69 files changed, 406 insertions, 208 deletions
diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
index 5e9d7348c16f..62d3aa74277b 100644
--- a/drivers/acpi/acpica/evgpe.c
+++ b/drivers/acpi/acpica/evgpe.c
@@ -81,12 +81,8 @@ acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
        ACPI_FUNCTION_TRACE(ev_enable_gpe);
-        /* Clear the GPE status */
-        status = acpi_hw_clear_gpe(gpe_event_info);
-        if (ACPI_FAILURE(status))
-                return_ACPI_STATUS(status);
        /* Enable the requested GPE */
        status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_ENABLE);
        return_ACPI_STATUS(status);
 }
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 399cad7daae7..d58a359a6622 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -774,18 +774,18 @@ struct zram_work {
        struct zram *zram;
        unsigned long entry;
        struct bio *bio;
+        struct bio_vec bvec;
 };
 #if PAGE_SIZE != 4096
 static void zram_sync_read(struct work_struct *work)
 {
-        struct bio_vec bvec;
        struct zram_work *zw = container_of(work, struct zram_work, work);
        struct zram *zram = zw->zram;
        unsigned long entry = zw->entry;
        struct bio *bio = zw->bio;
-        read_from_bdev_async(zram, &bvec, entry, bio);
+        read_from_bdev_async(zram, &zw->bvec, entry, bio);
 }
 /*
@@ -798,6 +798,7 @@ static int read_from_bdev_sync(struct zram *zram, struct bio_vec *bvec,
 {
        struct zram_work work;
+        work.bvec = *bvec;
        work.zram = zram;
        work.entry = entry;
        work.bio = bio;
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index ec8a291d62ba..54093ffd0aef 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -671,7 +671,7 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_slave_sg(
        d = bcm2835_dma_create_cb_chain(chan, direction, false,
                                        info, extra,
                                        frames, src, dst, 0, 0,
-                                        GFP_KERNEL);
+                                        GFP_NOWAIT);
        if (!d)
                return NULL;
diff --git a/drivers/dma/mediatek/mtk-cqdma.c b/drivers/dma/mediatek/mtk-cqdma.c
index 131f3974740d..814853842e29 100644
--- a/drivers/dma/mediatek/mtk-cqdma.c
+++ b/drivers/dma/mediatek/mtk-cqdma.c
@@ -253,7 +253,7 @@ static void mtk_cqdma_start(struct mtk_cqdma_pchan *pc,
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
        mtk_dma_set(pc, MTK_CQDMA_DST2, cvd->dest >> MTK_CQDMA_ADDR2_SHFIT);
 #else
-        mtk_dma_set(pc, MTK_CQDMA_SRC2, 0);
+        mtk_dma_set(pc, MTK_CQDMA_DST2, 0);
 #endif
        /* setup the length */
diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index 2b4f25698169..e2a5398f89b5 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -1282,6 +1282,9 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
        enum dma_status status;
        unsigned int residue = 0;
        unsigned int dptr = 0;
+        unsigned int chcrb;
+        unsigned int tcrb;
+        unsigned int i;
        if (!desc)
                return 0;
@@ -1330,14 +1333,31 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
        }
        /*
+         * We need to read two registers.
+         * Make sure the control register does not skip to next chunk
+         * while reading the counter.
+         * Trying it 3 times should be enough: Initial read, retry, retry
+         * for the paranoid.
+         */
+        for (i = 0; i < 3; i++) {
+                chcrb = rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
+                                            RCAR_DMACHCRB_DPTR_MASK;
+                tcrb = rcar_dmac_chan_read(chan, RCAR_DMATCRB);
+                /* Still the same? */
+                if (chcrb == (rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
+                              RCAR_DMACHCRB_DPTR_MASK))
+                        break;
+        }
+        WARN_ONCE(i >= 3, "residue might be not continuous!");
+        /*
         * In descriptor mode the descriptor running pointer is not maintained
         * by the interrupt handler, find the running descriptor from the
         * descriptor pointer field in the CHCRB register. In non-descriptor
         * mode just use the running descriptor pointer.
