev *res = NULL;
        struct mlx5_core_dev *tmp_dev;
        struct mlx5_priv *priv;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
index 75bb981e00b7..41cde926cdab 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
@@ -191,7 +191,7 @@ set_udp(void *headers_c, void *headers_v, __be16 psrc_m, __be16 psrc_v,
 {
        if (psrc_m) {
                MLX5E_FTE_SET(headers_c, udp_sport, 0xffff);
-                MLX5E_FTE_SET(headers_c, udp_sport, ntohs(psrc_v));
+                MLX5E_FTE_SET(headers_v, udp_sport, ntohs(psrc_v));
        }
        if (pdst_m) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index f72b5c9dcfe9..3028e8d90920 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -663,6 +663,7 @@ static int esw_create_offloads_fdb_tables(struct mlx5_eswitch *esw, int nvports)
        if (err)
                goto miss_rule_err;
+        kvfree(flow_group_in);
        return 0;
 miss_rule_err:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index f418541af7cf..37d114c668b7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1578,6 +1578,33 @@ static u64 matched_fgs_get_version(struct list_head *match_head)
        return version;
 }
+static struct fs_fte *
+lookup_fte_locked(struct mlx5_flow_group *g,
+                  u32 *match_value,
+                  bool take_write)
+{
+        struct fs_fte *fte_tmp;
+        if (take_write)
+                nested_down_write_ref_node(&g->node, FS_LOCK_PARENT);
+        else
+                nested_down_read_ref_node(&g->node, FS_LOCK_PARENT);
+        fte_tmp = rhashtable_lookup_fast(&g->ftes_hash, match_value,
+                                         rhash_fte);
+        if (!fte_tmp || !tree_get_node(&fte_tmp->node)) {
+                fte_tmp = NULL;
+                goto out;
+        }
+        nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
+out:
+        if (take_write)
+                up_write_ref_node(&g->node);
+        else
+                up_read_ref_node(&g->node);
+        return fte_tmp;
+}
 static struct mlx5_flow_handle *
 try_add_to_existing_fg(struct mlx5_flow_table *ft,
                       struct list_head *match_head,
@@ -1600,10 +1627,6 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft,
        if (IS_ERR(fte))
                return  ERR_PTR(-ENOMEM);
-        list_for_each_entry(iter, match_head, list) {
-                nested_down_read_ref_node(&iter->g->node, FS_LOCK_PARENT);
-        }
 search_again_locked:
        version = matched_fgs_get_version(match_head);
        /* Try to find a fg that already contains a matching fte */
@@ -1611,20 +1634,9 @@ search_again_locked:
                struct fs_fte *fte_tmp;
                g = iter->g;
-                fte_tmp = rhashtable_lookup_fast(&g->ftes_hash, spec->match_value,
+                fte_tmp = lookup_fte_locked(g, spec->match_value, take_write);
-                                                 rhash_fte);
+                if (!fte_tmp)
-                if (!fte_tmp || !tree_get_node(&fte_tmp->node))
                        continue;
-                nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
-                if (!take_write) {
-                        list_for_each_entry(iter, match_head, list)
-                                up_read_ref_node(&iter->g->node);
-                } else {
-                        list_for_each_entry(iter, match_head, list)
-                                up_write_ref_node(&iter->g->node);
-                }
                rule = add_rule_fg(g, spec->match_value,
                                   flow_act, dest, dest_num, fte_tmp);
                up_write_ref_node(&fte_tmp->node);
@@ -1633,19 +1645,6 @@ search_again_locked:
                return rule;
        }
-        /* No group with matching fte found. Try to add a new fte to any
-         * matching fg.
-         */
-        if (!take_write) {
-                list_for_each_entry(iter, match_head, list)
-                        up_read_ref_node(&iter->g->node);
-                list_for_each_entry(iter, match_head, list)
-                        nested_down_write_ref_node(&iter->g->node,
-                                                   FS_LOCK_PARENT);
-                take_write = true;
-        }
        /* Check the ft version, for case that new flow group
         * was added while the fgs weren't locked
         */
@@ -1657,27 +1656,30 @@ search_again_locked:
        /* Check the fgs version, for case the new FTE with the
         * same values was added while the fgs weren't locked
         */
-        if (version != matched_fgs_get_version(match_head))
+        if (version != matched_fgs_get_version(match_head)) {
+                take_write = true;
                goto search_again_locked;
+        }
        list_for_each_entry(iter, match_head, list) {
                g = iter->g;
                if (!g->node.active)
                        continue;
+                nested_down_write_ref_node(&g->node, FS_LOCK_PARENT);
                err = insert_fte(g, fte);
                if (err) {
+                        up_write_ref_node(&g->node);
                        if (err == -ENOSPC)
                                continue;
-                        list_for_each_entry(iter, match_head, list)
-                                up_write_ref_node(&iter->g->node);
                        kmem_cache_free(steering->ftes_cache, fte);
                        return ERR_PTR(err);
                }
                nested_down_write_ref_node(&fte->node, FS_LOCK_CHILD);
-                list_for_each_entry(iter, match_head, list)
+                up_write_ref_node(&g->node);
-                        up_write_ref_node(&iter->g->node);
                rule = add_rule_fg(g, spec->match_value,
                                   flow_act, dest, dest_num, fte);
                up_write_ref_node(&fte->node);
@@ -1686,8 +1688,6 @@ search_again_locked:
        }
        rule = ERR_PTR(-ENOENT);
 out:
-        list_for_each_entry(iter, match_head, list)
-                up_write_ref_node(&iter->g->node);
        kmem_cache_free(steering->ftes_cache, fte);
        return rule;
 }
@@ -1726,6 +1726,8 @@ search_again_locked:
        if (err) {
                if (take_write)
                        up_write_ref_node(&ft->node);
+                else
+                        up_read_ref_node(&ft->node);
                return ERR_PTR(err);
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index d39b0b7011b2..9f39aeca863f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -331,9 +331,17 @@ void mlx5_start_health_poll(struct mlx5_core_dev *dev)
        add_timer(&health->timer);
 }
-void mlx5_stop_health_poll(struct mlx5_core_dev *dev)
+void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health)
 {
        struct mlx5_core_health *health = &dev->priv.health;
+        unsigned long flags;
+        if (disable_health) {
+                spin_lock_irqsave(&health->wq_lock, flags);
+                set_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags);
+                set_bit(MLX5_DROP_NEW_RECOVERY_WORK, &health->flags);
+                spin_unlock_irqrestore(&health->wq_lock, flags);
+        }
        del_timer_sync(&health->timer);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index cf3e4a659052..b5e9f664fc66 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -878,8 +878,10 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
        priv->numa_node = dev_to_node(&dev->pdev->dev);
        priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root);
-        if (!priv->dbg_root)
+        if (!priv->dbg_root) {
+                dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n");
                return -ENOMEM;
+        }
        err = mlx5_pci_enable_device(dev);
        if (err) {
@@ -928,7 +930,7 @@ static void mlx5_pci_close(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
        pci_clear_master(dev->pdev);
        release_bar(dev->pdev);
        mlx5_pci_disable_device(dev);
-        debugfs_remove(priv->dbg_root);
+        debugfs_remove_recursive(priv->dbg_root);
 }
 static int mlx5_init_once(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
@@ -1286,7 +1288,7 @@ err_cleanup_once:
                mlx5_cleanup_once(dev);
 err_stop_poll:
-        mlx5_stop_health_poll(dev);
+        mlx5_stop_health_poll(dev, boot);
        if (mlx5_cmd_teardown_hca(dev)) {
                dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n");
                goto out_err;
@@ -1346,7 +1348,7 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
        mlx5_free_irq_vectors(dev);
        if (cleanup)
                mlx5_cleanup_once(dev);
-        mlx5_stop_health_poll(dev);
+        mlx5_stop_health_poll(dev, cleanup);
        err = mlx5_cmd_teardown_hca(dev);
        if (err) {
                dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n");
@@ -1608,7 +1610,7 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev)
         * with the HCA, so the health polll is no longer needed.
         */
        mlx5_drain_health_wq(dev);
-        mlx5_stop_health_poll(dev);
+        mlx5_stop_health_poll(dev, false);
        ret = mlx5_cmd_force_teardown_hca(dev);
        if (ret) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
index c8c315eb5128..68e7f8df2a6d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
@@ -39,9 +39,9 @@ u32 mlx5_wq_cyc_get_size(struct mlx5_wq_cyc *wq)
        return (u32)wq->fbc.sz_m1 + 1;
 }
-u32 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq)
+u16 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq)
 {
-        return (u32)wq->fbc.frag_sz_m1 + 1;
+        return wq->fbc.frag_sz_m1 + 1;
 }
 u32 mlx5_cqwq_get_size(struct mlx5_cqwq *wq)
@@ -138,7 +138,7 @@ int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                      void *qpc, struct mlx5_wq_qp *wq,
                      struct mlx5_wq_ctrl *wq_ctrl)
 {
-        u32 sq_strides_offset;
+        u16 sq_strides_offset;
        u32 rq_pg_remainder;
        int err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.h b/drivers/net/ethernet/mellanox/mlx5/core/wq.h
index 2bd4c3184eba..3a1a170bb2d7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.h
@@ -80,7 +80,7 @@ int mlx5_wq_cyc_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                       void *wqc, struct mlx5_wq_cyc *wq,
                       struct mlx5_wq_ctrl *wq_ctrl);
 u32 mlx5_wq_cyc_get_size(struct mlx5_wq_cyc *wq);
-u32 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq);
+u16 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq);
 int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                      void *qpc, struct mlx5_wq_qp *wq,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 4327487553c5..3589432d1643 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -337,14 +337,14 @@ static const struct mlxsw_sp_sb_cm mlxsw_sp_sb_cms_egress[] = {
        MLXSW_SP_SB_CM(1500, 9, 0),
        MLXSW_SP_SB_CM(1500, 9, 0),
        MLXSW_SP_SB_CM(1500, 9, 0),
-        MLXSW_SP_SB_CM(0, 0, 0),
+        MLXSW_SP_SB_CM(0, 140000, 15),
-        MLXSW_SP_SB_CM(0, 0, 0),
+        MLXSW_SP_SB_CM(0, 140000, 15),
-        MLXSW_SP_SB_CM(0, 0, 0),
+        MLXSW_SP_SB_CM(0, 140000, 15),
-        MLXSW_SP_SB_CM(0, 0, 0),
+        MLXSW_SP_SB_CM(0, 140000, 15),
-        MLXSW_SP_SB_CM(0, 0, 0),
+        MLXSW_SP_SB_CM(0, 140000, 15),
-        MLXSW_SP_SB_CM(0, 0, 0),
+        MLXSW_SP_SB_CM(0, 140000, 15),
-        MLXSW_SP_SB_CM(0, 0, 0),
+        MLXSW_SP_SB_CM(0, 140000, 15),
-        MLXSW_SP_SB_CM(0, 0, 0),
+        MLXSW_SP_SB_CM(0, 140000, 15),
        MLXSW_SP_SB_CM(1, 0xff, 0),
 };
diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index e7dce79ff2c9..001b5f714c1b 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -2850,7 +2850,7 @@ static void lan743x_pcidev_shutdown(struct pci_dev *pdev)
        lan743x_hardware_cleanup(adapter);
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static u16 lan743x_pm_wakeframe_crc16(const u8 *buf, int len)
 {
        return bitrev16(crc16(0xFFFF, buf, len));
@@ -3016,7 +3016,7 @@ static int lan743x_pm_resume(struct device *dev)
 static const struct dev_pm_ops lan743x_pm_ops = {
        SET_SYSTEM_SLEEP_PM_OPS(lan743x_pm_suspend, lan743x_pm_resume)
 };
-#endif /*CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 static const struct pci_device_id lan743x_pcidev_tbl[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_SMSC, PCI_DEVICE_ID_SMSC_LAN7430) },
@@ -3028,7 +3028,7 @@ static struct pci_driver lan743x_pcidev_driver = {
        .id_table = lan743x_pcidev_tbl,
        .probe    = lan743x_pcidev_probe,
        .remove   = lan743x_pcidev_remove,
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
        .driver.pm = &lan743x_pm_ops,
 #endif
        .shutdown = lan743x_pcidev_shutdown,
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index 9044496803e6..46ba0cf257c6 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -52,6 +52,7 @@
 #define NFP_FL_TUNNEL_CSUM                      cpu_to_be16(0x01)
 #define NFP_FL_TUNNEL_KEY                       cpu_to_be16(0x04)
 #define NFP_FL_TUNNEL_GENEVE_OPT                cpu_to_be16(0x0800)
+#define NFP_FL_SUPPORTED_TUNNEL_INFO_FLAGS      IP_TUNNEL_INFO_TX
 #define NFP_FL_SUPPORTED_IPV4_UDP_TUN_FLAGS     (NFP_FL_TUNNEL_CSUM | \
                                                 NFP_FL_TUNNEL_KEY | \
                                                 NFP_FL_TUNNEL_GENEVE_OPT)
@@ -741,11 +742,16 @@ nfp_flower_loop_action(struct nfp_app *app, const struct tc_action *a,
                nfp_fl_push_vlan(psh_v, a);
                *a_len += sizeof(struct nfp_fl_push_vlan);
        } else if (is_tcf_tunnel_set(a)) {
+                struct ip_tunnel_info *ip_tun = tcf_tunnel_info(a);
                struct nfp_repr *repr = netdev_priv(netdev);
                *tun_type = nfp_fl_get_tun_from_act_l4_port(repr->app, a);
                if (*tun_type == NFP_FL_TUNNEL_NONE)
                        return -EOPNOTSUPP;
+                if (ip_tun->mode & ~NFP_FL_SUPPORTED_TUNNEL_INFO_FLAGS)
+                        return -EOPNOTSUPP;
                /* Pre-tunnel action is required for tunnel encap.
                 * This checks for next hop entries on NFP.
                 * If none, the packet falls back before applying other actions.