         */
        if (desc->hwdescs.use) {
-                dptr = (rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
+                dptr = chcrb >> RCAR_DMACHCRB_DPTR_SHIFT;
-                        RCAR_DMACHCRB_DPTR_MASK) >> RCAR_DMACHCRB_DPTR_SHIFT;
                if (dptr == 0)
                        dptr = desc->nchunks;
                dptr--;
@@ -1355,7 +1375,7 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
        }
        /* Add the residue for the current chunk. */
-        residue += rcar_dmac_chan_read(chan, RCAR_DMATCRB) << desc->xfer_shift;
+        residue += tcrb << desc->xfer_shift;
        return residue;
 }
@@ -1368,6 +1388,7 @@ static enum dma_status rcar_dmac_tx_status(struct dma_chan *chan,
        enum dma_status status;
        unsigned long flags;
        unsigned int residue;
+        bool cyclic;
        status = dma_cookie_status(chan, cookie, txstate);
        if (status == DMA_COMPLETE || !txstate)
@@ -1375,10 +1396,11 @@ static enum dma_status rcar_dmac_tx_status(struct dma_chan *chan,
        spin_lock_irqsave(&rchan->lock, flags);
        residue = rcar_dmac_chan_get_residue(rchan, cookie);
+        cyclic = rchan->desc.running ? rchan->desc.running->cyclic : false;
        spin_unlock_irqrestore(&rchan->lock, flags);
        /* if there's no residue, the cookie is complete */
-        if (!residue)
+        if (!residue && !cyclic)
                return DMA_COMPLETE;
        dma_set_residue(txstate, residue);
diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index f0223cee9774..77092268ee95 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -414,6 +414,7 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
                        irq_set_handler_locked(data, handle_edge_irq);
                        break;
                case IRQ_TYPE_EDGE_BOTH:
+                        sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0);
                        sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 1);
                        irq_set_handler_locked(data, handle_edge_irq);
                        break;
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 0495bf1d480a..bca3e7740ef6 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1379,7 +1379,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
        status = gpiochip_add_irqchip(chip, lock_key, request_key);
        if (status)
-                goto err_remove_chip;
+                goto err_free_gpiochip_mask;
        status = of_gpiochip_add(chip);
        if (status)
@@ -1387,7 +1387,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
        status = gpiochip_init_valid_mask(chip);
        if (status)
-                goto err_remove_chip;
+                goto err_remove_of_chip;
        for (i = 0; i < chip->ngpio; i++) {
                struct gpio_desc *desc = &gdev->descs[i];
@@ -1415,14 +1415,18 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
        if (gpiolib_initialized) {
                status = gpiochip_setup_dev(gdev);
                if (status)
-                        goto err_remove_chip;
+                        goto err_remove_acpi_chip;
        }
        return 0;
-err_remove_chip:
+err_remove_acpi_chip:
        acpi_gpiochip_remove(chip);
+err_remove_of_chip:
        gpiochip_free_hogs(chip);
        of_gpiochip_remove(chip);
+err_remove_chip:
+        gpiochip_irqchip_remove(chip);
+err_free_gpiochip_mask:
        gpiochip_free_valid_mask(chip);
 err_remove_irqchip_mask:
        gpiochip_irqchip_free_valid_mask(chip);
diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
index db761329a1e3..ab7968c8f6a2 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
@@ -1046,6 +1046,10 @@ static bool dw_hdmi_support_scdc(struct dw_hdmi *hdmi)
        if (hdmi->version < 0x200a)
                return false;
+        /* Disable if no DDC bus */
+        if (!hdmi->ddc)
+                return false;
        /* Disable if SCDC is not supported, or if an HF-VSDB block is absent */
        if (!display->hdmi.scdc.supported ||
            !display->hdmi.scdc.scrambling.supported)
@@ -1684,13 +1688,13 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi,
                         * Source Devices compliant shall set the
                         * Source Version = 1.
                         */
-                        drm_scdc_readb(&hdmi->i2c->adap, SCDC_SINK_VERSION,
+                        drm_scdc_readb(hdmi->ddc, SCDC_SINK_VERSION,
                                       &bytes);
-                        drm_scdc_writeb(&hdmi->i2c->adap, SCDC_SOURCE_VERSION,
+                        drm_scdc_writeb(hdmi->ddc, SCDC_SOURCE_VERSION,
                                min_t(u8, bytes, SCDC_MIN_SOURCE_VERSION));
                        /* Enabled Scrambling in the Sink */
-                        drm_scdc_set_scrambling(&hdmi->i2c->adap, 1);
+                        drm_scdc_set_scrambling(hdmi->ddc, 1);
                        /*
                         * To activate the scrambler feature, you must ensure
@@ -1706,7 +1710,7 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi,
                        hdmi_writeb(hdmi, 0, HDMI_FC_SCRAMBLER_CTRL);
                        hdmi_writeb(hdmi, (u8)~HDMI_MC_SWRSTZ_TMDSSWRST_REQ,
                                    HDMI_MC_SWRSTZ);
-                        drm_scdc_set_scrambling(&hdmi->i2c->adap, 0);
+                        drm_scdc_set_scrambling(hdmi->ddc, 0);
                }
        }
@@ -1800,6 +1804,8 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
         * iteration for others.
         * The Amlogic Meson GX SoCs (v2.01a) have been identified as needing
         * the workaround with a single iteration.
+         * The Rockchip RK3288 SoC (v2.00a) and RK3328/RK3399 SoCs (v2.11a) have
+         * been identified as needing the workaround with a single iteration.
         */
        switch (hdmi->version) {
@@ -1808,7 +1814,9 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
                break;
        case 0x131a:
        case 0x132a:
+        case 0x200a:
        case 0x201a:
+        case 0x211a:
        case 0x212a:
                count = 1;
                break;
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index ab4e60dfd6a3..98cea1f4b3bf 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -3862,14 +3862,16 @@ static int intel_ddi_compute_config(struct intel_encoder *encoder,
                ret = intel_hdmi_compute_config(encoder, pipe_config, conn_state);
        else
                ret = intel_dp_compute_config(encoder, pipe_config, conn_state);
+        if (ret)
+                return ret;
-        if (IS_GEN9_LP(dev_priv) && ret)
+        if (IS_GEN9_LP(dev_priv))
                pipe_config->lane_lat_optim_mask =
                        bxt_ddi_phy_calc_lane_lat_optim_mask(pipe_config->lane_count);
        intel_ddi_compute_min_voltage_level(dev_priv, pipe_config);
-        return ret;
+        return 0;
 }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 8891f29a8c7f..48da4a969a0a 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1886,6 +1886,9 @@ static int intel_dp_dsc_compute_config(struct intel_dp *intel_dp,
        int pipe_bpp;
        int ret;
+        pipe_config->fec_enable = !intel_dp_is_edp(intel_dp) &&
+                intel_dp_supports_fec(intel_dp, pipe_config);
        if (!intel_dp_supports_dsc(intel_dp, pipe_config))
                return -EINVAL;
@@ -2116,9 +2119,6 @@ intel_dp_compute_config(struct intel_encoder *encoder,
        if (adjusted_mode->flags & DRM_MODE_FLAG_DBLCLK)
                return -EINVAL;
-        pipe_config->fec_enable = !intel_dp_is_edp(intel_dp) &&
-                                  intel_dp_supports_fec(intel_dp, pipe_config);
        ret = intel_dp_compute_link_config(encoder, pipe_config, conn_state);
        if (ret < 0)
                return ret;
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index ec3602ebbc1c..54011df8c2e8 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -71,7 +71,7 @@ static void ipu_crtc_disable_planes(struct ipu_crtc *ipu_crtc,
        if (disable_partial)
                ipu_plane_disable(ipu_crtc->plane[1], true);
        if (disable_full)
-                ipu_plane_disable(ipu_crtc->plane[0], false);
+                ipu_plane_disable(ipu_crtc->plane[0], true);
 }
 static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index 19fc601c9eeb..a1bec2779e76 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -366,10 +366,9 @@ void drm_sched_increase_karma(struct drm_sched_job *bad)
 EXPORT_SYMBOL(drm_sched_increase_karma);
 /**
- * drm_sched_hw_job_reset - stop the scheduler if it contains the bad job
+ * drm_sched_stop - stop the scheduler
 *
 * @sched: scheduler instance
- * @bad: bad scheduler job
 *
 */
 void drm_sched_stop(struct drm_gpu_scheduler *sched)
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index 3ebd9f5e2719..29258b404e54 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -16,6 +16,7 @@
 #include <linux/of_reserved_mem.h>
 #include <drm/drmP.h>
+#include <drm/drm_atomic_helper.h>
 #include <drm/drm_fb_cma_helper.h>
 #include <drm/drm_fb_helper.h>
 #include <drm/drm_gem_cma_helper.h>
@@ -85,6 +86,8 @@ static int sun4i_drv_bind(struct device *dev)
                ret = -ENOMEM;
                goto free_drm;
        }
+        dev_set_drvdata(dev, drm);
        drm->dev_private = drv;
        INIT_LIST_HEAD(&drv->frontend_list);
        INIT_LIST_HEAD(&drv->engine_list);
@@ -144,8 +147,12 @@ static void sun4i_drv_unbind(struct device *dev)
        drm_dev_unregister(drm);
        drm_kms_helper_poll_fini(drm);
+        drm_atomic_helper_shutdown(drm);
        drm_mode_config_cleanup(drm);
+        component_unbind_all(dev, NULL);
        of_reserved_mem_device_release(dev);
        drm_dev_put(drm);
 }
@@ -395,6 +402,8 @@ static int sun4i_drv_probe(struct platform_device *pdev)
 static int sun4i_drv_remove(struct platform_device *pdev)
 {
+        component_master_del(&pdev->dev, &sun4i_drv_master_ops);
        return 0;
 }
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 0fa5034b9f9e..1a01669b159a 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -49,9 +49,8 @@ static void ttm_bo_global_kobj_release(struct kobject *kobj);
 * ttm_global_mutex - protecting the global BO state
 */
 DEFINE_MUTEX(ttm_global_mutex);
-struct ttm_bo_global ttm_bo_glob = {
+unsigned ttm_bo_glob_use_count;
-        .use_count = 0
+struct ttm_bo_global ttm_bo_glob;
-};
 static struct attribute ttm_bo_count = {
        .name = "bo_count",
@@ -1531,12 +1530,13 @@ static void ttm_bo_global_release(void)
        struct ttm_bo_global *glob = &ttm_bo_glob;
        mutex_lock(&ttm_global_mutex);
-        if (--glob->use_count > 0)
+        if (--ttm_bo_glob_use_count > 0)
                goto out;
        kobject_del(&glob->kobj);