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.h b/drivers/net/ethernet/netronome/nfp/flower/main.h
index 85f8209bf007..81d941ab895c 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.h
@@ -70,6 +70,7 @@ struct nfp_app;
 #define NFP_FL_FEATS_GENEVE             BIT(0)
 #define NFP_FL_NBI_MTU_SETTING          BIT(1)
 #define NFP_FL_FEATS_GENEVE_OPT         BIT(2)
+#define NFP_FL_FEATS_VLAN_PCP           BIT(3)
 #define NFP_FL_FEATS_LAG                BIT(31)
 struct nfp_fl_mask_id {
diff --git a/drivers/net/ethernet/netronome/nfp/flower/match.c b/drivers/net/ethernet/netronome/nfp/flower/match.c
index a0c72f277faa..17acb8cc6044 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/match.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/match.c
@@ -56,7 +56,7 @@ nfp_flower_compile_meta_tci(struct nfp_flower_meta_tci *frame,
                                                      FLOW_DISSECTOR_KEY_VLAN,
                                                      target);
                /* Populate the tci field. */
-                if (flow_vlan->vlan_id) {
+                if (flow_vlan->vlan_id || flow_vlan->vlan_priority) {
                        tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
                                             flow_vlan->vlan_priority) |
                                  FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index 2edab01c3beb..bd19624f10cf 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -192,6 +192,17 @@ nfp_flower_calculate_key_layers(struct nfp_app *app,
                key_size += sizeof(struct nfp_flower_mac_mpls);
        }
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_VLAN)) {
+                struct flow_dissector_key_vlan *flow_vlan;
+                flow_vlan = skb_flow_dissector_target(flow->dissector,
+                                                      FLOW_DISSECTOR_KEY_VLAN,
+                                                      flow->mask);
+                if (!(priv->flower_ext_feats & NFP_FL_FEATS_VLAN_PCP) &&
+                    flow_vlan->vlan_priority)
+                        return -EOPNOTSUPP;
+        }
        if (dissector_uses_key(flow->dissector,
                               FLOW_DISSECTOR_KEY_ENC_CONTROL)) {
                struct flow_dissector_key_ipv4_addrs *mask_ipv4 = NULL;
diff --git a/drivers/net/ethernet/qualcomm/qca_7k.c b/drivers/net/ethernet/qualcomm/qca_7k.c
index ffe7a16bdfc8..6c8543fb90c0 100644
--- a/drivers/net/ethernet/qualcomm/qca_7k.c
+++ b/drivers/net/ethernet/qualcomm/qca_7k.c
@@ -45,34 +45,33 @@ qcaspi_read_register(struct qcaspi *qca, u16 reg, u16 *result)
 {
        __be16 rx_data;
        __be16 tx_data;
-        struct spi_transfer *transfer;
+        struct spi_transfer transfer[2];
-        struct spi_message *msg;
+        struct spi_message msg;
        int ret;
+        memset(transfer, 0, sizeof(transfer));
+        spi_message_init(&msg);
        tx_data = cpu_to_be16(QCA7K_SPI_READ | QCA7K_SPI_INTERNAL | reg);
+        *result = 0;
+        transfer[0].tx_buf = &tx_data;
+        transfer[0].len = QCASPI_CMD_LEN;
+        transfer[1].rx_buf = &rx_data;
+        transfer[1].len = QCASPI_CMD_LEN;
+        spi_message_add_tail(&transfer[0], &msg);
        if (qca->legacy_mode) {
-                msg = &qca->spi_msg1;
+                spi_sync(qca->spi_dev, &msg);
-                transfer = &qca->spi_xfer1;
+                spi_message_init(&msg);
-                transfer->tx_buf = &tx_data;
-                transfer->rx_buf = NULL;
-                transfer->len = QCASPI_CMD_LEN;
-                spi_sync(qca->spi_dev, msg);
-        } else {
-                msg = &qca->spi_msg2;
-                transfer = &qca->spi_xfer2[0];
-                transfer->tx_buf = &tx_data;
-                transfer->rx_buf = NULL;
-                transfer->len = QCASPI_CMD_LEN;
-                transfer = &qca->spi_xfer2[1];
        }
-        transfer->tx_buf = NULL;
+        spi_message_add_tail(&transfer[1], &msg);
-        transfer->rx_buf = &rx_data;
+        ret = spi_sync(qca->spi_dev, &msg);
-        transfer->len = QCASPI_CMD_LEN;
-        ret = spi_sync(qca->spi_dev, msg);
        if (!ret)
-                ret = msg->status;
+                ret = msg.status;
        if (ret)
                qcaspi_spi_error(qca);
@@ -86,35 +85,32 @@ int
 qcaspi_write_register(struct qcaspi *qca, u16 reg, u16 value)
 {
        __be16 tx_data[2];
-        struct spi_transfer *transfer;
+        struct spi_transfer transfer[2];
-        struct spi_message *msg;
+        struct spi_message msg;
        int ret;
+        memset(&transfer, 0, sizeof(transfer));
+        spi_message_init(&msg);
        tx_data[0] = cpu_to_be16(QCA7K_SPI_WRITE | QCA7K_SPI_INTERNAL | reg);
        tx_data[1] = cpu_to_be16(value);
+        transfer[0].tx_buf = &tx_data[0];
+        transfer[0].len = QCASPI_CMD_LEN;
+        transfer[1].tx_buf = &tx_data[1];
+        transfer[1].len = QCASPI_CMD_LEN;
+        spi_message_add_tail(&transfer[0], &msg);
        if (qca->legacy_mode) {
-                msg = &qca->spi_msg1;
+                spi_sync(qca->spi_dev, &msg);
-                transfer = &qca->spi_xfer1;
+                spi_message_init(&msg);
-                transfer->tx_buf = &tx_data[0];
-                transfer->rx_buf = NULL;
-                transfer->len = QCASPI_CMD_LEN;
-                spi_sync(qca->spi_dev, msg);
-        } else {
-                msg = &qca->spi_msg2;
-                transfer = &qca->spi_xfer2[0];
-                transfer->tx_buf = &tx_data[0];
-                transfer->rx_buf = NULL;
-                transfer->len = QCASPI_CMD_LEN;
-                transfer = &qca->spi_xfer2[1];
        }
-        transfer->tx_buf = &tx_data[1];
+        spi_message_add_tail(&transfer[1], &msg);
-        transfer->rx_buf = NULL;
+        ret = spi_sync(qca->spi_dev, &msg);
-        transfer->len = QCASPI_CMD_LEN;
-        ret = spi_sync(qca->spi_dev, msg);
        if (!ret)
-                ret = msg->status;
+                ret = msg.status;
        if (ret)
                qcaspi_spi_error(qca);
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 206f0266463e..66b775d462fd 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -99,22 +99,24 @@ static u32
 qcaspi_write_burst(struct qcaspi *qca, u8 *src, u32 len)
 {
        __be16 cmd;
-        struct spi_message *msg = &qca->spi_msg2;
+        struct spi_message msg;
-        struct spi_transfer *transfer = &qca->spi_xfer2[0];
+        struct spi_transfer transfer[2];
        int ret;
+        memset(&transfer, 0, sizeof(transfer));
+        spi_message_init(&msg);
        cmd = cpu_to_be16(QCA7K_SPI_WRITE | QCA7K_SPI_EXTERNAL);
-        transfer->tx_buf = &cmd;
+        transfer[0].tx_buf = &cmd;
-        transfer->rx_buf = NULL;
+        transfer[0].len = QCASPI_CMD_LEN;
-        transfer->len = QCASPI_CMD_LEN;
+        transfer[1].tx_buf = src;
-        transfer = &qca->spi_xfer2[1];
+        transfer[1].len = len;
-        transfer->tx_buf = src;
-        transfer->rx_buf = NULL;
-        transfer->len = len;
-        ret = spi_sync(qca->spi_dev, msg);
+        spi_message_add_tail(&transfer[0], &msg);
+        spi_message_add_tail(&transfer[1], &msg);
+        ret = spi_sync(qca->spi_dev, &msg);
-        if (ret || (msg->actual_length != QCASPI_CMD_LEN + len)) {
+        if (ret || (msg.actual_length != QCASPI_CMD_LEN + len)) {
                qcaspi_spi_error(qca);
                return 0;
        }
@@ -125,17 +127,20 @@ qcaspi_write_burst(struct qcaspi *qca, u8 *src, u32 len)
 static u32
 qcaspi_write_legacy(struct qcaspi *qca, u8 *src, u32 len)
 {
-        struct spi_message *msg = &qca->spi_msg1;
+        struct spi_message msg;
-        struct spi_transfer *transfer = &qca->spi_xfer1;
+        struct spi_transfer transfer;
        int ret;
-        transfer->tx_buf = src;
+        memset(&transfer, 0, sizeof(transfer));
-        transfer->rx_buf = NULL;
+        spi_message_init(&msg);
-        transfer->len = len;
+        transfer.tx_buf = src;
+        transfer.len = len;
-        ret = spi_sync(qca->spi_dev, msg);
+        spi_message_add_tail(&transfer, &msg);
+        ret = spi_sync(qca->spi_dev, &msg);
-        if (ret || (msg->actual_length != len)) {
+        if (ret || (msg.actual_length != len)) {
                qcaspi_spi_error(qca);
                return 0;
        }
@@ -146,23 +151,25 @@ qcaspi_write_legacy(struct qcaspi *qca, u8 *src, u32 len)
 static u32
 qcaspi_read_burst(struct qcaspi *qca, u8 *dst, u32 len)
 {
-        struct spi_message *msg = &qca->spi_msg2;
+        struct spi_message msg;
        __be16 cmd;
-        struct spi_transfer *transfer = &qca->spi_xfer2[0];
+        struct spi_transfer transfer[2];
        int ret;
+        memset(&transfer, 0, sizeof(transfer));
+        spi_message_init(&msg);
        cmd = cpu_to_be16(QCA7K_SPI_READ | QCA7K_SPI_EXTERNAL);
-        transfer->tx_buf = &cmd;
+        transfer[0].tx_buf = &cmd;
-        transfer->rx_buf = NULL;
+        transfer[0].len = QCASPI_CMD_LEN;
-        transfer->len = QCASPI_CMD_LEN;
+        transfer[1].rx_buf = dst;
-        transfer = &qca->spi_xfer2[1];
+        transfer[1].len = len;
-        transfer->tx_buf = NULL;
-        transfer->rx_buf = dst;
-        transfer->len = len;
-        ret = spi_sync(qca->spi_dev, msg);
+        spi_message_add_tail(&transfer[0], &msg);
+        spi_message_add_tail(&transfer[1], &msg);
+        ret = spi_sync(qca->spi_dev, &msg);
-        if (ret || (msg->actual_length != QCASPI_CMD_LEN + len)) {
+        if (ret || (msg.actual_length != QCASPI_CMD_LEN + len)) {
                qcaspi_spi_error(qca);
                return 0;
        }
@@ -173,17 +180,20 @@ qcaspi_read_burst(struct qcaspi *qca, u8 *dst, u32 len)
 static u32
 qcaspi_read_legacy(struct qcaspi *qca, u8 *dst, u32 len)
 {
-        struct spi_message *msg = &qca->spi_msg1;
+        struct spi_message msg;
-        struct spi_transfer *transfer = &qca->spi_xfer1;
+        struct spi_transfer transfer;
        int ret;
-        transfer->tx_buf = NULL;
+        memset(&transfer, 0, sizeof(transfer));
-        transfer->rx_buf = dst;
+        spi_message_init(&msg);
-        transfer->len = len;
-        ret = spi_sync(qca->spi_dev, msg);
+        transfer.rx_buf = dst;
+        transfer.len = len;
-        if (ret || (msg->actual_length != len)) {
+        spi_message_add_tail(&transfer, &msg);
+        ret = spi_sync(qca->spi_dev, &msg);
+        if (ret || (msg.actual_length != len)) {
                qcaspi_spi_error(qca);
                return 0;
        }
@@ -195,19 +205,23 @@ static int
 qcaspi_tx_cmd(struct qcaspi *qca, u16 cmd)
 {
        __be16 tx_data;
-        struct spi_message *msg = &qca->spi_msg1;
+        struct spi_message msg;
-        struct spi_transfer *transfer = &qca->spi_xfer1;
+        struct spi_transfer transfer;
        int ret;
+        memset(&transfer, 0, sizeof(transfer));
+        spi_message_init(&msg);
        tx_data = cpu_to_be16(cmd);
-        transfer->len = sizeof(tx_data);
+        transfer.len = sizeof(cmd);
-        transfer->tx_buf = &tx_data;
+        transfer.tx_buf = &tx_data;
-        transfer->rx_buf = NULL;
+        spi_message_add_tail(&transfer, &msg);
-        ret = spi_sync(qca->spi_dev, msg);
+        ret = spi_sync(qca->spi_dev, &msg);
        if (!ret)
-                ret = msg->status;
+                ret = msg.status;
        if (ret)
                qcaspi_spi_error(qca);
@@ -835,16 +849,6 @@ qcaspi_netdev_setup(struct net_device *dev)
        qca = netdev_priv(dev);
        memset(qca, 0, sizeof(struct qcaspi));
-        memset(&qca->spi_xfer1, 0, sizeof(struct spi_transfer));
-        memset(&qca->spi_xfer2, 0, sizeof(struct spi_transfer) * 2);
-        spi_message_init(&qca->spi_msg1);
-        spi_message_add_tail(&qca->spi_xfer1, &qca->spi_msg1);
-        spi_message_init(&qca->spi_msg2);
-        spi_message_add_tail(&qca->spi_xfer2[0], &qca->spi_msg2);
-        spi_message_add_tail(&qca->spi_xfer2[1], &qca->spi_msg2);
        memset(&qca->txr, 0, sizeof(qca->txr));
        qca->txr.count = TX_RING_MAX_LEN;
 }
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
index fc4beb1b32d1..fc0e98726b36 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.h
+++ b/drivers/net/ethernet/qualcomm/qca_spi.h
@@ -83,11 +83,6 @@ struct qcaspi {
        struct tx_ring txr;
        struct qcaspi_stats stats;
-        struct spi_message spi_msg1;
-        struct spi_message spi_msg2;
-        struct spi_transfer spi_xfer1;
-        struct spi_transfer spi_xfer2[2];
        u8 *rx_buffer;
        u32 buffer_size;
        u8 sync;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index b08d51bf7a20..bb529ff2ca81 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -13,6 +13,7 @@
 #include <linux/pci.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/ethtool.h>
 #include <linux/phy.h>
@@ -631,7 +632,7 @@ struct rtl8169_tc_offsets {
 };
 enum rtl_flag {
-        RTL_FLAG_TASK_ENABLED,
+        RTL_FLAG_TASK_ENABLED = 0,
        RTL_FLAG_TASK_SLOW_PENDING,
        RTL_FLAG_TASK_RESET_PENDING,
        RTL_FLAG_MAX
@@ -665,6 +666,7 @@ struct rtl8169_private {
        u16 event_slow;
        const struct rtl_coalesce_info *coalesce_info;
+        struct clk *clk;
        struct mdio_ops {
                void (*write)(struct rtl8169_private *, int, int);
@@ -4634,13 +4636,13 @@ static void rtl_hw_start(struct  rtl8169_private *tp)
        rtl_set_rx_max_size(tp);
        rtl_set_rx_tx_desc_registers(tp);
-        rtl_set_tx_config_registers(tp);
        RTL_W8(tp, Cfg9346, Cfg9346_Lock);
        /* Initially a 10 us delay. Turned it into a PCI commit. - FR */
        RTL_R8(tp, IntrMask);
        RTL_W8(tp, ChipCmd, CmdTxEnb | CmdRxEnb);
        rtl_init_rxcfg(tp);
+        rtl_set_tx_config_registers(tp);
        rtl_set_rx_mode(tp->dev);
        /* no early-rx interrupts */
@@ -4775,12 +4777,14 @@ static void rtl_pcie_state_l2l3_enable(struct rtl8169_private *tp, bool enable)
 static void rtl_hw_aspm_clkreq_enable(struct rtl8169_private *tp, bool enable)
 {
        if (enable) {
-                RTL_W8(tp, Config2, RTL_R8(tp, Config2) | ClkReqEn);
                RTL_W8(tp, Config5, RTL_R8(tp, Config5) | ASPM_en);
+                RTL_W8(tp, Config2, RTL_R8(tp, Config2) | ClkReqEn);
        } else {
                RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~ClkReqEn);
                RTL_W8(tp, Config5, RTL_R8(tp, Config5) & ~ASPM_en);
        }
+        udelay(10);
 }
 static void rtl_hw_start_8168bb(struct rtl8169_private *tp)
@@ -5625,6 +5629,8 @@ static void rtl_hw_start_8402(struct rtl8169_private *tp)
 static void rtl_hw_start_8106(struct rtl8169_private *tp)
 {
+        rtl_hw_aspm_clkreq_enable(tp, false);
        /* Force LAN exit from ASPM if Rx/Tx are not idle */
        RTL_W32(tp, FuncEvent, RTL_R32(tp, FuncEvent) | 0x002800);
@@ -5633,6 +5639,7 @@ static void rtl_hw_start_8106(struct rtl8169_private *tp)
        RTL_W8(tp, DLLPR, RTL_R8(tp, DLLPR) & ~PFM_EN);
        rtl_pcie_state_l2l3_enable(tp, false);
+        rtl_hw_aspm_clkreq_enable(tp, true);
 }
 static void rtl_hw_start_8101(struct rtl8169_private *tp)
@@ -6655,7 +6662,8 @@ static int rtl8169_close(struct net_device *dev)
        rtl8169_update_counters(tp);
        rtl_lock_work(tp);
-        clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+        /* Clear all task flags */
+        bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
        rtl8169_down(dev);
        rtl_unlock_work(tp);
@@ -6838,7 +6846,9 @@ static void rtl8169_net_suspend(struct net_device *dev)
        rtl_lock_work(tp);
        napi_disable(&tp->napi);
-        clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+        /* Clear all task flags */
+        bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
        rtl_unlock_work(tp);
        rtl_pll_power_down(tp);
@@ -7254,6 +7264,11 @@ static int rtl_jumbo_max(struct rtl8169_private *tp)
        }
 }
+static void rtl_disable_clk(void *data)
+{
+        clk_disable_unprepare(data);
+}
 static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        const struct rtl_cfg_info *cfg = rtl_cfg_infos + ent->driver_data;
@@ -7274,6 +7289,32 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        tp->msg_enable = netif_msg_init(debug.msg_enable, R8169_MSG_DEFAULT);
        tp->supports_gmii = cfg->has_gmii;
+        /* Get the *optional* external "ether_clk" used on some boards */
+        tp->clk = devm_clk_get(&pdev->dev, "ether_clk");
+        if (IS_ERR(tp->clk)) {
+                rc = PTR_ERR(tp->clk);
+                if (rc == -ENOENT) {
+                        /* clk-core allows NULL (for suspend / resume) */
+                        tp->clk = NULL;
+                } else if (rc == -EPROBE_DEFER) {
+                        return rc;
+                } else {
+                        dev_err(&pdev->dev, "failed to get clk: %d\n", rc);
+                        return rc;
+                }
+        } else {
+                rc = clk_prepare_enable(tp->clk);
+                if (rc) {
+                        dev_err(&pdev->dev, "failed to enable clk: %d\n", rc);
+                        return rc;
+                }
+                rc = devm_add_action_or_reset(&pdev->dev, rtl_disable_clk,
+                                              tp->clk);
+                if (rc)
+                        return rc;
+        }
        /* enable device (incl. PCI PM wakeup and hotplug setup) */
        rc = pcim_enable_device(pdev);
        if (rc < 0) {
diff --git a/drivers/net/ethernet/renesas/Kconfig b/drivers/net/ethernet/renesas/Kconfig
index f3f7477043ce..bb0ebdfd4459 100644
--- a/drivers/net/ethernet/renesas/Kconfig
+++ b/drivers/net/ethernet/renesas/Kconfig
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Renesas device configuration
 #
diff --git a/drivers/net/ethernet/renesas/Makefile b/drivers/net/ethernet/renesas/Makefile
index a05102a7df02..f21ab8c02af0 100644
--- a/drivers/net/ethernet/renesas/Makefile
+++ b/drivers/net/ethernet/renesas/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for the Renesas device drivers.
 #
diff --git a/drivers/net/ethernet/renesas/ravb_ptp.c b/drivers/net/ethernet/renesas/ravb_ptp.c
index eede70ec37f8..0721b5c35d91 100644
--- a/drivers/net/ethernet/renesas/ravb_ptp.c
+++ b/drivers/net/ethernet/renesas/ravb_ptp.c
@@ -1,13 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /* PTP 1588 clock using the Renesas Ethernet AVB
 *
 * Copyright (C) 2013-2015 Renesas Electronics Corporation
 * Copyright (C) 2015 Renesas Solutions Corp.
 * Copyright (C) 2015-2016 Cogent Embedded, Inc. <source@cogentembedded.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
 */
 #include "ravb.h"
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 3609c7b696c7..2b800ce1d5bf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -67,7 +67,7 @@ static int dwmac1000_validate_mcast_bins(int mcast_bins)
 * Description:
 * This function validates the number of Unicast address entries supported
 * by a particular Synopsys 10/100/1000 controller. The Synopsys controller
- * supports 1, 32, 64, or 128 Unicast filter entries for it's Unicast filter
+ * supports 1..32, 64, or 128 Unicast filter entries for it's Unicast filter
 * logic. This function validates a valid, supported configuration is
 * selected, and defaults to 1 Unicast address if an unsupported
 * configuration is selected.
@@ -77,8 +77,7 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries)
        int x = ucast_entries;
        switch (x) {
-        case 1:
+        case 1 ... 32:
-        case 32:
        case 64:
        case 128:
                break;
diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
index 9263d638bd6d..f932923f7d56 100644
--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -41,6 +41,7 @@ config TI_DAVINCI_MDIO
 config TI_DAVINCI_CPDMA
        tristate "TI DaVinci CPDMA Support"
        depends on ARCH_DAVINCI || ARCH_OMAP2PLUS || COMPILE_TEST
+        select GENERIC_ALLOCATOR
        ---help---
          This driver supports TI's DaVinci CPDMA dma engine.
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 31c3d77b4733..fe01e141c8f8 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1203,6 +1203,9 @@ static void netvsc_send_vf(struct net_device *ndev,
        net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
        net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
+        netdev_info(ndev, "VF slot %u %s\n",
+                    net_device_ctx->vf_serial,
+                    net_device_ctx->vf_alloc ? "added" : "removed");
 }
 static  void netvsc_receive_inband(struct net_device *ndev,
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 70921bbe0e28..3af6d8d15233 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -1894,20 +1894,6 @@ out_unlock:
        rtnl_unlock();
 }
-static struct net_device *get_netvsc_bymac(const u8 *mac)
-{
-        struct net_device_context *ndev_ctx;
-        list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
-                struct net_device *dev = hv_get_drvdata(ndev_ctx->device_ctx);
-                if (ether_addr_equal(mac, dev->perm_addr))
-                        return dev;
-        }
-        return NULL;
-}
 static struct net_device *get_netvsc_byref(struct net_device *vf_netdev)
 {
        struct net_device_context *net_device_ctx;
@@ -2036,26 +2022,48 @@ static void netvsc_vf_setup(struct work_struct *w)
        rtnl_unlock();
 }
+/* Find netvsc by VMBus serial number.