        kobject_put(&glob->kobj);
        ttm_mem_global_release(&ttm_mem_glob);
+        memset(glob, 0, sizeof(*glob));
 out:
        mutex_unlock(&ttm_global_mutex);
 }
@@ -1548,7 +1548,7 @@ static int ttm_bo_global_init(void)
        unsigned i;
        mutex_lock(&ttm_global_mutex);
-        if (++glob->use_count > 1)
+        if (++ttm_bo_glob_use_count > 1)
                goto out;
        ret = ttm_mem_global_init(&ttm_mem_glob);
diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
index f1567c353b54..9a0909decb36 100644
--- a/drivers/gpu/drm/ttm/ttm_memory.c
+++ b/drivers/gpu/drm/ttm/ttm_memory.c
@@ -461,8 +461,8 @@ out_no_zone:
 void ttm_mem_global_release(struct ttm_mem_global *glob)
 {
-        unsigned int i;
        struct ttm_mem_zone *zone;
+        unsigned int i;
        /* let the page allocator first stop the shrink work. */
        ttm_page_alloc_fini();
@@ -475,9 +475,10 @@ void ttm_mem_global_release(struct ttm_mem_global *glob)
                zone = glob->zones[i];
                kobject_del(&zone->kobj);
                kobject_put(&zone->kobj);
-                        }
+        }
        kobject_del(&glob->kobj);
        kobject_put(&glob->kobj);
+        memset(glob, 0, sizeof(*glob));
 }
 static void ttm_check_swapping(struct ttm_mem_global *glob)
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 730008d3da76..1baa10e94484 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -1042,7 +1042,7 @@ static void
 vc4_crtc_reset(struct drm_crtc *crtc)
 {
        if (crtc->state)
-                __drm_atomic_helper_crtc_destroy_state(crtc->state);
+                vc4_crtc_destroy_state(crtc, crtc->state);
        crtc->state = kzalloc(sizeof(struct vc4_crtc_state), GFP_KERNEL);
        if (crtc->state)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 6165fe2c4504..1bfa353d995c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -546,29 +546,13 @@ static void vmw_get_initial_size(struct vmw_private *dev_priv)
 }
 /**
- * vmw_assume_iommu - Figure out whether coherent dma-remapping might be
- * taking place.
- * @dev: Pointer to the struct drm_device.
- *
- * Return: true if iommu present, false otherwise.
- */
-static bool vmw_assume_iommu(struct drm_device *dev)
-{
-        const struct dma_map_ops *ops = get_dma_ops(dev->dev);
-        return !dma_is_direct(ops) && ops &&
-                ops->map_page != dma_direct_map_page;
-}
-/**
 * vmw_dma_select_mode - Determine how DMA mappings should be set up for this
 * system.
 *
 * @dev_priv: Pointer to a struct vmw_private
 *
- * This functions tries to determine the IOMMU setup and what actions
+ * This functions tries to determine what actions need to be taken by the
- * need to be taken by the driver to make system pages visible to the
+ * driver to make system pages visible to the device.
- * device.
 * If this function decides that DMA is not possible, it returns -EINVAL.
 * The driver may then try to disable features of the device that require
 * DMA.
@@ -578,23 +562,16 @@ static int vmw_dma_select_mode(struct vmw_private *dev_priv)
        static const char *names[vmw_dma_map_max] = {
                [vmw_dma_phys] = "Using physical TTM page addresses.",
                [vmw_dma_alloc_coherent] = "Using coherent TTM pages.",
-                [vmw_dma_map_populate] = "Keeping DMA mappings.",
+                [vmw_dma_map_populate] = "Caching DMA mappings.",
                [vmw_dma_map_bind] = "Giving up DMA mappings early."};
        if (vmw_force_coherent)
                dev_priv->map_mode = vmw_dma_alloc_coherent;
-        else if (vmw_assume_iommu(dev_priv->dev))
+        else if (vmw_restrict_iommu)
-                dev_priv->map_mode = vmw_dma_map_populate;
+                dev_priv->map_mode = vmw_dma_map_bind;
-        else if (!vmw_force_iommu)
-                dev_priv->map_mode = vmw_dma_phys;
-        else if (IS_ENABLED(CONFIG_SWIOTLB) && swiotlb_nr_tbl())
-                dev_priv->map_mode = vmw_dma_alloc_coherent;
        else
                dev_priv->map_mode = vmw_dma_map_populate;
-        if (dev_priv->map_mode == vmw_dma_map_populate && vmw_restrict_iommu)
-                dev_priv->map_mode = vmw_dma_map_bind;
        /* No TTM coherent page pool? FIXME: Ask TTM instead! */
        if (!(IS_ENABLED(CONFIG_SWIOTLB) || IS_ENABLED(CONFIG_INTEL_IOMMU)) &&
            (dev_priv->map_mode == vmw_dma_alloc_coherent))
diff --git a/drivers/gpu/ipu-v3/ipu-dp.c b/drivers/gpu/ipu-v3/ipu-dp.c
index 9b2b3fa479c4..5e44ff1f2085 100644
--- a/drivers/gpu/ipu-v3/ipu-dp.c
+++ b/drivers/gpu/ipu-v3/ipu-dp.c
@@ -195,7 +195,8 @@ int ipu_dp_setup_channel(struct ipu_dp *dp,
                ipu_dp_csc_init(flow, flow->foreground.in_cs, flow->out_cs,
                                DP_COM_CONF_CSC_DEF_BOTH);
        } else {
-                if (flow->foreground.in_cs == flow->out_cs)
+                if (flow->foreground.in_cs == IPUV3_COLORSPACE_UNKNOWN ||
+                    flow->foreground.in_cs == flow->out_cs)
                        /*
                         * foreground identical to output, apply color
                         * conversion on background
@@ -261,6 +262,8 @@ void ipu_dp_disable_channel(struct ipu_dp *dp, bool sync)
        struct ipu_dp_priv *priv = flow->priv;
        u32 reg, csc;
+        dp->in_cs = IPUV3_COLORSPACE_UNKNOWN;
        if (!dp->foreground)
                return;
@@ -268,8 +271,9 @@ void ipu_dp_disable_channel(struct ipu_dp *dp, bool sync)
        reg = readl(flow->base + DP_COM_CONF);
        csc = reg & DP_COM_CONF_CSC_DEF_MASK;
-        if (csc == DP_COM_CONF_CSC_DEF_FG)
+        reg &= ~DP_COM_CONF_CSC_DEF_MASK;
-                reg &= ~DP_COM_CONF_CSC_DEF_MASK;
+        if (csc == DP_COM_CONF_CSC_DEF_BOTH || csc == DP_COM_CONF_CSC_DEF_BG)
+                reg |= DP_COM_CONF_CSC_DEF_BG;
        reg &= ~DP_COM_CONF_FG_EN;
        writel(reg, flow->base + DP_COM_CONF);
@@ -347,6 +351,8 @@ int ipu_dp_init(struct ipu_soc *ipu, struct device *dev, unsigned long base)
        mutex_init(&priv->mutex);
        for (i = 0; i < IPUV3_NUM_FLOWS; i++) {
+                priv->flow[i].background.in_cs = IPUV3_COLORSPACE_UNKNOWN;
+                priv->flow[i].foreground.in_cs = IPUV3_COLORSPACE_UNKNOWN;
                priv->flow[i].foreground.foreground = true;
                priv->flow[i].base = priv->base + ipu_dp_flow_base[i];
                priv->flow[i].priv = priv;
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 38af18645133..c480ca385ffb 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -185,7 +185,7 @@ static int i2c_generic_bus_free(struct i2c_adapter *adap)
 int i2c_generic_scl_recovery(struct i2c_adapter *adap)
 {
        struct i2c_bus_recovery_info *bri = adap->bus_recovery_info;
-        int i = 0, scl = 1, ret;
+        int i = 0, scl = 1, ret = 0;
        if (bri->prepare_recovery)
                bri->prepare_recovery(adap);
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index ea0bc6885517..32cc8fe7902f 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -160,6 +160,7 @@ struct ib_uverbs_file {
        struct mutex umap_lock;
        struct list_head umaps;
+        struct page *disassociate_page;
        struct idr              idr;
        /* spinlock protects write access to idr */
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index f2e7ffe6fc54..c489f545baae 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -208,6 +208,9 @@ void ib_uverbs_release_file(struct kref *ref)
                kref_put(&file->async_file->ref,
                         ib_uverbs_release_async_event_file);
        put_device(&file->device->dev);
+        if (file->disassociate_page)
+                __free_pages(file->disassociate_page, 0);
        kfree(file);
 }
@@ -877,9 +880,50 @@ static void rdma_umap_close(struct vm_area_struct *vma)
        kfree(priv);
 }
+/*
+ * Once the zap_vma_ptes has been called touches to the VMA will come here and
+ * we return a dummy writable zero page for all the pfns.
+ */
+static vm_fault_t rdma_umap_fault(struct vm_fault *vmf)
+{
+        struct ib_uverbs_file *ufile = vmf->vma->vm_file->private_data;
+        struct rdma_umap_priv *priv = vmf->vma->vm_private_data;
+        vm_fault_t ret = 0;
+        if (!priv)
+                return VM_FAULT_SIGBUS;
+        /* Read only pages can just use the system zero page. */
+        if (!(vmf->vma->vm_flags & (VM_WRITE | VM_MAYWRITE))) {
+                vmf->page = ZERO_PAGE(vmf->address);
+                get_page(vmf->page);
+                return 0;
+        }
+        mutex_lock(&ufile->umap_lock);
+        if (!ufile->disassociate_page)
+                ufile->disassociate_page =
+                        alloc_pages(vmf->gfp_mask | __GFP_ZERO, 0);
+        if (ufile->disassociate_page) {
+                /*
+                 * This VMA is forced to always be shared so this doesn't have
+                 * to worry about COW.
+                 */
+                vmf->page = ufile->disassociate_page;
+                get_page(vmf->page);
+        } else {
+                ret = VM_FAULT_SIGBUS;
+        }
+        mutex_unlock(&ufile->umap_lock);
+        return ret;
+}
 static const struct vm_operations_struct rdma_umap_ops = {
        .open = rdma_umap_open,
        .close = rdma_umap_close,
+        .fault = rdma_umap_fault,
 };
 static struct rdma_umap_priv *rdma_user_mmap_pre(struct ib_ucontext *ucontext,
@@ -889,6 +933,9 @@ static struct rdma_umap_priv *rdma_user_mmap_pre(struct ib_ucontext *ucontext,
        struct ib_uverbs_file *ufile = ucontext->ufile;
        struct rdma_umap_priv *priv;
+        if (!(vma->vm_flags & VM_SHARED))
+                return ERR_PTR(-EINVAL);
        if (vma->vm_end - vma->vm_start != size)
                return ERR_PTR(-EINVAL);
@@ -992,7 +1039,7 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
                 * at a time to get the lock ordering right. Typically there
                 * will only be one mm, so no big deal.