+ * The PCI hyperv controller records the serial number as the slot.
+ */
+static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
+{
+        struct device *parent = vf_netdev->dev.parent;
+        struct net_device_context *ndev_ctx;
+        struct pci_dev *pdev;
+        if (!parent || !dev_is_pci(parent))
+                return NULL; /* not a PCI device */
+        pdev = to_pci_dev(parent);
+        if (!pdev->slot) {
+                netdev_notice(vf_netdev, "no PCI slot information\n");
+                return NULL;
+        }
+        list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
+                if (!ndev_ctx->vf_alloc)
+                        continue;
+                if (ndev_ctx->vf_serial == pdev->slot->number)
+                        return hv_get_drvdata(ndev_ctx->device_ctx);
+        }
+        netdev_notice(vf_netdev,
+                      "no netdev found for slot %u\n", pdev->slot->number);
+        return NULL;
+}
 static int netvsc_register_vf(struct net_device *vf_netdev)
 {
-        struct net_device *ndev;
        struct net_device_context *net_device_ctx;
-        struct device *pdev = vf_netdev->dev.parent;
        struct netvsc_device *netvsc_dev;
+        struct net_device *ndev;
        int ret;
        if (vf_netdev->addr_len != ETH_ALEN)
                return NOTIFY_DONE;
-        if (!pdev || !dev_is_pci(pdev) || dev_is_pf(pdev))
+        ndev = get_netvsc_byslot(vf_netdev);
-                return NOTIFY_DONE;
-        /*
-         * We will use the MAC address to locate the synthetic interface to
-         * associate with the VF interface. If we don't find a matching
-         * synthetic interface, move on.
-         */
-        ndev = get_netvsc_bymac(vf_netdev->perm_addr);
        if (!ndev)
                return NOTIFY_DONE;
@@ -2272,17 +2280,15 @@ static int netvsc_remove(struct hv_device *dev)
        cancel_delayed_work_sync(&ndev_ctx->dwork);
-        rcu_read_lock();
+        rtnl_lock();
-        nvdev = rcu_dereference(ndev_ctx->nvdev);
+        nvdev = rtnl_dereference(ndev_ctx->nvdev);
+        if (nvdev)
-        if  (nvdev)
                cancel_work_sync(&nvdev->subchan_work);
        /*
         * Call to the vsc driver to let it know that the device is being
         * removed. Also blocks mtu and channel changes.
         */
-        rtnl_lock();
        vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev);
        if (vf_netdev)
                netvsc_unregister_vf(vf_netdev);
@@ -2294,7 +2300,6 @@ static int netvsc_remove(struct hv_device *dev)
        list_del(&ndev_ctx->list);
        rtnl_unlock();
-        rcu_read_unlock();
        hv_set_drvdata(dev, NULL);
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index ce61231e96ea..62dc564b251d 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -429,6 +429,9 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
        if (!skb)
                goto out;
+        if (skb_mac_header_len(skb) < ETH_HLEN)
+                goto drop;
        if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
                goto drop;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index cb0cc30c3d6a..533b6fb8d923 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -967,6 +967,13 @@ static const struct usb_device_id products[] = {
                USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
                .driver_info = (unsigned long)&qmi_wwan_info,
        },
+        {       /* Quectel EP06/EG06/EM06 */
+                USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x0306,
+                                              USB_CLASS_VENDOR_SPEC,
+                                              USB_SUBCLASS_VENDOR_SPEC,
+                                              0xff),
+                .driver_info        = (unsigned long)&qmi_wwan_info_quirk_dtr,
+        },
        /* 3. Combined interface devices matching on interface number */
        {QMI_FIXED_INTF(0x0408, 0xea42, 4)},    /* Yota / Megafon M100-1 */
@@ -1206,13 +1213,13 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
        {QMI_FIXED_INTF(0x1199, 0x9063, 8)},    /* Sierra Wireless EM7305 */
        {QMI_FIXED_INTF(0x1199, 0x9063, 10)},   /* Sierra Wireless EM7305 */
-        {QMI_FIXED_INTF(0x1199, 0x9071, 8)},    /* Sierra Wireless MC74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9071, 10)},   /* Sierra Wireless MC74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 10)},/* Sierra Wireless MC74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9079, 8)},    /* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9079, 10)},   /* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 10)},/* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x907b, 8)},    /* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x907b, 10)},   /* Sierra Wireless EM74xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 10)},/* Sierra Wireless EM74xx */
-        {QMI_FIXED_INTF(0x1199, 0x9091, 8)},    /* Sierra Wireless EM7565 */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */
        {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
        {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
@@ -1255,7 +1262,6 @@ static const struct usb_device_id products[] = {
        {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
        {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
        {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)},    /* Quectel BG96 */
-        {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */
        /* 4. Gobi 1000 devices */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
@@ -1331,6 +1337,19 @@ static bool quectel_ec20_detected(struct usb_interface *intf)
        return false;
 }
+static bool quectel_ep06_diag_detected(struct usb_interface *intf)
+{
+        struct usb_device *dev = interface_to_usbdev(intf);
+        struct usb_interface_descriptor intf_desc = intf->cur_altsetting->desc;
+        if (le16_to_cpu(dev->descriptor.idVendor) == 0x2c7c &&
+            le16_to_cpu(dev->descriptor.idProduct) == 0x0306 &&
+            intf_desc.bNumEndpoints == 2)
+                return true;
+        return false;
+}
 static int qmi_wwan_probe(struct usb_interface *intf,
                          const struct usb_device_id *prod)
 {
@@ -1365,6 +1384,15 @@ static int qmi_wwan_probe(struct usb_interface *intf,
                return -ENODEV;
        }
+        /* Quectel EP06/EM06/EG06 supports dynamic interface configuration, so
+         * we need to match on class/subclass/protocol. These values are
+         * identical for the diagnostic- and QMI-interface, but bNumEndpoints is
+         * different. Ignore the current interface if the number of endpoints
+         * the number for the diag interface (two).
+         */
+        if (quectel_ep06_diag_detected(intf))
+                return -ENODEV;
        return usbnet_probe(intf, id);
 }
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 8d679c8b7f25..41a00cd76955 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -463,6 +463,8 @@ static struct sk_buff *veth_xdp_rcv_skb(struct veth_rq *rq, struct sk_buff *skb,
        int mac_len, delta, off;
        struct xdp_buff xdp;
+        skb_orphan(skb);
        rcu_read_lock();
        xdp_prog = rcu_dereference(rq->xdp_prog);
        if (unlikely(!xdp_prog)) {
@@ -508,8 +510,6 @@ static struct sk_buff *veth_xdp_rcv_skb(struct veth_rq *rq, struct sk_buff *skb,
                skb_copy_header(nskb, skb);
                head_off = skb_headroom(nskb) - skb_headroom(skb);
                skb_headers_offset_update(nskb, head_off);
-                if (skb->sk)
-                        skb_set_owner_w(nskb, skb->sk);
                consume_skb(skb);
                skb = nskb;
        }
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 73f596a90c69..f17f602e6171 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -87,8 +87,7 @@ struct netfront_cb {
 /* IRQ name is queue name with "-tx" or "-rx" appended */
 #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
-static DECLARE_WAIT_QUEUE_HEAD(module_load_q);
+static DECLARE_WAIT_QUEUE_HEAD(module_wq);
-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
 struct netfront_stats {
        u64                     packets;
@@ -909,7 +908,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
                        BUG_ON(pull_to <= skb_headlen(skb));
                        __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
                }
-                BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
+                if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+                        queue->rx.rsp_cons = ++cons;
+                        kfree_skb(nskb);
+                        return ~0U;
+                }
                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
                                skb_frag_page(nfrag),
@@ -1046,6 +1049,8 @@ err:
                skb->len += rx->status;
                i = xennet_fill_frags(queue, skb, &tmpq);
+                if (unlikely(i == ~0U))
+                        goto err;
                if (rx->flags & XEN_NETRXF_csum_blank)
                        skb->ip_summed = CHECKSUM_PARTIAL;
@@ -1332,11 +1337,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
        netif_carrier_off(netdev);
        xenbus_switch_state(dev, XenbusStateInitialising);
-        wait_event(module_load_q,
+        wait_event(module_wq,
-                           xenbus_read_driver_state(dev->otherend) !=
+                   xenbus_read_driver_state(dev->otherend) !=
-                           XenbusStateClosed &&
+                   XenbusStateClosed &&
-                           xenbus_read_driver_state(dev->otherend) !=
+                   xenbus_read_driver_state(dev->otherend) !=
-                           XenbusStateUnknown);
+                   XenbusStateUnknown);
        return netdev;
 exit:
@@ -2010,15 +2015,14 @@ static void netback_changed(struct xenbus_device *dev,
        dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state));
+        wake_up_all(&module_wq);
        switch (backend_state) {
        case XenbusStateInitialising:
        case XenbusStateInitialised:
        case XenbusStateReconfiguring:
        case XenbusStateReconfigured:
-                break;
        case XenbusStateUnknown:
-                wake_up_all(&module_unload_q);
                break;
        case XenbusStateInitWait:
@@ -2034,12 +2038,10 @@ static void netback_changed(struct xenbus_device *dev,
                break;
        case XenbusStateClosed:
-                wake_up_all(&module_unload_q);
                if (dev->state == XenbusStateClosed)
                        break;
                /* Missed the backend's CLOSING state -- fallthrough */
        case XenbusStateClosing:
-                wake_up_all(&module_unload_q);
                xenbus_frontend_closed(dev);
                break;
        }
@@ -2147,14 +2149,14 @@ static int xennet_remove(struct xenbus_device *dev)
        if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
                xenbus_switch_state(dev, XenbusStateClosing);
-                wait_event(module_unload_q,
+                wait_event(module_wq,
                           xenbus_read_driver_state(dev->otherend) ==
                           XenbusStateClosing ||
                           xenbus_read_driver_state(dev->otherend) ==
                           XenbusStateUnknown);
                xenbus_switch_state(dev, XenbusStateClosed);
-                wait_event(module_unload_q,
+                wait_event(module_wq,
                           xenbus_read_driver_state(dev->otherend) ==
                           XenbusStateClosed ||
                           xenbus_read_driver_state(dev->otherend) ==
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index a21caea1e080..2008fa62a373 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -245,6 +245,10 @@ static void nvmet_execute_get_log_page_ana(struct nvmet_req *req)
                offset += len;
                ngrps++;
        }
+        for ( ; grpid <= NVMET_MAX_ANAGRPS; grpid++) {
+                if (nvmet_ana_group_enabled[grpid])
+                        ngrps++;
+        }
        hdr.chgcnt = cpu_to_le64(nvmet_ana_chgcnt);
        hdr.ngrps = cpu_to_le16(ngrps);
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 3533e918ea37..bfc4da660bb4 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -66,6 +66,7 @@ struct nvmet_rdma_rsp {
        struct nvmet_req        req;
+        bool                    allocated;
        u8                      n_rdma;
        u32                     flags;
        u32                     invalidate_rkey;
@@ -174,11 +175,19 @@ nvmet_rdma_get_rsp(struct nvmet_rdma_queue *queue)
        unsigned long flags;
        spin_lock_irqsave(&queue->rsps_lock, flags);
-        rsp = list_first_entry(&queue->free_rsps,
+        rsp = list_first_entry_or_null(&queue->free_rsps,
                                struct nvmet_rdma_rsp, free_list);
-        list_del(&rsp->free_list);
+        if (likely(rsp))
+                list_del(&rsp->free_list);
        spin_unlock_irqrestore(&queue->rsps_lock, flags);
+        if (unlikely(!rsp)) {
+                rsp = kmalloc(sizeof(*rsp), GFP_KERNEL);
+                if (unlikely(!rsp))
+                        return NULL;
+                rsp->allocated = true;
+        }
        return rsp;
 }
@@ -187,6 +196,11 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp *rsp)
 {
        unsigned long flags;
+        if (rsp->allocated) {
+                kfree(rsp);
+                return;
+        }
        spin_lock_irqsave(&rsp->queue->rsps_lock, flags);
        list_add_tail(&rsp->free_list, &rsp->queue->free_rsps);
        spin_unlock_irqrestore(&rsp->queue->rsps_lock, flags);
@@ -776,6 +790,15 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
        cmd->queue = queue;
        rsp = nvmet_rdma_get_rsp(queue);
+        if (unlikely(!rsp)) {
+                /*
+                 * we get here only under memory pressure,
+                 * silently drop and have the host retry
+                 * as we can't even fail it.
+                 */
+                nvmet_rdma_post_recv(queue->dev, cmd);
+                return;
+        }
        rsp->queue = queue;
        rsp->cmd = cmd;
        rsp->flags = 0;
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 9095b8290150..74eaedd5b860 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -140,6 +140,9 @@ void of_populate_phandle_cache(void)
                if (np->phandle && np->phandle != OF_PHANDLE_ILLEGAL)
                        phandles++;
+        if (!phandles)
+                goto out;
        cache_entries = roundup_pow_of_two(phandles);
        phandle_cache_mask = cache_entries - 1;
diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
index c00f82cc54aa..ee80e79db21a 100644
--- a/drivers/pci/controller/pci-hyperv.c
+++ b/drivers/pci/controller/pci-hyperv.c
@@ -89,6 +89,9 @@ static enum pci_protocol_version_t pci_protocol_version;
 #define STATUS_REVISION_MISMATCH 0xC0000059
+/* space for 32bit serial number as string */
+#define SLOT_NAME_SIZE 11
 /*
 * Message Types
 */
@@ -494,6 +497,7 @@ struct hv_pci_dev {
        struct list_head list_entry;
        refcount_t refs;
        enum hv_pcichild_state state;
+        struct pci_slot *pci_slot;
        struct pci_function_description desc;
        bool reported_missing;
        struct hv_pcibus_device *hbus;
@@ -1457,6 +1461,34 @@ static void prepopulate_bars(struct hv_pcibus_device *hbus)
        spin_unlock_irqrestore(&hbus->device_list_lock, flags);
 }
+/*
+ * Assign entries in sysfs pci slot directory.
+ *
+ * Note that this function does not need to lock the children list
+ * because it is called from pci_devices_present_work which
+ * is serialized with hv_eject_device_work because they are on the
+ * same ordered workqueue. Therefore hbus->children list will not change
+ * even when pci_create_slot sleeps.
+ */
+static void hv_pci_assign_slots(struct hv_pcibus_device *hbus)
+{
+        struct hv_pci_dev *hpdev;
+        char name[SLOT_NAME_SIZE];
+        int slot_nr;
+        list_for_each_entry(hpdev, &hbus->children, list_entry) {
+                if (hpdev->pci_slot)
+                        continue;
+                slot_nr = PCI_SLOT(wslot_to_devfn(hpdev->desc.win_slot.slot));
+                snprintf(name, SLOT_NAME_SIZE, "%u", hpdev->desc.ser);
+                hpdev->pci_slot = pci_create_slot(hbus->pci_bus, slot_nr,
+                                          name, NULL);
+                if (!hpdev->pci_slot)
+                        pr_warn("pci_create slot %s failed\n", name);
+        }
+}
 /**
 * create_root_hv_pci_bus() - Expose a new root PCI bus
 * @hbus:       Root PCI bus, as understood by this driver
@@ -1480,6 +1512,7 @@ static int create_root_hv_pci_bus(struct hv_pcibus_device *hbus)
        pci_lock_rescan_remove();
        pci_scan_child_bus(hbus->pci_bus);
        pci_bus_assign_resources(hbus->pci_bus);
+        hv_pci_assign_slots(hbus);
        pci_bus_add_devices(hbus->pci_bus);
        pci_unlock_rescan_remove();
        hbus->state = hv_pcibus_installed;
@@ -1742,6 +1775,7 @@ static void pci_devices_present_work(struct work_struct *work)
                 */
                pci_lock_rescan_remove();
                pci_scan_child_bus(hbus->pci_bus);
+                hv_pci_assign_slots(hbus);
                pci_unlock_rescan_remove();
                break;
@@ -1858,6 +1892,9 @@ static void hv_eject_device_work(struct work_struct *work)
        list_del(&hpdev->list_entry);
        spin_unlock_irqrestore(&hpdev->hbus->device_list_lock, flags);
+        if (hpdev->pci_slot)
+                pci_destroy_slot(hpdev->pci_slot);
        memset(&ctxt, 0, sizeof(ctxt));
        ejct_pkt = (struct pci_eject_response *)&ctxt.pkt.message;
        ejct_pkt->message_type.type = PCI_EJECTION_COMPLETE;
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 7136e3430925..a938abdb41ce 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -496,7 +496,7 @@ int pciehp_power_on_slot(struct slot *slot)
        u16 slot_status;
        int retval;
-        /* Clear sticky power-fault bit from previous power failures */
+        /* Clear power-fault bit from previous power failures */
        pcie_capability_read_word(pdev, PCI_EXP_SLTSTA, &slot_status);
        if (slot_status & PCI_EXP_SLTSTA_PFD)
                pcie_capability_write_word(pdev, PCI_EXP_SLTSTA,
@@ -646,6 +646,14 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
                pciehp_handle_button_press(slot);
        }
+        /* Check Power Fault Detected */
+        if ((events & PCI_EXP_SLTSTA_PFD) && !ctrl->power_fault_detected) {
+                ctrl->power_fault_detected = 1;
+                ctrl_err(ctrl, "Slot(%s): Power fault\n", slot_name(slot));
+                pciehp_set_attention_status(slot, 1);
+                pciehp_green_led_off(slot);
+        }
        /*
         * Disable requests have higher priority than Presence Detect Changed
         * or Data Link Layer State Changed events.