                 */
-                down_write(&mm->mmap_sem);
+                down_read(&mm->mmap_sem);
                if (!mmget_still_valid(mm))
                        goto skip_mm;
                mutex_lock(&ufile->umap_lock);
@@ -1006,11 +1053,10 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
                        zap_vma_ptes(vma, vma->vm_start,
                                     vma->vm_end - vma->vm_start);
-                        vma->vm_flags &= ~(VM_SHARED | VM_MAYSHARE);
                }
                mutex_unlock(&ufile->umap_lock);
        skip_mm:
-                up_write(&mm->mmap_sem);
+                up_read(&mm->mmap_sem);
                mmput(mm);
        }
 }
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index 66cdf625534f..60cf9f03e941 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -533,7 +533,7 @@ static int hns_roce_set_kernel_sq_size(struct hns_roce_dev *hr_dev,
 static int hns_roce_qp_has_sq(struct ib_qp_init_attr *attr)
 {
-        if (attr->qp_type == IB_QPT_XRC_TGT)
+        if (attr->qp_type == IB_QPT_XRC_TGT || !attr->cap.max_send_wr)
                return 0;
        return 1;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 0845e95d2d11..347e3cac254e 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1119,6 +1119,8 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
                if (MLX5_CAP_GEN(mdev, qp_packet_based))
                        resp.flags |=
                                MLX5_IB_QUERY_DEV_RESP_PACKET_BASED_CREDIT_MODE;
+                resp.flags |= MLX5_IB_QUERY_DEV_RESP_FLAGS_SCAT2CQE_DCT;
        }
        if (field_avail(typeof(resp), sw_parsing_caps,
@@ -2066,6 +2068,7 @@ static int mlx5_ib_mmap_clock_info_page(struct mlx5_ib_dev *dev,
        if (vma->vm_flags & VM_WRITE)
                return -EPERM;
+        vma->vm_flags &= ~VM_MAYWRITE;
        if (!dev->mdev->clock_info_page)
                return -EOPNOTSUPP;
@@ -2231,19 +2234,18 @@ static int mlx5_ib_mmap(struct ib_ucontext *ibcontext, struct vm_area_struct *vm
                if (vma->vm_flags & VM_WRITE)
                        return -EPERM;
+                vma->vm_flags &= ~VM_MAYWRITE;
                /* Don't expose to user-space information it shouldn't have */
                if (PAGE_SIZE > 4096)
                        return -EOPNOTSUPP;
-                vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
                pfn = (dev->mdev->iseg_base +
                       offsetof(struct mlx5_init_seg, internal_timer_h)) >>
                        PAGE_SHIFT;
-                if (io_remap_pfn_range(vma, vma->vm_start, pfn,
+                return rdma_user_mmap_io(&context->ibucontext, vma, pfn,
-                                       PAGE_SIZE, vma->vm_page_prot))
+                                         PAGE_SIZE,
-                        return -EAGAIN;
+                                         pgprot_noncached(vma->vm_page_prot));
-                break;
        case MLX5_IB_MMAP_CLOCK_INFO:
                return mlx5_ib_mmap_clock_info_page(dev, vma, context);
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index ef7d69269a88..fc67d78ca959 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1818,13 +1818,16 @@ static void configure_responder_scat_cqe(struct ib_qp_init_attr *init_attr,
        rcqe_sz = mlx5_ib_get_cqe_size(init_attr->recv_cq);
-        if (rcqe_sz == 128) {
+        if (init_attr->qp_type == MLX5_IB_QPT_DCT) {
-                MLX5_SET(qpc, qpc, cs_res, MLX5_RES_SCAT_DATA64_CQE);
+                if (rcqe_sz == 128)
+                        MLX5_SET(dctc, qpc, cs_res, MLX5_RES_SCAT_DATA64_CQE);
                return;
        }
-        if (init_attr->qp_type != MLX5_IB_QPT_DCT)
+        MLX5_SET(qpc, qpc, cs_res,
-                MLX5_SET(qpc, qpc, cs_res, MLX5_RES_SCAT_DATA32_CQE);
+                 rcqe_sz == 128 ? MLX5_RES_SCAT_DATA64_CQE :
+                                  MLX5_RES_SCAT_DATA32_CQE);
 }
 static void configure_requester_scat_cqe(struct mlx5_ib_dev *dev,
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 728795043496..0bb6e39dd03a 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -608,11 +608,6 @@ static int rvt_set_page(struct ib_mr *ibmr, u64 addr)
        if (unlikely(mapped_segs == mr->mr.max_segs))
                return -ENOMEM;
-        if (mr->mr.length == 0) {
-                mr->mr.user_base = addr;
-                mr->mr.iova = addr;
-        }
        m = mapped_segs / RVT_SEGSZ;
        n = mapped_segs % RVT_SEGSZ;
        mr->mr.map[m]->segs[n].vaddr = (void *)addr;
@@ -630,17 +625,24 @@ static int rvt_set_page(struct ib_mr *ibmr, u64 addr)
 * @sg_nents: number of entries in sg
 * @sg_offset: offset in bytes into sg
 *
+ * Overwrite rvt_mr length with mr length calculated by ib_sg_to_pages.
+ *
 * Return: number of sg elements mapped to the memory region
 */
 int rvt_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
                  int sg_nents, unsigned int *sg_offset)
 {
        struct rvt_mr *mr = to_imr(ibmr);
+        int ret;
        mr->mr.length = 0;
        mr->mr.page_shift = PAGE_SHIFT;
-        return ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset,
+        ret = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rvt_set_page);
-                              rvt_set_page);
+        mr->mr.user_base = ibmr->iova;
+        mr->mr.iova = ibmr->iova;
+        mr->mr.offset = ibmr->iova - (u64)mr->mr.map[0]->segs[0].vaddr;
+        mr->mr.length = (size_t)ibmr->length;
+        return ret;
 }
 /**
@@ -671,6 +673,7 @@ int rvt_fast_reg_mr(struct rvt_qp *qp, struct ib_mr *ibmr, u32 key,
        ibmr->rkey = key;
        mr->mr.lkey = key;
        mr->mr.access_flags = access;
+        mr->mr.iova = ibmr->iova;
        atomic_set(&mr->mr.lkey_invalid, 0);
        return 0;
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index a878351f1643..52d7f55fca32 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -420,7 +420,7 @@ config KEYBOARD_MPR121
 config KEYBOARD_SNVS_PWRKEY
        tristate "IMX SNVS Power Key Driver"
-        depends on SOC_IMX6SX || SOC_IMX7D
+        depends on ARCH_MXC || COMPILE_TEST
        depends on OF
        help
          This is the snvs powerkey driver for the Freescale i.MX application
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index fc3ab93b7aea..7fb358f96195 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -860,7 +860,7 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
        error = rmi_register_function(fn);
        if (error)
-                goto err_put_fn;
+                return error;
        if (pdt->function_number == 0x01)
                data->f01_container = fn;
@@ -870,10 +870,6 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
        list_add_tail(&fn->node, &data->function_list);
        return RMI_SCAN_CONTINUE;
-err_put_fn:
-        put_device(&fn->dev);
-        return error;
 }
 void rmi_enable_irq(struct rmi_device *rmi_dev, bool clear_wake)
diff --git a/drivers/input/rmi4/rmi_f11.c b/drivers/input/rmi4/rmi_f11.c
index df64d6aed4f7..93901ebd122a 100644
--- a/drivers/input/rmi4/rmi_f11.c
+++ b/drivers/input/rmi4/rmi_f11.c
@@ -1230,7 +1230,7 @@ static int rmi_f11_initialize(struct rmi_function *fn)
        }
        rc = f11_write_control_regs(fn, &f11->sens_query,
-                           &f11->dev_controls, fn->fd.query_base_addr);
+                           &f11->dev_controls, fn->fd.control_base_addr);
        if (rc)
                dev_warn(&fn->dev, "Failed to write control registers\n");
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index f38e5c1b87e4..d984538980e2 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -722,12 +722,6 @@ static void marvell_nfc_select_target(struct nand_chip *chip,
        struct marvell_nfc *nfc = to_marvell_nfc(chip->controller);
        u32 ndcr_generic;
-        if (chip == nfc->selected_chip && die_nr == marvell_nand->selected_die)
-                return;
-        writel_relaxed(marvell_nand->ndtr0, nfc->regs + NDTR0);
-        writel_relaxed(marvell_nand->ndtr1, nfc->regs + NDTR1);
        /*
         * Reset the NDCR register to a clean state for this particular chip,
         * also clear ND_RUN bit.
@@ -739,6 +733,12 @@ static void marvell_nfc_select_target(struct nand_chip *chip,
        /* Also reset the interrupt status register */
        marvell_nfc_clear_int(nfc, NDCR_ALL_INT);
+        if (chip == nfc->selected_chip && die_nr == marvell_nand->selected_die)
+                return;
+        writel_relaxed(marvell_nand->ndtr0, nfc->regs + NDTR0);
+        writel_relaxed(marvell_nand->ndtr1, nfc->regs + NDTR1);
        nfc->selected_chip = chip;
        marvell_nand->selected_die = die_nr;
 }
diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
index e6234d209787..4212bc4a5f31 100644
--- a/drivers/net/dsa/bcm_sf2_cfp.c
+++ b/drivers/net/dsa/bcm_sf2_cfp.c
@@ -886,6 +886,9 @@ static int bcm_sf2_cfp_rule_set(struct dsa_switch *ds, int port,
             fs->m_ext.data[1]))
                return -EINVAL;
+        if (fs->location != RX_CLS_LOC_ANY && fs->location >= CFP_NUM_RULES)
+                return -EINVAL;
        if (fs->location != RX_CLS_LOC_ANY &&
            test_bit(fs->location, priv->cfp.used))
                return -EBUSY;
@@ -974,6 +977,9 @@ static int bcm_sf2_cfp_rule_del(struct bcm_sf2_priv *priv, int port, u32 loc)
        struct cfp_rule *rule;
        int ret;
+        if (loc >= CFP_NUM_RULES)
+                return -EINVAL;
        /* Refuse deleting unused rules, and those that are not unique since
         * that could leave IPv6 rules with one of the chained rule in the
         * table.