@@ -657,14 +665,6 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
                pciehp_handle_presence_or_link_change(slot, events);
        up_read(&ctrl->reset_lock);
-        /* Check Power Fault Detected */
-        if ((events & PCI_EXP_SLTSTA_PFD) && !ctrl->power_fault_detected) {
-                ctrl->power_fault_detected = 1;
-                ctrl_err(ctrl, "Slot(%s): Power fault\n", slot_name(slot));
-                pciehp_set_attention_status(slot, 1);
-                pciehp_green_led_off(slot);
-        }
        pci_config_pm_runtime_put(pdev);
        wake_up(&ctrl->requester);
        return IRQ_HANDLED;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 29ff9619b5fa..1835f3a7aa8d 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -4547,6 +4547,7 @@ int pci_bridge_secondary_bus_reset(struct pci_dev *dev)
        return pci_dev_wait(dev, "bus reset", PCIE_RESET_READY_POLL_MS);
 }
+EXPORT_SYMBOL_GPL(pci_bridge_secondary_bus_reset);
 static int pci_parent_bus_reset(struct pci_dev *dev, int probe)
 {
@@ -5200,7 +5201,7 @@ static int __pci_reset_bus(struct pci_bus *bus)
 */
 int pci_reset_bus(struct pci_dev *pdev)
 {
-        return pci_probe_reset_slot(pdev->slot) ?
+        return (!pci_probe_reset_slot(pdev->slot)) ?
            __pci_reset_slot(pdev->slot) : __pci_reset_bus(pdev->bus);
 }
 EXPORT_SYMBOL_GPL(pci_reset_bus);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index ec784009a36b..201f9e5ff55c 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -2074,6 +2074,7 @@ static void pci_configure_eetlp_prefix(struct pci_dev *dev)
 {
 #ifdef CONFIG_PCI_PASID
        struct pci_dev *bridge;
+        int pcie_type;
        u32 cap;
        if (!pci_is_pcie(dev))
@@ -2083,7 +2084,9 @@ static void pci_configure_eetlp_prefix(struct pci_dev *dev)
        if (!(cap & PCI_EXP_DEVCAP2_EE_PREFIX))
                return;
-        if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
+        pcie_type = pci_pcie_type(dev);
+        if (pcie_type == PCI_EXP_TYPE_ROOT_PORT ||
+            pcie_type == PCI_EXP_TYPE_RC_END)
                dev->eetlp_prefix_path = 1;
        else {
                bridge = pci_upstream_bridge(dev);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index ef7143a274e0..6bc27b7fd452 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4355,11 +4355,6 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags)
 *
 * 0x9d10-0x9d1b PCI Express Root port #{1-12}
 *
- * The 300 series chipset suffers from the same bug so include those root
- * ports here as well.
- *
- * 0xa32c-0xa343 PCI Express Root port #{0-24}
- *
 * [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html
 * [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html
 * [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html
@@ -4377,7 +4372,6 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev)
        case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */
        case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */
        case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */
-        case 0xa32c ... 0xa343:                         /* 300 series */
                return true;
        }
diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index 9940cc70f38b..54a8b30dda38 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -14,6 +14,8 @@
 #include <linux/poll.h>
 #include <linux/wait.h>
+#include <linux/nospec.h>
 MODULE_DESCRIPTION("Microsemi Switchtec(tm) PCIe Management Driver");
 MODULE_VERSION("0.1");
 MODULE_LICENSE("GPL");
@@ -909,6 +911,8 @@ static int ioctl_port_to_pff(struct switchtec_dev *stdev,
        default:
                if (p.port > ARRAY_SIZE(pcfg->dsp_pff_inst_id))
                        return -EINVAL;
+                p.port = array_index_nospec(p.port,
+                                        ARRAY_SIZE(pcfg->dsp_pff_inst_id) + 1);
                p.pff = ioread32(&pcfg->dsp_pff_inst_id[p.port - 1]);
                break;
        }
diff --git a/drivers/pinctrl/cirrus/pinctrl-madera-core.c b/drivers/pinctrl/cirrus/pinctrl-madera-core.c
index ece41fb2848f..c4f4d904e4a6 100644
--- a/drivers/pinctrl/cirrus/pinctrl-madera-core.c
+++ b/drivers/pinctrl/cirrus/pinctrl-madera-core.c
@@ -1040,7 +1040,7 @@ static int madera_pin_probe(struct platform_device *pdev)
        }
        /* if the configuration is provided through pdata, apply it */
-        if (pdata) {
+        if (pdata && pdata->gpio_configs) {
                ret = pinctrl_register_mappings(pdata->gpio_configs,
                                                pdata->n_gpio_configs);
                if (ret) {
diff --git a/drivers/pinctrl/intel/pinctrl-cannonlake.c b/drivers/pinctrl/intel/pinctrl-cannonlake.c
index fb1afe55bf53..8d48371caaa2 100644
--- a/drivers/pinctrl/intel/pinctrl-cannonlake.c
+++ b/drivers/pinctrl/intel/pinctrl-cannonlake.c
@@ -379,7 +379,7 @@ static const struct intel_padgroup cnlh_community1_gpps[] = {
 static const struct intel_padgroup cnlh_community3_gpps[] = {
        CNL_GPP(0, 155, 178, 192),              /* GPP_K */
        CNL_GPP(1, 179, 202, 224),              /* GPP_H */
-        CNL_GPP(2, 203, 215, 258),              /* GPP_E */
+        CNL_GPP(2, 203, 215, 256),              /* GPP_E */
        CNL_GPP(3, 216, 239, 288),              /* GPP_F */
        CNL_GPP(4, 240, 248, CNL_NO_GPIO),      /* SPI */
 };
diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index 62b009b27eda..ec8dafc94694 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -747,13 +747,63 @@ static const struct pinctrl_desc intel_pinctrl_desc = {
        .owner = THIS_MODULE,
 };
+/**
+ * intel_gpio_to_pin() - Translate from GPIO offset to pin number
+ * @pctrl: Pinctrl structure
+ * @offset: GPIO offset from gpiolib
+ * @commmunity: Community is filled here if not %NULL
+ * @padgrp: Pad group is filled here if not %NULL
+ *
+ * When coming through gpiolib irqchip, the GPIO offset is not
+ * automatically translated to pinctrl pin number. This function can be
+ * used to find out the corresponding pinctrl pin.
+ */
+static int intel_gpio_to_pin(struct intel_pinctrl *pctrl, unsigned offset,
+                             const struct intel_community **community,
+                             const struct intel_padgroup **padgrp)
+{
+        int i;
+        for (i = 0; i < pctrl->ncommunities; i++) {
+                const struct intel_community *comm = &pctrl->communities[i];
+                int j;
+                for (j = 0; j < comm->ngpps; j++) {
+                        const struct intel_padgroup *pgrp = &comm->gpps[j];
+                        if (pgrp->gpio_base < 0)
+                                continue;
+                        if (offset >= pgrp->gpio_base &&
+                            offset < pgrp->gpio_base + pgrp->size) {
+                                int pin;
+                                pin = pgrp->base + offset - pgrp->gpio_base;
+                                if (community)
+                                        *community = comm;
+                                if (padgrp)
+                                        *padgrp = pgrp;
+                                return pin;
+                        }
+                }
+        }
+        return -EINVAL;
+}
 static int intel_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
        struct intel_pinctrl *pctrl = gpiochip_get_data(chip);
        void __iomem *reg;
        u32 padcfg0;
+        int pin;
+        pin = intel_gpio_to_pin(pctrl, offset, NULL, NULL);
+        if (pin < 0)
+                return -EINVAL;
-        reg = intel_get_padcfg(pctrl, offset, PADCFG0);
+        reg = intel_get_padcfg(pctrl, pin, PADCFG0);
        if (!reg)
                return -EINVAL;
@@ -770,8 +820,13 @@ static void intel_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
        unsigned long flags;
        void __iomem *reg;
        u32 padcfg0;
+        int pin;
+        pin = intel_gpio_to_pin(pctrl, offset, NULL, NULL);
+        if (pin < 0)
+                return;
-        reg = intel_get_padcfg(pctrl, offset, PADCFG0);
+        reg = intel_get_padcfg(pctrl, pin, PADCFG0);
        if (!reg)
                return;
@@ -790,8 +845,13 @@ static int intel_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
        struct intel_pinctrl *pctrl = gpiochip_get_data(chip);
        void __iomem *reg;
        u32 padcfg0;
+        int pin;
-        reg = intel_get_padcfg(pctrl, offset, PADCFG0);
+        pin = intel_gpio_to_pin(pctrl, offset, NULL, NULL);
+        if (pin < 0)
+                return -EINVAL;
+        reg = intel_get_padcfg(pctrl, pin, PADCFG0);
        if (!reg)
                return -EINVAL;
@@ -827,51 +887,6 @@ static const struct gpio_chip intel_gpio_chip = {
        .set_config = gpiochip_generic_config,
 };
-/**
- * intel_gpio_to_pin() - Translate from GPIO offset to pin number
- * @pctrl: Pinctrl structure
- * @offset: GPIO offset from gpiolib
- * @commmunity: Community is filled here if not %NULL
- * @padgrp: Pad group is filled here if not %NULL
- *
- * When coming through gpiolib irqchip, the GPIO offset is not
- * automatically translated to pinctrl pin number. This function can be
- * used to find out the corresponding pinctrl pin.
- */
-static int intel_gpio_to_pin(struct intel_pinctrl *pctrl, unsigned offset,
-                             const struct intel_community **community,
-                             const struct intel_padgroup **padgrp)
-{
-        int i;
-        for (i = 0; i < pctrl->ncommunities; i++) {
-                const struct intel_community *comm = &pctrl->communities[i];
-                int j;
-                for (j = 0; j < comm->ngpps; j++) {
-                        const struct intel_padgroup *pgrp = &comm->gpps[j];
-                        if (pgrp->gpio_base < 0)
-                                continue;
-                        if (offset >= pgrp->gpio_base &&
-                            offset < pgrp->gpio_base + pgrp->size) {
-                                int pin;
-                                pin = pgrp->base + offset - pgrp->gpio_base;
-                                if (community)
-                                        *community = comm;
-                                if (padgrp)
-                                        *padgrp = pgrp;
-                                return pin;
-                        }
-                }
-        }
-        return -EINVAL;
-}
 static int intel_gpio_irq_reqres(struct irq_data *d)
 {
        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
index 6a1b6058b991..628817c40e3b 100644
--- a/drivers/pinctrl/pinctrl-ingenic.c
+++ b/drivers/pinctrl/pinctrl-ingenic.c
@@ -793,7 +793,7 @@ static int ingenic_pinctrl_probe(struct platform_device *pdev)
                err = pinctrl_generic_add_group(jzpc->pctl, group->name,
                                group->pins, group->num_pins, group->data);
-                if (err) {
+                if (err < 0) {
                        dev_err(dev, "Failed to register group %s\n",
                                        group->name);
                        return err;
@@ -806,7 +806,7 @@ static int ingenic_pinctrl_probe(struct platform_device *pdev)
                err = pinmux_generic_add_function(jzpc->pctl, func->name,
                                func->group_names, func->num_group_names,
                                func->data);
-                if (err) {
+                if (err < 0) {
                        dev_err(dev, "Failed to register function %s\n",
                                        func->name);
                        return err;
diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index 2155a30c282b..5d72ffad32c2 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -634,6 +634,29 @@ static void msm_gpio_irq_mask(struct irq_data *d)
        raw_spin_lock_irqsave(&pctrl->lock, flags);
        val = readl(pctrl->regs + g->intr_cfg_reg);
+        /*
+         * There are two bits that control interrupt forwarding to the CPU. The
+         * RAW_STATUS_EN bit causes the level or edge sensed on the line to be
+         * latched into the interrupt status register when the hardware detects
+         * an irq that it's configured for (either edge for edge type or level
+         * for level type irq). The 'non-raw' status enable bit causes the
+         * hardware to assert the summary interrupt to the CPU if the latched
+         * status bit is set. There's a bug though, the edge detection logic
+         * seems to have a problem where toggling the RAW_STATUS_EN bit may
+         * cause the status bit to latch spuriously when there isn't any edge
+         * so we can't touch that bit for edge type irqs and we have to keep
+         * the bit set anyway so that edges are latched while the line is masked.
+         *
+         * To make matters more complicated, leaving the RAW_STATUS_EN bit
+         * enabled all the time causes level interrupts to re-latch into the
+         * status register because the level is still present on the line after
+         * we ack it. We clear the raw status enable bit during mask here and
+         * set the bit on unmask so the interrupt can't latch into the hardware
+         * while it's masked.
+         */
+        if (irqd_get_trigger_type(d) & IRQ_TYPE_LEVEL_MASK)
+                val &= ~BIT(g->intr_raw_status_bit);
        val &= ~BIT(g->intr_enable_bit);
        writel(val, pctrl->regs + g->intr_cfg_reg);
@@ -655,6 +678,7 @@ static void msm_gpio_irq_unmask(struct irq_data *d)
        raw_spin_lock_irqsave(&pctrl->lock, flags);
        val = readl(pctrl->regs + g->intr_cfg_reg);
+        val |= BIT(g->intr_raw_status_bit);
        val |= BIT(g->intr_enable_bit);
        writel(val, pctrl->regs + g->intr_cfg_reg);
diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
index d975462a4c57..f10af5c383c5 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -536,6 +536,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
                if (obj && obj->type == ACPI_TYPE_INTEGER)
                        *out_data = (u32) obj->integer.value;
        }
+        kfree(output.pointer);
        return status;
 }
diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c
index 88afe5651d24..cf2229ece9ff 100644
--- a/drivers/platform/x86/dell-smbios-wmi.c
+++ b/drivers/platform/x86/dell-smbios-wmi.c
@@ -78,6 +78,7 @@ static int run_smbios_call(struct wmi_device *wdev)
        dev_dbg(&wdev->dev, "result: [%08x,%08x,%08x,%08x]\n",
                priv->buf->std.output[0], priv->buf->std.output[1],
                priv->buf->std.output[2], priv->buf->std.output[3]);
+        kfree(output.pointer);
        return 0;
 }
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index ec891bc7d10a..f039266b275d 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -872,8 +872,6 @@ static int hex2bitmap(const char *str, unsigned long *bitmap, int bits)
        if (bits & 0x07)
                return -EINVAL;
-        memset(bitmap, 0, bits / 8);
        if (str[0] == '0' && str[1] == 'x')
                str++;
        if (*str == 'x')
@@ -895,25 +893,23 @@ static int hex2bitmap(const char *str, unsigned long *bitmap, int bits)
 }
 /*
- * str2clrsetmasks() - parse bitmask argument and set the clear and
+ * modify_bitmap() - parse bitmask argument and modify an existing
- * the set bitmap mask. A concatenation (done with ',') of these terms
+ * bit mask accordingly. A concatenation (done with ',') of these
- * is recognized:
+ * terms is recognized:
 *   +<bitnr>[-<bitnr>] or -<bitnr>[-<bitnr>]
 * <bitnr> may be any valid number (hex, decimal or octal) in the range
 * 0...bits-1; the leading + or - is required. Here are some examples:
 *   +0-15,+32,-128,-0xFF
 *   -0-255,+1-16,+0x128
 *   +1,+2,+3,+4,-5,-7-10
- * Returns a clear and a set bitmask. Every positive value in the string
+ * Returns the new bitmap after all changes have been applied. Every
- * results in a bit set in the set mask and every negative value in the
+ * positive value in the string will set a bit and every negative value
- * string results in a bit SET in the clear mask. As a bit may be touched
+ * in the string will clear a bit. As a bit may be touched more than once,
- * more than once, the last 'operation' wins: +0-255,-128 = all but bit
+ * the last 'operation' wins:
- * 128 set in the set mask, only bit 128 set in the clear mask.
+ * +0-255,-128 = first bits 0-255 will be set, then bit 128 will be
+ * cleared again. All other bits are unmodified.
 */
-static int str2clrsetmasks(const char *str,
+static int modify_bitmap(const char *str, unsigned long *bitmap, int bits)
-                           unsigned long *clrmap,
-                           unsigned long *setmap,
-                           int bits)
 {
        int a, i, z;
        char *np, sign;
@@ -922,9 +918,6 @@ static int str2clrsetmasks(const char *str,
        if (bits & 0x07)
                return -EINVAL;
-        memset(clrmap, 0, bits / 8);
-        memset(setmap, 0, bits / 8);
        while (*str) {
                sign = *str++;
                if (sign != '+' && sign != '-')
@@ -940,13 +933,10 @@ static int str2clrsetmasks(const char *str,
                        str = np;
                }
                for (i = a; i <= z; i++)
-                        if (sign == '+') {
+                        if (sign == '+')
-                                set_bit_inv(i, setmap);
+                                set_bit_inv(i, bitmap);
-                                clear_bit_inv(i, clrmap);
+                        else
-                        } else {
+                                clear_bit_inv(i, bitmap);
-                                clear_bit_inv(i, setmap);
-                                set_bit_inv(i, clrmap);
-                        }
                while (*str == ',' || *str == '\n')
                        str++;
        }
@@ -970,44 +960,34 @@ static int process_mask_arg(const char *str,
                            unsigned long *bitmap, int bits,
                            struct mutex *lock)
 {
-        int i;
+        unsigned long *newmap, size;
+        int rc;
        /* bits needs to be a multiple of 8 */
        if (bits & 0x07)
                return -EINVAL;
+        size = BITS_TO_LONGS(bits)*sizeof(unsigned long);
+        newmap = kmalloc(size, GFP_KERNEL);
+        if (!newmap)
+                return -ENOMEM;
+        if (mutex_lock_interruptible(lock)) {
+                kfree(newmap);
+                return -ERESTARTSYS;
+        }
        if (*str == '+' || *str == '-') {
-                DECLARE_BITMAP(clrm, bits);
+                memcpy(newmap, bitmap, size);
-                DECLARE_BITMAP(setm, bits);
+                rc = modify_bitmap(str, newmap, bits);
-                i = str2clrsetmasks(str, clrm, setm, bits);
-                if (i)
-                        return i;
-                if (mutex_lock_interruptible(lock))
-                        return -ERESTARTSYS;
-                for (i = 0; i < bits; i++) {
-                        if (test_bit_inv(i, clrm))
-                                clear_bit_inv(i, bitmap);
-                        if (test_bit_inv(i, setm))
-                                set_bit_inv(i, bitmap);
-                }
        } else {
-                DECLARE_BITMAP(setm, bits);
+                memset(newmap, 0, size);
+                rc = hex2bitmap(str, newmap, bits);
-                i = hex2bitmap(str, setm, bits);
-                if (i)
-                        return i;
-                if (mutex_lock_interruptible(lock))
-                        return -ERESTARTSYS;
-                for (i = 0; i < bits; i++)
-                        if (test_bit_inv(i, setm))
-                                set_bit_inv(i, bitmap);
-                        else
-                                clear_bit_inv(i, bitmap);
        }
+        if (rc == 0)
+                memcpy(bitmap, newmap, size);
        mutex_unlock(lock);
+        kfree(newmap);
-        return 0;
+        return rc;
 }
 /*
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 49f64eb3eab0..de8282420f96 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -25,6 +25,7 @@
 #include <linux/netdevice.h>
 #include <linux/netdev_features.h>
 #include <linux/skbuff.h>
+#include <linux/vmalloc.h>
 #include <net/iucv/af_iucv.h>
 #include <net/dsfield.h>
@@ -4699,7 +4700,7 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
        priv.buffer_len = oat_data.buffer_len;
        priv.response_len = 0;
-        priv.buffer =  kzalloc(oat_data.buffer_len, GFP_KERNEL);
+        priv.buffer = vzalloc(oat_data.buffer_len);
        if (!priv.buffer) {
                rc = -ENOMEM;
                goto out;
@@ -4740,7 +4741,7 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
                        rc = -EFAULT;
 out_free:
-        kfree(priv.buffer);
+        vfree(priv.buffer);
 out:
        return rc;
 }
@@ -5706,6 +5707,8 @@ static struct net_device *qeth_alloc_netdev(struct qeth_card *card)
                dev->priv_flags &= ~IFF_TX_SKB_SHARING;
                dev->hw_features |= NETIF_F_SG;
                dev->vlan_features |= NETIF_F_SG;
+                if (IS_IQD(card))
+                        dev->features |= NETIF_F_SG;
        }
        return dev;
@@ -5768,8 +5771,10 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
        qeth_update_from_chp_desc(card);
        card->dev = qeth_alloc_netdev(card);
-        if (!card->dev)
+        if (!card->dev) {
+                rc = -ENOMEM;
                goto err_card;
+        }
        qeth_determine_capabilities(card);
        enforced_disc = qeth_enforce_discipline(card);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 710fa74892ae..b5e38531733f 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -423,7 +423,7 @@ static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
                default:
                        dev_kfree_skb_any(skb);
                        QETH_CARD_TEXT(card, 3, "inbunkno");
-                        QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
+                        QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
                        continue;
                }
                work_done++;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 7175086677fb..ada258c01a08 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1390,7 +1390,7 @@ static int qeth_l3_process_inbound_buffer(struct qeth_card *card,
                default:
                        dev_kfree_skb_any(skb);
                        QETH_CARD_TEXT(card, 3, "inbunkno");
-                        QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
+                        QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
                        continue;
                }
                work_done++;
diff --git a/drivers/scsi/qedi/qedi.h b/drivers/scsi/qedi/qedi.h
index fc3babc15fa3..a6f96b35e971 100644
--- a/drivers/scsi/qedi/qedi.h
+++ b/drivers/scsi/qedi/qedi.h
@@ -77,6 +77,11 @@ enum qedi_nvm_tgts {
        QEDI_NVM_TGT_SEC,
 };
+struct qedi_nvm_iscsi_image {
+        struct nvm_iscsi_cfg iscsi_cfg;
+        u32 crc;
+};
 struct qedi_uio_ctrl {
        /* meta data */
        u32 uio_hsi_version;
@@ -294,7 +299,7 @@ struct qedi_ctx {
        void *bdq_pbl_list;
        dma_addr_t bdq_pbl_list_dma;
        u8 bdq_pbl_list_num_entries;
-        struct nvm_iscsi_cfg *iscsi_cfg;
+        struct qedi_nvm_iscsi_image *iscsi_image;
        dma_addr_t nvm_buf_dma;
        void __iomem *bdq_primary_prod;
        void __iomem *bdq_secondary_prod;
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index aa96bccb5a96..cc8e64dc65ad 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1346,23 +1346,26 @@ exit_setup_int:
 static void qedi_free_nvm_iscsi_cfg(struct qedi_ctx *qedi)
 {
-        if (qedi->iscsi_cfg)
+        if (qedi->iscsi_image)
                dma_free_coherent(&qedi->pdev->dev,
-                                  sizeof(struct nvm_iscsi_cfg),
+                                  sizeof(struct qedi_nvm_iscsi_image),
-                                  qedi->iscsi_cfg, qedi->nvm_buf_dma);
+                                  qedi->iscsi_image, qedi->nvm_buf_dma);
 }
 static int qedi_alloc_nvm_iscsi_cfg(struct qedi_ctx *qedi)
 {
-        qedi->iscsi_cfg = dma_zalloc_coherent(&qedi->pdev->dev,
+        struct qedi_nvm_iscsi_image nvm_image;
-                                             sizeof(struct nvm_iscsi_cfg),
-                                             &qedi->nvm_buf_dma, GFP_KERNEL);
+        qedi->iscsi_image = dma_zalloc_coherent(&qedi->pdev->dev,
-        if (!qedi->iscsi_cfg) {
+                                                sizeof(nvm_image),
+                                                &qedi->nvm_buf_dma,
+                                                GFP_KERNEL);
+        if (!qedi->iscsi_image) {
                QEDI_ERR(&qedi->dbg_ctx, "Could not allocate NVM BUF.\n");
                return -ENOMEM;
        }
        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
-                  "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_cfg,
+                  "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_image,
                  qedi->nvm_buf_dma);
        return 0;
@@ -1905,7 +1908,7 @@ qedi_get_nvram_block(struct qedi_ctx *qedi)
        struct nvm_iscsi_block *block;
        pf = qedi->dev_info.common.abs_pf_id;
-        block = &qedi->iscsi_cfg->block[0];
+        block = &qedi->iscsi_image->iscsi_cfg.block[0];
        for (i = 0; i < NUM_OF_ISCSI_PF_SUPPORTED; i++, block++) {
                flags = ((block->id) & NVM_ISCSI_CFG_BLK_CTRL_FLAG_MASK) >>
                        NVM_ISCSI_CFG_BLK_CTRL_FLAG_OFFSET;
@@ -2194,15 +2197,14 @@ static void qedi_boot_release(void *data)
 static int qedi_get_boot_info(struct qedi_ctx *qedi)
 {
        int ret = 1;
-        u16 len;
+        struct qedi_nvm_iscsi_image nvm_image;
-        len = sizeof(struct nvm_iscsi_cfg);
        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
                  "Get NVM iSCSI CFG image\n");
        ret = qedi_ops->common->nvm_get_image(qedi->cdev,
                                              QED_NVM_IMAGE_ISCSI_CFG,
-                                              (char *)qedi->iscsi_cfg, len);
+                                              (char *)qedi->iscsi_image,
+                                              sizeof(nvm_image));
        if (ret)
                QEDI_ERR(&qedi->dbg_ctx,
                         "Could not get NVM image. ret = %d\n", ret);
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index fecf96f0225c..199d3ba1916d 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -374,8 +374,8 @@ struct atio_from_isp {
 static inline int fcpcmd_is_corrupted(struct atio *atio)
 {
        if (atio->entry_type == ATIO_TYPE7 &&
-            (le16_to_cpu(atio->attr_n_length & FCP_CMD_LENGTH_MASK) <
+            ((le16_to_cpu(atio->attr_n_length) & FCP_CMD_LENGTH_MASK) <
-            FCP_CMD_LENGTH_MIN))
+             FCP_CMD_LENGTH_MIN))
                return 1;
        else
                return 0;
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 7cb3ab0a35a0..3082e72e4f6c 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -30,7 +30,11 @@
 #define DRIVER_NAME "fsl-dspi"
+#ifdef CONFIG_M5441x
+#define DSPI_FIFO_SIZE                  16
+#else
 #define DSPI_FIFO_SIZE                  4
+#endif
 #define DSPI_DMA_BUFSIZE                (DSPI_FIFO_SIZE * 1024)
 #define SPI_MCR         0x00
@@ -623,9 +627,11 @@ static void dspi_tcfq_read(struct fsl_dspi *dspi)
 static void dspi_eoq_write(struct fsl_dspi *dspi)
 {
        int fifo_size = DSPI_FIFO_SIZE;
+        u16 xfer_cmd = dspi->tx_cmd;
        /* Fill TX FIFO with as many transfers as possible */
        while (dspi->len && fifo_size--) {
+                dspi->tx_cmd = xfer_cmd;
                /* Request EOQF for last transfer in FIFO */
                if (dspi->len == dspi->bytes_per_word || fifo_size == 0)
                        dspi->tx_cmd |= SPI_PUSHR_CMD_EOQ;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index ec395a6baf9c..9da0bc5a036c 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2143,8 +2143,17 @@ int spi_register_controller(struct spi_controller *ctlr)
         */
        if (ctlr->num_chipselect == 0)
                return -EINVAL;
-        /* allocate dynamic bus number using Linux idr */
+        if (ctlr->bus_num >= 0) {
-        if ((ctlr->bus_num < 0) && ctlr->dev.of_node) {
+                /* devices with a fixed bus num must check-in with the num */
+                mutex_lock(&board_lock);
+                id = idr_alloc(&spi_master_idr, ctlr, ctlr->bus_num,
+                        ctlr->bus_num + 1, GFP_KERNEL);
+                mutex_unlock(&board_lock);
+                if (WARN(id < 0, "couldn't get idr"))
+                        return id == -ENOSPC ? -EBUSY : id;
+                ctlr->bus_num = id;
+        } else if (ctlr->dev.of_node) {
+                /* allocate dynamic bus number using Linux idr */
                id = of_alias_get_id(ctlr->dev.of_node, "spi");
                if (id >= 0) {
                        ctlr->bus_num = id;
diff --git a/drivers/staging/erofs/Kconfig b/drivers/staging/erofs/Kconfig
index 96f614934df1..663b755bf2fb 100644
--- a/drivers/staging/erofs/Kconfig
+++ b/drivers/staging/erofs/Kconfig
@@ -2,7 +2,7 @@
 config EROFS_FS
        tristate "EROFS filesystem support"
-        depends on BROKEN
+        depends on BLOCK
        help
          EROFS(Enhanced Read-Only File System) is a lightweight
          read-only file system with modern designs (eg. page-sized
diff --git a/drivers/staging/erofs/super.c b/drivers/staging/erofs/super.c
index 1aec509c805f..2df9768edac9 100644
--- a/drivers/staging/erofs/super.c
+++ b/drivers/staging/erofs/super.c
@@ -340,7 +340,7 @@ static int erofs_read_super(struct super_block *sb,
                goto err_sbread;
        sb->s_magic = EROFS_SUPER_MAGIC;
-        sb->s_flags |= MS_RDONLY | MS_NOATIME;
+        sb->s_flags |= SB_RDONLY | SB_NOATIME;
        sb->s_maxbytes = MAX_LFS_FILESIZE;
        sb->s_time_gran = 1;
@@ -627,7 +627,7 @@ static int erofs_remount(struct super_block *sb, int *flags, char *data)
 {
        BUG_ON(!sb_rdonly(sb));
-        *flags |= MS_RDONLY;
+        *flags |= SB_RDONLY;
        return 0;
 }
diff --git a/drivers/staging/fbtft/TODO b/drivers/staging/fbtft/TODO
index 7e64c7e438f0..a9f4802bb6be 100644
--- a/drivers/staging/fbtft/TODO
+++ b/drivers/staging/fbtft/TODO
@@ -2,3 +2,7 @@
  GPIO descriptor API in <linux/gpio/consumer.h> and look up GPIO
  lines from device tree, ACPI or board files, board files should
  use <linux/gpio/machine.h>
+* convert all these over to drm_simple_display_pipe and submit for inclusion
+  into the DRM subsystem under drivers/gpu/drm - fbdev doesn't take any new
+  drivers anymore.
diff --git a/drivers/staging/gasket/TODO b/drivers/staging/gasket/TODO
index 6ff8e01b04cc..5b1865f8af2d 100644
--- a/drivers/staging/gasket/TODO
+++ b/drivers/staging/gasket/TODO
@@ -1,9 +1,22 @@
 This is a list of things that need to be done to get this driver out of the
 staging directory.
+- Implement the gasket framework's functionality through UIO instead of
+  introducing a new user-space drivers framework that is quite similar.
+  UIO provides the necessary bits to implement user-space drivers. Meanwhile
+  the gasket APIs adds some extra conveniences like PCI BAR mapping, and
+  MSI interrupts. Add these features to the UIO subsystem, then re-implement
+  the Apex driver as a basic UIO driver instead (include/linux/uio_driver.h)
 - Document sysfs files with Documentation/ABI/ entries.
 - Use misc interface instead of major number for driver version description.
 - Add descriptions of module_param's
 - apex_get_status() should actually check status.
 - "drivers" should never be dealing with "raw" sysfs calls or mess around with
  kobjects at all. The driver core should handle all of this for you
  automaically. There should not be a need for raw attribute macros.
diff --git a/drivers/staging/vboxvideo/vbox_drv.c b/drivers/staging/vboxvideo/vbox_drv.c
index da92c493f157..69cc508af1bc 100644
--- a/drivers/staging/vboxvideo/vbox_drv.c
+++ b/drivers/staging/vboxvideo/vbox_drv.c
@@ -59,6 +59,11 @@ static int vbox_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                ret = PTR_ERR(dev);
                goto err_drv_alloc;
        }
+        ret = pci_enable_device(pdev);
+        if (ret)
+                goto err_pci_enable;
        dev->pdev = pdev;
        pci_set_drvdata(pdev, dev);
@@ -75,6 +80,8 @@ static int vbox_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 err_drv_dev_register:
        vbox_driver_unload(dev);
 err_vbox_driver_load:
+        pci_disable_device(pdev);
+ err_pci_enable:
        drm_dev_put(dev);
 err_drv_alloc:
        return ret;
diff --git a/drivers/staging/vboxvideo/vbox_mode.c b/drivers/staging/vboxvideo/vbox_mode.c
index a83eac8668d0..79836c8fb909 100644
--- a/drivers/staging/vboxvideo/vbox_mode.c
+++ b/drivers/staging/vboxvideo/vbox_mode.c
@@ -323,6 +323,11 @@ static int vbox_crtc_page_flip(struct drm_crtc *crtc,
        if (rc)
                return rc;
+        mutex_lock(&vbox->hw_mutex);
+        vbox_set_view(crtc);
+        vbox_do_modeset(crtc, &crtc->mode);
+        mutex_unlock(&vbox->hw_mutex);
        spin_lock_irqsave(&drm->event_lock, flags);
        if (event)
diff --git a/drivers/staging/wilc1000/Makefile b/drivers/staging/wilc1000/Makefile
index f7b07c0b5ce2..ee7e26b886a5 100644
--- a/drivers/staging/wilc1000/Makefile
+++ b/drivers/staging/wilc1000/Makefile
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
+obj-$(CONFIG_WILC1000) += wilc1000.o
 ccflags-y += -DFIRMWARE_1002=\"atmel/wilc1002_firmware.bin\" \
                -DFIRMWARE_1003=\"atmel/wilc1003_firmware.bin\"
@@ -11,9 +12,7 @@ wilc1000-objs := wilc_wfi_cfgoperations.o linux_wlan.o linux_mon.o \
                        wilc_wlan.o
 obj-$(CONFIG_WILC1000_SDIO) += wilc1000-sdio.o
-wilc1000-sdio-objs += $(wilc1000-objs)
 wilc1000-sdio-objs += wilc_sdio.o
 obj-$(CONFIG_WILC1000_SPI) += wilc1000-spi.o
-wilc1000-spi-objs += $(wilc1000-objs)
 wilc1000-spi-objs += wilc_spi.o
diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c
index 01cf4bd2e192..3b8d237decbf 100644
--- a/drivers/staging/wilc1000/linux_wlan.c
+++ b/drivers/staging/wilc1000/linux_wlan.c
@@ -1038,8 +1038,8 @@ void wilc_netdev_cleanup(struct wilc *wilc)
        }
        kfree(wilc);
-        wilc_debugfs_remove();
 }
+EXPORT_SYMBOL_GPL(wilc_netdev_cleanup);
 static const struct net_device_ops wilc_netdev_ops = {
        .ndo_init = mac_init_fn,
@@ -1062,7 +1062,6 @@ int wilc_netdev_init(struct wilc **wilc, struct device *dev, int io_type,
        if (!wl)
                return -ENOMEM;
-        wilc_debugfs_init();
        *wilc = wl;
        wl->io_type = io_type;
        wl->hif_func = ops;
@@ -1124,3 +1123,6 @@ int wilc_netdev_init(struct wilc **wilc, struct device *dev, int io_type,
        return 0;
 }
+EXPORT_SYMBOL_GPL(wilc_netdev_init);
+MODULE_LICENSE("GPL");
diff --git a/drivers/staging/wilc1000/wilc_debugfs.c b/drivers/staging/wilc1000/wilc_debugfs.c
index edc72876458d..8001df66b8c2 100644
--- a/drivers/staging/wilc1000/wilc_debugfs.c
+++ b/drivers/staging/wilc1000/wilc_debugfs.c
@@ -19,6 +19,7 @@ static struct dentry *wilc_dir;
 #define DBG_LEVEL_ALL   (DEBUG | INFO | WRN | ERR)
 static atomic_t WILC_DEBUG_LEVEL = ATOMIC_INIT(ERR);
+EXPORT_SYMBOL_GPL(WILC_DEBUG_LEVEL);
 static ssize_t wilc_debug_level_read(struct file *file, char __user *userbuf,
                                     size_t count, loff_t *ppos)
@@ -87,7 +88,7 @@ static struct wilc_debugfs_info_t debugfs_info[] = {
        },
 };
-int wilc_debugfs_init(void)
+static int __init wilc_debugfs_init(void)
 {
        int i;
        struct wilc_debugfs_info_t *info;
@@ -103,10 +104,12 @@ int wilc_debugfs_init(void)
        }
        return 0;
 }
+module_init(wilc_debugfs_init);
-void wilc_debugfs_remove(void)
+static void __exit wilc_debugfs_remove(void)
 {
        debugfs_remove_recursive(wilc_dir);
 }
+module_exit(wilc_debugfs_remove);
 #endif
diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 6787b6e9f124..8b184aa30d25 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -417,6 +417,7 @@ void chip_allow_sleep(struct wilc *wilc)
        wilc->hif_func->hif_write_reg(wilc, 0xf0, reg & ~BIT(0));
        wilc->hif_func->hif_write_reg(wilc, 0xfa, 0);
 }
+EXPORT_SYMBOL_GPL(chip_allow_sleep);
 void chip_wakeup(struct wilc *wilc)
 {
@@ -471,6 +472,7 @@ void chip_wakeup(struct wilc *wilc)
        }
        chip_ps_state = CHIP_WAKEDUP;
 }
+EXPORT_SYMBOL_GPL(chip_wakeup);
 void wilc_chip_sleep_manually(struct wilc *wilc)
 {
@@ -484,6 +486,7 @@ void wilc_chip_sleep_manually(struct wilc *wilc)
        chip_ps_state = CHIP_SLEEPING_MANUAL;
        release_bus(wilc, RELEASE_ONLY);
 }
+EXPORT_SYMBOL_GPL(wilc_chip_sleep_manually);
 void host_wakeup_notify(struct wilc *wilc)
 {
@@ -491,6 +494,7 @@ void host_wakeup_notify(struct wilc *wilc)
        wilc->hif_func->hif_write_reg(wilc, 0x10b0, 1);
        release_bus(wilc, RELEASE_ONLY);
 }
+EXPORT_SYMBOL_GPL(host_wakeup_notify);
 void host_sleep_notify(struct wilc *wilc)
 {
@@ -498,6 +502,7 @@ void host_sleep_notify(struct wilc *wilc)
        wilc->hif_func->hif_write_reg(wilc, 0x10ac, 1);
        release_bus(wilc, RELEASE_ONLY);
 }
+EXPORT_SYMBOL_GPL(host_sleep_notify);
 int wilc_wlan_handle_txq(struct net_device *dev, u32 *txq_count)
 {
@@ -871,6 +876,7 @@ void wilc_handle_isr(struct wilc *wilc)
        release_bus(wilc, RELEASE_ALLOW_SLEEP);
 }
+EXPORT_SYMBOL_GPL(wilc_handle_isr);
 int wilc_wlan_firmware_download(struct wilc *wilc, const u8 *buffer,
                                u32 buffer_size)
diff --git a/drivers/staging/wilc1000/wilc_wlan_if.h b/drivers/staging/wilc1000/wilc_wlan_if.h
index 00d13b153f80..b81a73b9bd67 100644
--- a/drivers/staging/wilc1000/wilc_wlan_if.h
+++ b/drivers/staging/wilc1000/wilc_wlan_if.h
@@ -831,6 +831,4 @@ struct wilc;
 int wilc_wlan_init(struct net_device *dev);
 u32 wilc_get_chipid(struct wilc *wilc, bool update);
-int wilc_debugfs_init(void);
-void wilc_debugfs_remove(void);
 #endif
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 94bad43c41ff..cc756a123fd8 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1416,7 +1416,8 @@ static void iscsit_do_crypto_hash_buf(struct ahash_request *hash,
        sg_init_table(sg, ARRAY_SIZE(sg));
        sg_set_buf(sg, buf, payload_length);
-        sg_set_buf(sg + 1, pad_bytes, padding);
+        if (padding)
+                sg_set_buf(sg + 1, pad_bytes, padding);
        ahash_request_set_crypt(hash, sg, data_crc, payload_length + padding);
@@ -3910,10 +3911,14 @@ static bool iscsi_target_check_conn_state(struct iscsi_conn *conn)
 static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
 {
        int ret;
-        u8 buffer[ISCSI_HDR_LEN], opcode;
+        u8 *buffer, opcode;
        u32 checksum = 0, digest = 0;
        struct kvec iov;
+        buffer = kcalloc(ISCSI_HDR_LEN, sizeof(*buffer), GFP_KERNEL);
+        if (!buffer)
+                return;
        while (!kthread_should_stop()) {
                /*
                 * Ensure that both TX and RX per connection kthreads
@@ -3921,7 +3926,6 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                 */
                iscsit_thread_check_cpumask(conn, current, 0);
-                memset(buffer, 0, ISCSI_HDR_LEN);
                memset(&iov, 0, sizeof(struct kvec));
                iov.iov_base    = buffer;
@@ -3930,7 +3934,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                ret = rx_data(conn, &iov, 1, ISCSI_HDR_LEN);
                if (ret != ISCSI_HDR_LEN) {
                        iscsit_rx_thread_wait_for_tcp(conn);
-                        return;
+                        break;
                }
                if (conn->conn_ops->HeaderDigest) {
@@ -3940,7 +3944,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                        ret = rx_data(conn, &iov, 1, ISCSI_CRC_LEN);
                        if (ret != ISCSI_CRC_LEN) {
                                iscsit_rx_thread_wait_for_tcp(conn);
-                                return;
+                                break;
                        }
                        iscsit_do_crypto_hash_buf(conn->conn_rx_hash, buffer,
@@ -3964,7 +3968,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                }
                if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT)
-                        return;
+                        break;
                opcode = buffer[0] & ISCSI_OPCODE_MASK;
@@ -3975,13 +3979,15 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn)
                        " while in Discovery Session, rejecting.\n", opcode);
                        iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
                                          buffer);
-                        return;
+                        break;
                }
                ret = iscsi_target_rx_opcode(conn, buffer);
                if (ret < 0)
-                        return;
+                        break;
        }
+        kfree(buffer);
 }
 int iscsi_target_rx_thread(void *arg)
@@ -4208,22 +4214,15 @@ int iscsit_close_connection(
                crypto_free_ahash(tfm);
        }
-        free_cpumask_var(conn->conn_cpumask);
-        kfree(conn->conn_ops);
-        conn->conn_ops = NULL;
        if (conn->sock)
                sock_release(conn->sock);
        if (conn->conn_transport->iscsit_free_conn)
                conn->conn_transport->iscsit_free_conn(conn);
-        iscsit_put_transport(conn->conn_transport);
        pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
        conn->conn_state = TARG_CONN_STATE_FREE;
-        kfree(conn);
+        iscsit_free_conn(conn);
        spin_lock_bh(&sess->conn_lock);
        atomic_dec(&sess->nconn);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 9e74f8bc2963..bb90c80ff388 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -67,45 +67,10 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn)
                goto out_req_buf;
        }
-        conn->conn_ops = kzalloc(sizeof(struct iscsi_conn_ops), GFP_KERNEL);
-        if (!conn->conn_ops) {
-                pr_err("Unable to allocate memory for"
-                        " struct iscsi_conn_ops.\n");
-                goto out_rsp_buf;
-        }
-        init_waitqueue_head(&conn->queues_wq);
-        INIT_LIST_HEAD(&conn->conn_list);
-        INIT_LIST_HEAD(&conn->conn_cmd_list);
-        INIT_LIST_HEAD(&conn->immed_queue_list);
-        INIT_LIST_HEAD(&conn->response_queue_list);
-        init_completion(&conn->conn_post_wait_comp);
-        init_completion(&conn->conn_wait_comp);
-        init_completion(&conn->conn_wait_rcfr_comp);
-        init_completion(&conn->conn_waiting_on_uc_comp);
-        init_completion(&conn->conn_logout_comp);
-        init_completion(&conn->rx_half_close_comp);
-        init_completion(&conn->tx_half_close_comp);
-        init_completion(&conn->rx_login_comp);
-        spin_lock_init(&conn->cmd_lock);
-        spin_lock_init(&conn->conn_usage_lock);
-        spin_lock_init(&conn->immed_queue_lock);
-        spin_lock_init(&conn->nopin_timer_lock);
-        spin_lock_init(&conn->response_queue_lock);
-        spin_lock_init(&conn->state_lock);
-        if (!zalloc_cpumask_var(&conn->conn_cpumask, GFP_KERNEL)) {
-                pr_err("Unable to allocate conn->conn_cpumask\n");
-                goto out_conn_ops;
-        }
        conn->conn_login = login;
        return login;
-out_conn_ops:
-        kfree(conn->conn_ops);
-out_rsp_buf:
-        kfree(login->rsp_buf);
 out_req_buf:
        kfree(login->req_buf);
 out_login:
@@ -310,11 +275,9 @@ static int iscsi_login_zero_tsih_s1(
                return -ENOMEM;
        }
-        ret = iscsi_login_set_conn_values(sess, conn, pdu->cid);
+        if (iscsi_login_set_conn_values(sess, conn, pdu->cid))
-        if (unlikely(ret)) {
+                goto free_sess;
-                kfree(sess);
-                return ret;
-        }
        sess->init_task_tag     = pdu->itt;
        memcpy(&sess->isid, pdu->isid, 6);
        sess->exp_cmd_sn        = be32_to_cpu(pdu->cmdsn);
@@ -1149,6 +1112,75 @@ iscsit_conn_set_transport(struct iscsi_conn *conn, struct iscsit_transport *t)
        return 0;
 }
+static struct iscsi_conn *iscsit_alloc_conn(struct iscsi_np *np)
+{
+        struct iscsi_conn *conn;
+        conn = kzalloc(sizeof(struct iscsi_conn), GFP_KERNEL);
+        if (!conn) {
+                pr_err("Could not allocate memory for new connection\n");
+                return NULL;
+        }
+        pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
+        conn->conn_state = TARG_CONN_STATE_FREE;
+        init_waitqueue_head(&conn->queues_wq);
+        INIT_LIST_HEAD(&conn->conn_list);
+        INIT_LIST_HEAD(&conn->conn_cmd_list);
+        INIT_LIST_HEAD(&conn->immed_queue_list);
+        INIT_LIST_HEAD(&conn->response_queue_list);
+        init_completion(&conn->conn_post_wait_comp);
+        init_completion(&conn->conn_wait_comp);
+        init_completion(&conn->conn_wait_rcfr_comp);
+        init_completion(&conn->conn_waiting_on_uc_comp);
+        init_completion(&conn->conn_logout_comp);
+        init_completion(&conn->rx_half_close_comp);
+        init_completion(&conn->tx_half_close_comp);
+        init_completion(&conn->rx_login_comp);
+        spin_lock_init(&conn->cmd_lock);
+        spin_lock_init(&conn->conn_usage_lock);
+        spin_lock_init(&conn->immed_queue_lock);
+        spin_lock_init(&conn->nopin_timer_lock);
+        spin_lock_init(&conn->response_queue_lock);
+        spin_lock_init(&conn->state_lock);
+        timer_setup(&conn->nopin_response_timer,
+                    iscsit_handle_nopin_response_timeout, 0);
+        timer_setup(&conn->nopin_timer, iscsit_handle_nopin_timeout, 0);
+        if (iscsit_conn_set_transport(conn, np->np_transport) < 0)
+                goto free_conn;
+        conn->conn_ops = kzalloc(sizeof(struct iscsi_conn_ops), GFP_KERNEL);
+        if (!conn->conn_ops) {
+                pr_err("Unable to allocate memory for struct iscsi_conn_ops.\n");
+                goto put_transport;
+        }
+        if (!zalloc_cpumask_var(&conn->conn_cpumask, GFP_KERNEL)) {
+                pr_err("Unable to allocate conn->conn_cpumask\n");
+                goto free_mask;
+        }
+        return conn;
+free_mask:
+        free_cpumask_var(conn->conn_cpumask);
+put_transport:
+        iscsit_put_transport(conn->conn_transport);
+free_conn:
+        kfree(conn);
+        return NULL;
+}
+void iscsit_free_conn(struct iscsi_conn *conn)
+{
+        free_cpumask_var(conn->conn_cpumask);
+        kfree(conn->conn_ops);
+        iscsit_put_transport(conn->conn_transport);
+        kfree(conn);
+}
 void iscsi_target_login_sess_out(struct iscsi_conn *conn,
                struct iscsi_np *np, bool zero_tsih, bool new_sess)
 {
@@ -1198,10 +1230,6 @@ old_sess_out:
                crypto_free_ahash(tfm);
        }
-        free_cpumask_var(conn->conn_cpumask);
-        kfree(conn->conn_ops);
        if (conn->param_list) {
                iscsi_release_param_list(conn->param_list);
                conn->param_list = NULL;
@@ -1219,8 +1247,7 @@ old_sess_out:
        if (conn->conn_transport->iscsit_free_conn)
                conn->conn_transport->iscsit_free_conn(conn);
-        iscsit_put_transport(conn->conn_transport);
+        iscsit_free_conn(conn);
-        kfree(conn);
 }
 static int __iscsi_target_login_thread(struct iscsi_np *np)
@@ -1250,31 +1277,16 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
        }
        spin_unlock_bh(&np->np_thread_lock);
-        conn = kzalloc(sizeof(struct iscsi_conn), GFP_KERNEL);
+        conn = iscsit_alloc_conn(np);
        if (!conn) {
-                pr_err("Could not allocate memory for"
-                        " new connection\n");
                /* Get another socket */
                return 1;
        }
-        pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
-        conn->conn_state = TARG_CONN_STATE_FREE;
-        timer_setup(&conn->nopin_response_timer,
-                    iscsit_handle_nopin_response_timeout, 0);
-        timer_setup(&conn->nopin_timer, iscsit_handle_nopin_timeout, 0);
-        if (iscsit_conn_set_transport(conn, np->np_transport) < 0) {
-                kfree(conn);
-                return 1;
-        }
        rc = np->np_transport->iscsit_accept_np(np, conn);
        if (rc == -ENOSYS) {
                complete(&np->np_restart_comp);
-                iscsit_put_transport(conn->conn_transport);
+                iscsit_free_conn(conn);
-                kfree(conn);
-                conn = NULL;
                goto exit;
        } else if (rc < 0) {
                spin_lock_bh(&np->np_thread_lock);
@@ -1282,17 +1294,13 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                        np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                        spin_unlock_bh(&np->np_thread_lock);
                        complete(&np->np_restart_comp);
-                        iscsit_put_transport(conn->conn_transport);
+                        iscsit_free_conn(conn);
-                        kfree(conn);
-                        conn = NULL;
                        /* Get another socket */
                        return 1;
                }
                spin_unlock_bh(&np->np_thread_lock);
-                iscsit_put_transport(conn->conn_transport);
+                iscsit_free_conn(conn);
-                kfree(conn);
+                return 1;
-                conn = NULL;
-                goto out;
        }
        /*
         * Perform the remaining iSCSI connection initialization items..
@@ -1442,7 +1450,6 @@ old_sess_out:
                tpg_np = NULL;
        }
-out:
        return 1;
 exit:
diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
index 74ac3abc44a0..3b8e3639ff5d 100644
--- a/drivers/target/iscsi/iscsi_target_login.h
+++ b/drivers/target/iscsi/iscsi_target_login.h
@@ -19,7 +19,7 @@ extern int iscsi_target_setup_login_socket(struct iscsi_np *,
 extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
 extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
 extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
-extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
+extern void iscsit_free_conn(struct iscsi_conn *);
 extern int iscsit_start_kthreads(struct iscsi_conn *);
 extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
 extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index 5414c4a87bea..27284a2dcd2b 100644
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -522,6 +522,8 @@ static int hvc_write(struct tty_struct *tty, const unsigned char *buf, int count
                return -EIO;
        while (count > 0) {
+                int ret = 0;
                spin_lock_irqsave(&hp->lock, flags);
                rsize = hp->outbuf_size - hp->n_outbuf;
@@ -537,10 +539,13 @@ static int hvc_write(struct tty_struct *tty, const unsigned char *buf, int count
                }
                if (hp->n_outbuf > 0)
-                        hvc_push(hp);
+                        ret = hvc_push(hp);
                spin_unlock_irqrestore(&hp->lock, flags);
+                if (!ret)
+                        break;
                if (count) {
                        if (hp->n_outbuf > 0)
                                hvc_flush(hp);
@@ -623,6 +628,15 @@ static int hvc_chars_in_buffer(struct tty_struct *tty)
 #define MAX_TIMEOUT             (2000)
 static u32 timeout = MIN_TIMEOUT;
+/*
+ * Maximum number of bytes to get from the console driver if hvc_poll is
+ * called from driver (and can't sleep). Any more than this and we break
+ * and start polling with khvcd. This value was derived from from an OpenBMC
+ * console with the OPAL driver that results in about 0.25ms interrupts off
+ * latency.
+ */
+#define HVC_ATOMIC_READ_MAX     128
 #define HVC_POLL_READ   0x00000001
 #define HVC_POLL_WRITE  0x00000002
@@ -669,8 +683,8 @@ static int __hvc_poll(struct hvc_struct *hp, bool may_sleep)
        if (!hp->irq_requested)
                poll_mask |= HVC_POLL_READ;
+ read_again:
        /* Read data if any */
        count = tty_buffer_request_room(&hp->port, N_INBUF);
        /* If flip is full, just reschedule a later read */
@@ -717,9 +731,23 @@ static int __hvc_poll(struct hvc_struct *hp, bool may_sleep)
 #endif /* CONFIG_MAGIC_SYSRQ */
                tty_insert_flip_char(&hp->port, buf[i], 0);
        }
-        if (n == count)
+        read_total += n;
-                poll_mask |= HVC_POLL_READ;
-        read_total = n;
+        if (may_sleep) {
+                /* Keep going until the flip is full */
+                spin_unlock_irqrestore(&hp->lock, flags);
+                cond_resched();
+                spin_lock_irqsave(&hp->lock, flags);
+                goto read_again;
+        } else if (read_total < HVC_ATOMIC_READ_MAX) {
+                /* Break and defer if it's a large read in atomic */
+                goto read_again;
+        }
+        /*
+         * Latency break, schedule another poll immediately.
+         */
+        poll_mask |= HVC_POLL_READ;
 out:
        /* Wakeup write queue if necessary */
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 27346d69f393..f9b40a9dc4d3 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -780,20 +780,9 @@ static int acm_tty_write(struct tty_struct *tty,
        }
        if (acm->susp_count) {
-                if (acm->putbuffer) {
-                        /* now to preserve order */
-                        usb_anchor_urb(acm->putbuffer->urb, &acm->delayed);
-                        acm->putbuffer = NULL;
-                }
                usb_anchor_urb(wb->urb, &acm->delayed);
                spin_unlock_irqrestore(&acm->write_lock, flags);
                return count;
-        } else {
-                if (acm->putbuffer) {
-                        /* at this point there is no good way to handle errors */
-                        acm_start_wb(acm, acm->putbuffer);
-                        acm->putbuffer = NULL;
-                }
        }
        stat = acm_start_wb(acm, wb);
@@ -804,66 +793,6 @@ static int acm_tty_write(struct tty_struct *tty,
        return count;
 }
-static void acm_tty_flush_chars(struct tty_struct *tty)
-{
-        struct acm *acm = tty->driver_data;
-        struct acm_wb *cur;
-        int err;
-        unsigned long flags;
-        spin_lock_irqsave(&acm->write_lock, flags);
-        cur = acm->putbuffer;
-        if (!cur) /* nothing to do */
-                goto out;
-        acm->putbuffer = NULL;
-        err = usb_autopm_get_interface_async(acm->control);
-        if (err < 0) {
-                cur->use = 0;
-                acm->putbuffer = cur;
-                goto out;
-        }
-        if (acm->susp_count)
-                usb_anchor_urb(cur->urb, &acm->delayed);
-        else
-                acm_start_wb(acm, cur);
-out:
-        spin_unlock_irqrestore(&acm->write_lock, flags);
-        return;
-}
-static int acm_tty_put_char(struct tty_struct *tty, unsigned char ch)
-{
-        struct acm *acm = tty->driver_data;
-        struct acm_wb *cur;
-        int wbn;
-        unsigned long flags;
-overflow:
-        cur = acm->putbuffer;
-        if (!cur) {
-                spin_lock_irqsave(&acm->write_lock, flags);
-                wbn = acm_wb_alloc(acm);
-                if (wbn >= 0) {
-                        cur = &acm->wb[wbn];
-                        acm->putbuffer = cur;
-                }
-                spin_unlock_irqrestore(&acm->write_lock, flags);
-                if (!cur)
-                        return 0;
-        }
-        if (cur->len == acm->writesize) {
-                acm_tty_flush_chars(tty);
-                goto overflow;
-        }
-        cur->buf[cur->len++] = ch;
-        return 1;
-}
 static int acm_tty_write_room(struct tty_struct *tty)
 {
        struct acm *acm = tty->driver_data;
@@ -1987,8 +1916,6 @@ static const struct tty_operations acm_ops = {
        .cleanup =              acm_tty_cleanup,
        .hangup =               acm_tty_hangup,
        .write =                acm_tty_write,
-        .put_char =             acm_tty_put_char,
-        .flush_chars =          acm_tty_flush_chars,
        .write_room =           acm_tty_write_room,
        .ioctl =                acm_tty_ioctl,
        .throttle =             acm_tty_throttle,
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index eacc116e83da..ca06b20d7af9 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -96,7 +96,6 @@ struct acm {
        unsigned long read_urbs_free;
        struct urb *read_urbs[ACM_NR];
        struct acm_rb read_buffers[ACM_NR];
-        struct acm_wb *putbuffer;                       /* for acm_tty_put_char() */
        int rx_buflimit;
        spinlock_t read_lock;
        u8 *notification_buffer;                        /* to reassemble fragmented notifications */
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index bec581fb7c63..656d247819c9 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -460,7 +460,7 @@ static int service_outstanding_interrupt(struct wdm_device *desc)
        set_bit(WDM_RESPONDING, &desc->flags);
        spin_unlock_irq(&desc->iuspin);
-        rv = usb_submit_urb(desc->response, GFP_KERNEL);
+        rv = usb_submit_urb(desc->response, GFP_ATOMIC);
        spin_lock_irq(&desc->iuspin);
        if (rv) {
                dev_err(&desc->intf->dev,
diff --git a/drivers/usb/common/common.c b/drivers/usb/common/common.c
index 50a2362ed3ea..48277bbc15e4 100644
--- a/drivers/usb/common/common.c
+++ b/drivers/usb/common/common.c
@@ -246,6 +246,31 @@ int of_usb_update_otg_caps(struct device_node *np,
 }
 EXPORT_SYMBOL_GPL(of_usb_update_otg_caps);
+/**
+ * usb_of_get_companion_dev - Find the companion device
+ * @dev: the device pointer to find a companion
+ *
+ * Find the companion device from platform bus.
+ *
+ * Takes a reference to the returned struct device which needs to be dropped
+ * after use.
+ *
+ * Return: On success, a pointer to the companion device, %NULL on failure.
+ */
+struct device *usb_of_get_companion_dev(struct device *dev)
+{
+        struct device_node *node;
+        struct platform_device *pdev = NULL;
+        node = of_parse_phandle(dev->of_node, "companion", 0);
+        if (node)
+                pdev = of_find_device_by_node(node);
+        of_node_put(node);
+        return pdev ? &pdev->dev : NULL;
+}
+EXPORT_SYMBOL_GPL(usb_of_get_companion_dev);
 #endif
 MODULE_LICENSE("GPL");
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 66fe1b78d952..03432467b05f 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -515,8 +515,6 @@ static int resume_common(struct device *dev, int event)
                                event == PM_EVENT_RESTORE);
                if (retval) {
                        dev_err(dev, "PCI post-resume error %d!\n", retval);
-                        if (hcd->shared_hcd)
-                                usb_hc_died(hcd->shared_hcd);
                        usb_hc_died(hcd);
                }
        }
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 228672f2c4a1..bfa5eda0cc26 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1341,6 +1341,11 @@ void usb_enable_interface(struct usb_device *dev,
 * is submitted that needs that bandwidth.  Some other operating systems
 * allocate bandwidth early, when a configuration is chosen.
 *
+ * xHCI reserves bandwidth and configures the alternate setting in
+ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting
+ * may be disabled. Drivers cannot rely on any particular alternate
+ * setting being in effect after a failure.
+ *
 * This call is synchronous, and may not be used in an interrupt context.
 * Also, drivers must not change altsettings while urbs are scheduled for
 * endpoints in that interface; all such urbs must first be completed
@@ -1376,6 +1381,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate)
                         alternate);
                return -EINVAL;
        }
+        /*
+         * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth,
+         * including freeing dropped endpoint ring buffers.
+         * Make sure the interface endpoints are flushed before that
+         */
+        usb_disable_interface(dev, iface, false);
        /* Make sure we have enough bandwidth for this alternate interface.
         * Remove the current alt setting and add the new alt setting.
diff --git a/drivers/usb/core/of.c b/drivers/usb/core/of.c
index fd77442c2d12..651708d8c908 100644
--- a/drivers/usb/core/of.c
+++ b/drivers/usb/core/of.c
@@ -105,29 +105,3 @@ usb_of_get_interface_node(struct usb_device *udev, u8 config, u8 ifnum)
        return NULL;
 }
 EXPORT_SYMBOL_GPL(usb_of_get_interface_node);
-/**
- * usb_of_get_companion_dev - Find the companion device
- * @dev: the device pointer to find a companion
- *
- * Find the companion device from platform bus.
- *
- * Takes a reference to the returned struct device which needs to be dropped
- * after use.
- *
- * Return: On success, a pointer to the companion device, %NULL on failure.
- */
-struct device *usb_of_get_companion_dev(struct device *dev)
-{
-        struct device_node *node;
-        struct platform_device *pdev = NULL;
-        node = of_parse_phandle(dev->of_node, "companion", 0);
-        if (node)
-                pdev = of_find_device_by_node(node);
-        of_node_put(node);
-        return pdev ? &pdev->dev : NULL;
-}
-EXPORT_SYMBOL_GPL(usb_of_get_companion_dev);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 097057d2eacf..e77dfe5ed5ec 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -178,6 +178,10 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* CBM - Flash disk */
        { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */
+        { USB_DEVICE(0x0218, 0x0201), .driver_info =
+                        USB_QUIRK_CONFIG_INTF_STRINGS },
        /* WORLDE easy key (easykey.25) MIDI controller  */
        { USB_DEVICE(0x0218, 0x0401), .driver_info =
                        USB_QUIRK_CONFIG_INTF_STRINGS },
@@ -406,6 +410,9 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x2040, 0x7200), .driver_info =
                        USB_QUIRK_CONFIG_INTF_STRINGS },
+        /* DJI CineSSD */
+        { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
        /* INTEL VALUE SSD */
        { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index 9a53a58e676e..577642895b57 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -412,8 +412,6 @@ static int dwc2_driver_probe(struct platform_device *dev)
        dev_dbg(&dev->dev, "mapped PA %08lx to VA %p\n",
                (unsigned long)res->start, hsotg->regs);
-        hsotg->needs_byte_swap = dwc2_check_core_endianness(hsotg);
        retval = dwc2_lowlevel_hw_init(hsotg);
        if (retval)
                return retval;
@@ -438,6 +436,8 @@ static int dwc2_driver_probe(struct platform_device *dev)
        if (retval)
                return retval;
+        hsotg->needs_byte_swap = dwc2_check_core_endianness(hsotg);
        retval = dwc2_get_dr_mode(hsotg);
        if (retval)
                goto error;
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 40bf9e0bbc59..4c2771c5e727 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -180,8 +180,7 @@ static int dwc3_of_simple_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM
+static int __maybe_unused dwc3_of_simple_runtime_suspend(struct device *dev)
-static int dwc3_of_simple_runtime_suspend(struct device *dev)
 {
        struct dwc3_of_simple   *simple = dev_get_drvdata(dev);
        int                     i;
@@ -192,7 +191,7 @@ static int dwc3_of_simple_runtime_suspend(struct device *dev)
        return 0;
 }
-static int dwc3_of_simple_runtime_resume(struct device *dev)
+static int __maybe_unused dwc3_of_simple_runtime_resume(struct device *dev)
 {
        struct dwc3_of_simple   *simple = dev_get_drvdata(dev);
        int                     ret;
@@ -210,7 +209,7 @@ static int dwc3_of_simple_runtime_resume(struct device *dev)
        return 0;
 }
-static int dwc3_of_simple_suspend(struct device *dev)
+static int __maybe_unused dwc3_of_simple_suspend(struct device *dev)
 {
        struct dwc3_of_simple *simple = dev_get_drvdata(dev);
@@ -220,7 +219,7 @@ static int dwc3_of_simple_suspend(struct device *dev)
        return 0;
 }
-static int dwc3_of_simple_resume(struct device *dev)
+static int __maybe_unused dwc3_of_simple_resume(struct device *dev)
 {
        struct dwc3_of_simple *simple = dev_get_drvdata(dev);
@@ -229,7 +228,6 @@ static int dwc3_of_simple_resume(struct device *dev)
        return 0;
 }
-#endif
 static const struct dev_pm_ops dwc3_of_simple_dev_pm_ops = {
        SET_SYSTEM_SLEEP_PM_OPS(dwc3_of_simple_suspend, dwc3_of_simple_resume)
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 5edd79470368..1286076a8890 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -85,8 +85,8 @@ static int dwc3_byt_enable_ulpi_refclock(struct pci_dev *pci)
        u32             value;
        reg = pcim_iomap(pci, GP_RWBAR, 0);
-        if (IS_ERR(reg))
+        if (!reg)
-                return PTR_ERR(reg);
+                return -ENOMEM;
        value = readl(reg + GP_RWREG1);
        if (!(value & GP_RWREG1_ULPI_REFCLK_DISABLE))
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 032ea7d709ba..2b53194081ba 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -473,7 +473,6 @@ static int dwc3_gadget_set_xfer_resource(struct dwc3_ep *dep)
 /**
 * dwc3_gadget_start_config - configure ep resources
- * @dwc: pointer to our controller context structure
 * @dep: endpoint that is being enabled
 *
 * Issue a %DWC3_DEPCMD_DEPSTARTCFG command to @dep. After the command's
diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index 53a48f561458..587c5037ff07 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -1063,12 +1063,15 @@ static const struct usb_gadget_ops fotg210_gadget_ops = {
 static int fotg210_udc_remove(struct platform_device *pdev)
 {
        struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
+        int i;
        usb_del_gadget_udc(&fotg210->gadget);
        iounmap(fotg210->reg);
        free_irq(platform_get_irq(pdev, 0), fotg210);
        fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
+        for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+                kfree(fotg210->ep[i]);
        kfree(fotg210);
        return 0;
@@ -1099,7 +1102,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
        /* initialize udc */
        fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
        if (fotg210 == NULL)
-                goto err_alloc;
+                goto err;
        for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
                _ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
@@ -1111,7 +1114,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
        fotg210->reg = ioremap(res->start, resource_size(res));
        if (fotg210->reg == NULL) {
                pr_err("ioremap error.\n");
-                goto err_map;
+                goto err_alloc;
        }
        spin_lock_init(&fotg210->lock);
@@ -1159,7 +1162,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
        fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
                                GFP_KERNEL);
        if (fotg210->ep0_req == NULL)
-                goto err_req;
+                goto err_map;
        fotg210_init(fotg210);
@@ -1187,12 +1190,14 @@ err_req:
        fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
 err_map:
-        if (fotg210->reg)
+        iounmap(fotg210->reg);
-                iounmap(fotg210->reg);
 err_alloc:
+        for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+                kfree(fotg210->ep[i]);
        kfree(fotg210);
+err:
        return ret;
 }
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 318246d8b2e2..b02ab2a8d927 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -1545,11 +1545,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on)
                writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl);
        } else {
                writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl);
-                stop_activity(dev, dev->driver);
+                stop_activity(dev, NULL);
        }
        spin_unlock_irqrestore(&dev->lock, flags);
+        if (!is_on && dev->driver)
+                dev->driver->disconnect(&dev->gadget);
        return 0;
 }
@@ -2466,8 +2469,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver)
                nuke(&dev->ep[i]);
        /* report disconnect; the driver is already quiesced */
-        if (driver)
+        if (driver) {
+                spin_unlock(&dev->lock);
                driver->disconnect(&dev->gadget);
+                spin_lock(&dev->lock);
+        }
        usb_reinit(dev);
 }
@@ -3341,6 +3347,8 @@ next_endpoints:
                BIT(PCI_RETRY_ABORT_INTERRUPT))
 static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
+__releases(dev->lock)
+__acquires(dev->lock)
 {
        struct net2280_ep       *ep;
        u32                     tmp, num, mask, scratch;
@@ -3381,12 +3389,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
                        if (disconnect || reset) {
                                stop_activity(dev, dev->driver);
                                ep0_start(dev);
+                                spin_unlock(&dev->lock);
                                if (reset)
                                        usb_gadget_udc_reset
                                                (&dev->gadget, dev->driver);
                                else
                                        (dev->driver->disconnect)
                                                (&dev->gadget);
+                                spin_lock(&dev->lock);
                                return;
                        }
                }
@@ -3405,6 +3415,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
        tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT);
        if (stat & tmp) {
                writel(tmp, &dev->regs->irqstat1);
+                spin_unlock(&dev->lock);
                if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) {
                        if (dev->driver->suspend)
                                dev->driver->suspend(&dev->gadget);
@@ -3415,6 +3426,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
                                dev->driver->resume(&dev->gadget);
                        /* at high speed, note erratum 0133 */
                }
+                spin_lock(&dev->lock);
                stat &= ~tmp;
        }
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 1f879b3f2c96..e1656f361e08 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -812,12 +812,15 @@ static void usb3_irq_epc_int_1_speed(struct renesas_usb3 *usb3)
        switch (speed) {
        case USB_STA_SPEED_SS:
                usb3->gadget.speed = USB_SPEED_SUPER;
+                usb3->gadget.ep0->maxpacket = USB3_EP0_SS_MAX_PACKET_SIZE;
                break;
        case USB_STA_SPEED_HS:
                usb3->gadget.speed = USB_SPEED_HIGH;
+                usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE;
                break;
        case USB_STA_SPEED_FS:
                usb3->gadget.speed = USB_SPEED_FULL;
+                usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE;
                break;
        default:
                usb3->gadget.speed = USB_SPEED_UNKNOWN;
@@ -2513,7 +2516,7 @@ static int renesas_usb3_init_ep(struct renesas_usb3 *usb3, struct device *dev,
                        /* for control pipe */
                        usb3->gadget.ep0 = &usb3_ep->ep;
                        usb_ep_set_maxpacket_limit(&usb3_ep->ep,
-                                                USB3_EP0_HSFS_MAX_PACKET_SIZE);
+                                                USB3_EP0_SS_MAX_PACKET_SIZE);
                        usb3_ep->ep.caps.type_control = true;
                        usb3_ep->ep.caps.dir_in = true;
                        usb3_ep->ep.caps.dir_out = true;
diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c
index 072bd5d5738e..5b8a3d9530c4 100644
--- a/drivers/usb/host/u132-hcd.c
+++ b/drivers/usb/host/u132-hcd.c
@@ -2555,7 +2555,7 @@ static int u132_get_frame(struct usb_hcd *hcd)
        } else {
                int frame = 0;
                dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n");
-                msleep(100);
+                mdelay(100);
                return frame;
        }
 }
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index ef350c33dc4a..b1f27aa38b10 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1613,6 +1613,10 @@ void xhci_endpoint_copy(struct xhci_hcd *xhci,
        in_ep_ctx->ep_info2 = out_ep_ctx->ep_info2;
        in_ep_ctx->deq = out_ep_ctx->deq;
        in_ep_ctx->tx_info = out_ep_ctx->tx_info;
+        if (xhci->quirks & XHCI_MTK_HOST) {
+                in_ep_ctx->reserved[0] = out_ep_ctx->reserved[0];
+                in_ep_ctx->reserved[1] = out_ep_ctx->reserved[1];
+        }
 }
 /* Copy output xhci_slot_ctx to the input xhci_slot_ctx.
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 8dc77e34a859..94e939249b2b 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -153,7 +153,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
 {
        const struct xhci_plat_priv *priv_match;
        const struct hc_driver  *driver;
-        struct device           *sysdev;
+        struct device           *sysdev, *tmpdev;
        struct xhci_hcd         *xhci;
        struct resource         *res;
        struct usb_hcd          *hcd;
@@ -273,19 +273,24 @@ static int xhci_plat_probe(struct platform_device *pdev)
                goto disable_clk;
        }
-        if (device_property_read_bool(sysdev, "usb2-lpm-disable"))
+        /* imod_interval is the interrupt moderation value in nanoseconds. */
-                xhci->quirks |= XHCI_HW_LPM_DISABLE;
+        xhci->imod_interval = 40000;
-        if (device_property_read_bool(sysdev, "usb3-lpm-capable"))
+        /* Iterate over all parent nodes for finding quirks */
-                xhci->quirks |= XHCI_LPM_SUPPORT;
+        for (tmpdev = &pdev->dev; tmpdev; tmpdev = tmpdev->parent) {
-        if (device_property_read_bool(&pdev->dev, "quirk-broken-port-ped"))
+                if (device_property_read_bool(tmpdev, "usb2-lpm-disable"))
-                xhci->quirks |= XHCI_BROKEN_PORT_PED;
+                        xhci->quirks |= XHCI_HW_LPM_DISABLE;
-        /* imod_interval is the interrupt moderation value in nanoseconds. */
+                if (device_property_read_bool(tmpdev, "usb3-lpm-capable"))
-        xhci->imod_interval = 40000;
+                        xhci->quirks |= XHCI_LPM_SUPPORT;
-        device_property_read_u32(sysdev, "imod-interval-ns",
-                                 &xhci->imod_interval);
+                if (device_property_read_bool(tmpdev, "quirk-broken-port-ped"))
+                        xhci->quirks |= XHCI_BROKEN_PORT_PED;
+                device_property_read_u32(tmpdev, "imod-interval-ns",
+                                         &xhci->imod_interval);
+        }
        hcd->usb_phy = devm_usb_get_phy_by_phandle(sysdev, "usb-phy", 0);
        if (IS_ERR(hcd->usb_phy)) {
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 61f48b17e57b..0420eefa647a 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -37,6 +37,21 @@ static unsigned long long quirks;
 module_param(quirks, ullong, S_IRUGO);
 MODULE_PARM_DESC(quirks, "Bit flags for quirks to be enabled as default");
+static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring)
+{
+        struct xhci_segment *seg = ring->first_seg;
+        if (!td || !td->start_seg)
+                return false;
+        do {
+                if (seg == td->start_seg)
+                        return true;
+                seg = seg->next;
+        } while (seg && seg != ring->first_seg);
+        return false;
+}
 /* TODO: copied from ehci-hcd.c - can this be refactored? */
 /*
 * xhci_handshake - spin reading hc until handshake completes or fails
@@ -1571,6 +1586,21 @@ static int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                goto done;
        }
+        /*
+         * check ring is not re-allocated since URB was enqueued. If it is, then
+         * make sure none of the ring related pointers in this URB private data
+         * are touched, such as td_list, otherwise we overwrite freed data
+         */
+        if (!td_on_ring(&urb_priv->td[0], ep_ring)) {
+                xhci_err(xhci, "Canceled URB td not found on endpoint ring");
+                for (i = urb_priv->num_tds_done; i < urb_priv->num_tds; i++) {
+                        td = &urb_priv->td[i];
+                        if (!list_empty(&td->cancelled_td_list))
+                                list_del_init(&td->cancelled_td_list);
+                }
+                goto err_giveback;
+        }
        if (xhci->xhc_state & XHCI_STATE_HALTED) {
                xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                "HC halted, freeing TD manually.");
diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index 82f220631bd7..b5d661644263 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -369,7 +369,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch
        mask &= 0x0f;
        val &= 0x0f;
        d = (priv->reg[1] & (~mask)) ^ val;
-        if (set_1284_register(pp, 2, d, GFP_KERNEL))
+        if (set_1284_register(pp, 2, d, GFP_ATOMIC))
                return 0;
        priv->reg[1] = d;
        return d & 0xf;
@@ -379,7 +379,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp)
 {
        unsigned char ret;
-        if (get_1284_register(pp, 1, &ret, GFP_KERNEL))
+        if (get_1284_register(pp, 1, &ret, GFP_ATOMIC))
                return 0;
        return ret & 0xf8;
 }
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 3be40eaa1ac9..6d9fd5f64903 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -413,6 +413,9 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
        spin_unlock_irqrestore(&dev->lock, flags);
        mutex_unlock(&dev->io_mutex);
+        if (WARN_ON_ONCE(len >= sizeof(in_buffer)))
+                return -EIO;
        return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
 }
@@ -421,13 +424,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
 {
        struct usb_yurex *dev;
        int i, set = 0, retval = 0;
-        char buffer[16];
+        char buffer[16 + 1];
        char *data = buffer;
        unsigned long long c, c2 = 0;
        signed long timeout = 0;
        DEFINE_WAIT(wait);
-        count = min(sizeof(buffer), count);
+        count = min(sizeof(buffer) - 1, count);
        dev = file->private_data;
        /* verify that we actually have some data to write */
@@ -446,6 +449,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
                retval = -EFAULT;
                goto error;
        }
+        buffer[count] = 0;
        memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE);
        switch (buffer[0]) {
diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
index eecfd0671362..d045d8458f81 100644
--- a/drivers/usb/mtu3/mtu3_core.c
+++ b/drivers/usb/mtu3/mtu3_core.c
@@ -107,8 +107,12 @@ static int mtu3_device_enable(struct mtu3 *mtu)
                (SSUSB_U2_PORT_DIS | SSUSB_U2_PORT_PDN |
                SSUSB_U2_PORT_HOST_SEL));
-        if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG)
+        if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) {
                mtu3_setbits(ibase, SSUSB_U2_CTRL(0), SSUSB_U2_PORT_OTG_SEL);
+                if (mtu->is_u3_ip)
+                        mtu3_setbits(ibase, SSUSB_U3_CTRL(0),
+                                     SSUSB_U3_PORT_DUAL_MODE);
+        }
        return ssusb_check_clocks(mtu->ssusb, check_clk);
 }
diff --git a/drivers/usb/mtu3/mtu3_hw_regs.h b/drivers/usb/mtu3/mtu3_hw_regs.h
index 6ee371478d89..a45bb253939f 100644
--- a/drivers/usb/mtu3/mtu3_hw_regs.h
+++ b/drivers/usb/mtu3/mtu3_hw_regs.h
@@ -459,6 +459,7 @@
 /* U3D_SSUSB_U3_CTRL_0P */
 #define SSUSB_U3_PORT_SSP_SPEED BIT(9)
+#define SSUSB_U3_PORT_DUAL_MODE BIT(7)
 #define SSUSB_U3_PORT_HOST_SEL          BIT(2)
 #define SSUSB_U3_PORT_PDN               BIT(1)
 #define SSUSB_U3_PORT_DIS               BIT(0)
diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h
index e53c68261017..9bbcee37524e 100644
--- a/drivers/usb/serial/io_ti.h
+++ b/drivers/usb/serial/io_ti.h
@@ -173,7 +173,7 @@ struct ump_interrupt {
 }  __attribute__((packed));
-#define TIUMP_GET_PORT_FROM_CODE(c)     (((c) >> 4) - 3)
+#define TIUMP_GET_PORT_FROM_CODE(c)     (((c) >> 6) & 0x01)
 #define TIUMP_GET_FUNC_FROM_CODE(c)     ((c) & 0x0f)
 #define TIUMP_INTERRUPT_CODE_LSR        0x03
 #define TIUMP_INTERRUPT_CODE_MSR        0x04
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 3010878f7f8e..e3c5832337e0 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1119,7 +1119,7 @@ static void ti_break(struct tty_struct *tty, int break_state)
 static int ti_get_port_from_code(unsigned char code)
 {
-        return (code >> 4) - 3;
+        return (code >> 6) & 0x01;
 }
 static int ti_get_func_from_code(unsigned char code)
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index c267f2812a04..e227bb5b794f 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -376,6 +376,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb,
                return 0;
        }
+        if ((us->fflags & US_FL_NO_ATA_1X) &&
+                        (srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) {
+                memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB,
+                       sizeof(usb_stor_sense_invalidCDB));
+                srb->result = SAM_STAT_CHECK_CONDITION;
+                done(srb);
+                return 0;
+        }
        /* enqueue the command and wake up the control thread */
        srb->scsi_done = done;
        us->srb = srb;
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 9e9de5452860..1f7b401c4d04 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -842,6 +842,27 @@ static int uas_slave_configure(struct scsi_device *sdev)
                sdev->skip_ms_page_8 = 1;
                sdev->wce_default_on = 1;
        }
+        /*
+         * Some disks return the total number of blocks in response
+         * to READ CAPACITY rather than the highest block number.
+         * If this device makes that mistake, tell the sd driver.
+         */
+        if (devinfo->flags & US_FL_FIX_CAPACITY)
+                sdev->fix_capacity = 1;
+        /*
+         * Some devices don't like MODE SENSE with page=0x3f,
+         * which is the command used for checking if a device
+         * is write-protected.  Now that we tell the sd driver
+         * to do a 192-byte transfer with this command the
+         * majority of devices work fine, but a few still can't
+         * handle it.  The sd driver will simply assume those
+         * devices are write-enabled.
+         */
+        if (devinfo->flags & US_FL_NO_WP_DETECT)
+                sdev->skip_ms_page_3f = 1;
        scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
        return 0;
 }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 22fcfccf453a..f7f83b21dc74 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2288,6 +2288,13 @@ UNUSUAL_DEV(  0x2735, 0x100b, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_GO_SLOW ),
+/* Reported-by: Tim Anderson <tsa@biglakesoftware.com> */
+UNUSUAL_DEV(  0x2ca3, 0x0031, 0x0000, 0x9999,
+                "DJI",
+                "CineSSD",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
 /*
 * Reported by Frederic Marchal <frederic.marchal@wowcompany.com>
 * Mio Moov 330
diff --git a/drivers/usb/typec/bus.c b/drivers/usb/typec/bus.c
index 95a2b10127db..76299b6ff06d 100644
--- a/drivers/usb/typec/bus.c
+++ b/drivers/usb/typec/bus.c
@@ -255,12 +255,13 @@ EXPORT_SYMBOL_GPL(typec_altmode_unregister_driver);
 /* API for the port drivers */
 /**
- * typec_match_altmode - Match SVID to an array of alternate modes
+ * typec_match_altmode - Match SVID and mode to an array of alternate modes
 * @altmodes: Array of alternate modes
- * @n: Number of elements in the array, or -1 for NULL termiated arrays
+ * @n: Number of elements in the array, or -1 for NULL terminated arrays
 * @svid: Standard or Vendor ID to match with
+ * @mode: Mode to match with
 *
- * Return pointer to an alternate mode with SVID mathing @svid, or NULL when no
+ * Return pointer to an alternate mode with SVID matching @svid, or NULL when no
 * match is found.
 */
 struct typec_altmode *typec_match_altmode(struct typec_altmode **altmodes,
diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index c202975f8097..e61dffb27a0c 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -1484,7 +1484,6 @@ EXPORT_SYMBOL_GPL(typec_set_mode);
 * typec_port_register_altmode - Register USB Type-C Port Alternate Mode
 * @port: USB Type-C Port that supports the alternate mode
 * @desc: Description of the alternate mode
- * @drvdata: Private pointer to driver specific info
 *
 * This routine is used to register an alternate mode that @port is capable of
 * supporting.
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index b459edfacff3..90d387b50ab7 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -79,15 +79,19 @@ config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
          This value is used to allocate enough space in internal
          tables needed for physical memory administration.
-config XEN_SCRUB_PAGES
+config XEN_SCRUB_PAGES_DEFAULT
-        bool "Scrub pages before returning them to system"
+        bool "Scrub pages before returning them to system by default"
        depends on XEN_BALLOON
        default y
        help
          Scrub pages before returning them to the system for reuse by
          other domains.  This makes sure that any confidential data
          is not accidentally visible to other domains.  Is it more
-          secure, but slightly less efficient.
+          secure, but slightly less efficient. This can be controlled with
+          xen_scrub_pages=0 parameter and
+          /sys/devices/system/xen_memory/xen_memory0/scrub_pages.
+          This option only sets the default value.
          If in doubt, say yes.
 config XEN_DEV_EVTCHN
diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
index d4265c8ebb22..b1357aa4bc55 100644
--- a/drivers/xen/cpu_hotplug.c
+++ b/drivers/xen/cpu_hotplug.c
@@ -19,15 +19,16 @@ static void enable_hotplug_cpu(int cpu)
 static void disable_hotplug_cpu(int cpu)
 {
-        if (cpu_online(cpu)) {
+        if (!cpu_is_hotpluggable(cpu))
-                lock_device_hotplug();
+                return;
+        lock_device_hotplug();
+        if (cpu_online(cpu))
                device_offline(get_cpu_device(cpu));
-                unlock_device_hotplug();
+        if (!cpu_online(cpu) && cpu_present(cpu)) {
-        }
-        if (cpu_present(cpu))
                xen_arch_unregister_cpu(cpu);
+                set_cpu_present(cpu, false);
-        set_cpu_present(cpu, false);
+        }
+        unlock_device_hotplug();
 }
 static int vcpu_online(unsigned int cpu)
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 08e4af04d6f2..e6c1934734b7 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -138,7 +138,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
                clear_evtchn_to_irq_row(row);
        }
-        evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)] = irq;
+        evtchn_to_irq[row][col] = irq;
        return 0;
 }
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 57390c7666e5..b0b02a501167 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -492,12 +492,19 @@ static bool in_range(struct gntdev_grant_map *map,
        return true;
 }
-static void unmap_if_in_range(struct gntdev_grant_map *map,
+static int unmap_if_in_range(struct gntdev_grant_map *map,
-                              unsigned long start, unsigned long end)
+                              unsigned long start, unsigned long end,
+                              bool blockable)
 {
        unsigned long mstart, mend;
        int err;
+        if (!in_range(map, start, end))
+                return 0;
+        if (!blockable)
+                return -EAGAIN;
        mstart = max(start, map->vma->vm_start);
        mend   = min(end,   map->vma->vm_end);
        pr_debug("map %d+%d (%lx %lx), range %lx %lx, mrange %lx %lx\n",
@@ -508,6 +515,8 @@ static void unmap_if_in_range(struct gntdev_grant_map *map,
                                (mstart - map->vma->vm_start) >> PAGE_SHIFT,
                                (mend - mstart) >> PAGE_SHIFT);
        WARN_ON(err);
+        return 0;
 }
 static int mn_invl_range_start(struct mmu_notifier *mn,
@@ -519,25 +528,20 @@ static int mn_invl_range_start(struct mmu_notifier *mn,
        struct gntdev_grant_map *map;
        int ret = 0;
-        /* TODO do we really need a mutex here? */
        if (blockable)
                mutex_lock(&priv->lock);
        else if (!mutex_trylock(&priv->lock))
                return -EAGAIN;
        list_for_each_entry(map, &priv->maps, next) {
-                if (in_range(map, start, end)) {
+                ret = unmap_if_in_range(map, start, end, blockable);
-                        ret = -EAGAIN;
+                if (ret)
                        goto out_unlock;
-                }
-                unmap_if_in_range(map, start, end);
        }
        list_for_each_entry(map, &priv->freeable_maps, next) {
-                if (in_range(map, start, end)) {
+                ret = unmap_if_in_range(map, start, end, blockable);
-                        ret = -EAGAIN;
+                if (ret)
                        goto out_unlock;
-                }
-                unmap_if_in_range(map, start, end);
        }
 out_unlock:
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 7bafa703a992..84575baceebc 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1040,18 +1040,33 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
                return ret;
        for (i = 0; i < count; i++) {
-                /* Retry eagain maps */
+                switch (map_ops[i].status) {
-                if (map_ops[i].status == GNTST_eagain)
+                case GNTST_okay:
-                        gnttab_retry_eagain_gop(GNTTABOP_map_grant_ref, map_ops + i,
+                {
-                                                &map_ops[i].status, __func__);
-                if (map_ops[i].status == GNTST_okay) {
                        struct xen_page_foreign *foreign;
                        SetPageForeign(pages[i]);
                        foreign = xen_page_foreign(pages[i]);
                        foreign->domid = map_ops[i].dom;
                        foreign->gref = map_ops[i].ref;
+                        break;
+                }
+                case GNTST_no_device_space:
+                        pr_warn_ratelimited("maptrack limit reached, can't map all guest pages\n");
+                        break;
+                case GNTST_eagain:
+                        /* Retry eagain maps */
+                        gnttab_retry_eagain_gop(GNTTABOP_map_grant_ref,
+                                                map_ops + i,
+                                                &map_ops[i].status, __func__);
+                        /* Test status in next loop iteration. */
+                        i--;
+                        break;
+                default:
+                        break;
                }
        }
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index c93d8ef8df34..5bb01a62f214 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -280,9 +280,11 @@ static void sysrq_handler(struct xenbus_watch *watch, const char *path,
                /*
                 * The Xenstore watch fires directly after registering it and
                 * after a suspend/resume cycle. So ENOENT is no error but
-                 * might happen in those cases.
+                 * might happen in those cases. ERANGE is observed when we get
+                 * an empty value (''), this happens when we acknowledge the
+                 * request by writing '\0' below.
                 */
-                if (err != -ENOENT)
+                if (err != -ENOENT && err != -ERANGE)
                        pr_err("Error %d reading sysrq code in control/sysrq\n",
                               err);
                xenbus_transaction_end(xbt, 1);
diff --git a/drivers/xen/mem-reservation.c b/drivers/xen/mem-reservation.c
index 084799c6180e..3782cf070338 100644
--- a/drivers/xen/mem-reservation.c
+++ b/drivers/xen/mem-reservation.c
@@ -14,6 +14,10 @@
 #include <xen/interface/memory.h>
 #include <xen/mem-reservation.h>
+#include <linux/moduleparam.h>
+bool __read_mostly xen_scrub_pages = IS_ENABLED(CONFIG_XEN_SCRUB_PAGES_DEFAULT);
+core_param(xen_scrub_pages, xen_scrub_pages, bool, 0);
 /*
 * Use one extent per PAGE_SIZE to avoid to break down the page into
diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
index 294f35ce9e46..63c1494a8d73 100644
--- a/drivers/xen/xen-balloon.c
+++ b/drivers/xen/xen-balloon.c
@@ -44,6 +44,7 @@
 #include <xen/xenbus.h>
 #include <xen/features.h>
 #include <xen/page.h>
+#include <xen/mem-reservation.h>
 #define PAGES2KB(_p) ((_p)<<(PAGE_SHIFT-10))
@@ -137,6 +138,7 @@ static DEVICE_ULONG_ATTR(schedule_delay, 0444, balloon_stats.schedule_delay);
 static DEVICE_ULONG_ATTR(max_schedule_delay, 0644, balloon_stats.max_schedule_delay);
 static DEVICE_ULONG_ATTR(retry_count, 0444, balloon_stats.retry_count);
 static DEVICE_ULONG_ATTR(max_retry_count, 0644, balloon_stats.max_retry_count);
+static DEVICE_BOOL_ATTR(scrub_pages, 0644, xen_scrub_pages);
 static ssize_t show_target_kb(struct device *dev, struct device_attribute *attr,
                              char *buf)
@@ -203,6 +205,7 @@ static struct attribute *balloon_attrs[] = {
        &dev_attr_max_schedule_delay.attr.attr,
        &dev_attr_retry_count.attr.attr,
        &dev_attr_max_retry_count.attr.attr,
+        &dev_attr_scrub_pages.attr.attr,
        NULL
 };