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 526f36dcb204..a0de3c368f4a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1625,7 +1625,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
                        netdev_warn(bp->dev, "RX buffer error %x\n", rx_err);
                        bnxt_sched_reset(bp, rxr);
                }
-                goto next_rx;
+                goto next_rx_no_len;
        }
        len = le32_to_cpu(rxcmp->rx_cmp_len_flags_type) >> RX_CMP_LEN_SHIFT;
@@ -1706,12 +1706,13 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
        rc = 1;
 next_rx:
-        rxr->rx_prod = NEXT_RX(prod);
-        rxr->rx_next_cons = NEXT_RX(cons);
        cpr->rx_packets += 1;
        cpr->rx_bytes += len;
+next_rx_no_len:
+        rxr->rx_prod = NEXT_RX(prod);
+        rxr->rx_next_cons = NEXT_RX(cons);
 next_rx_no_prod_no_len:
        *raw_cons = tmp_raw_cons;
@@ -5135,10 +5136,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path)
        for (i = 0; i < bp->tx_nr_rings; i++) {
                struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
                struct bnxt_ring_struct *ring = &txr->tx_ring_struct;
-                u32 cmpl_ring_id;
-                cmpl_ring_id = bnxt_cp_ring_for_tx(bp, txr);
                if (ring->fw_ring_id != INVALID_HW_RING_ID) {
+                        u32 cmpl_ring_id = bnxt_cp_ring_for_tx(bp, txr);
                        hwrm_ring_free_send_msg(bp, ring,
                                                RING_FREE_REQ_RING_TYPE_TX,
                                                close_path ? cmpl_ring_id :
@@ -5151,10 +5152,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path)
                struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];
                struct bnxt_ring_struct *ring = &rxr->rx_ring_struct;
                u32 grp_idx = rxr->bnapi->index;
-                u32 cmpl_ring_id;
-                cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
                if (ring->fw_ring_id != INVALID_HW_RING_ID) {
+                        u32 cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
                        hwrm_ring_free_send_msg(bp, ring,
                                                RING_FREE_REQ_RING_TYPE_RX,
                                                close_path ? cmpl_ring_id :
@@ -5173,10 +5174,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path)
                struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];
                struct bnxt_ring_struct *ring = &rxr->rx_agg_ring_struct;
                u32 grp_idx = rxr->bnapi->index;
-                u32 cmpl_ring_id;
-                cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
                if (ring->fw_ring_id != INVALID_HW_RING_ID) {
+                        u32 cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
                        hwrm_ring_free_send_msg(bp, ring, type,
                                                close_path ? cmpl_ring_id :
                                                INVALID_HW_RING_ID);
@@ -5315,17 +5316,16 @@ __bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, struct hwrm_func_cfg_input *req,
        req->num_tx_rings = cpu_to_le16(tx_rings);
        if (BNXT_NEW_RM(bp)) {
                enables |= rx_rings ? FUNC_CFG_REQ_ENABLES_NUM_RX_RINGS : 0;
+                enables |= stats ? FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
                if (bp->flags & BNXT_FLAG_CHIP_P5) {
                        enables |= cp_rings ? FUNC_CFG_REQ_ENABLES_NUM_MSIX : 0;
                        enables |= tx_rings + ring_grps ?
-                                   FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
+                                   FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS : 0;
-                                   FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
                        enables |= rx_rings ?
                                FUNC_CFG_REQ_ENABLES_NUM_RSSCOS_CTXS : 0;
                } else {
                        enables |= cp_rings ?
-                                   FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
+                                   FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS : 0;
-                                   FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
                        enables |= ring_grps ?
                                   FUNC_CFG_REQ_ENABLES_NUM_HW_RING_GRPS |
                                   FUNC_CFG_REQ_ENABLES_NUM_RSSCOS_CTXS : 0;
@@ -5365,14 +5365,13 @@ __bnxt_hwrm_reserve_vf_rings(struct bnxt *bp,
        enables |= tx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_TX_RINGS : 0;
        enables |= rx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_RX_RINGS |
                              FUNC_VF_CFG_REQ_ENABLES_NUM_RSSCOS_CTXS : 0;
+        enables |= stats ? FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
        if (bp->flags & BNXT_FLAG_CHIP_P5) {
                enables |= tx_rings + ring_grps ?
-                           FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
+                           FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS : 0;
-                           FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
        } else {
                enables |= cp_rings ?
-                           FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
+                           FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS : 0;
-                           FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
                enables |= ring_grps ?
                           FUNC_VF_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;
        }
@@ -6753,6 +6752,7 @@ static int bnxt_hwrm_port_qstats_ext(struct bnxt *bp)
        struct hwrm_queue_pri2cos_qcfg_input req2 = {0};
        struct hwrm_port_qstats_ext_input req = {0};
        struct bnxt_pf_info *pf = &bp->pf;
+        u32 tx_stat_size;
        int rc;
        if (!(bp->flags & BNXT_FLAG_PORT_STATS_EXT))
@@ -6762,13 +6762,16 @@ static int bnxt_hwrm_port_qstats_ext(struct bnxt *bp)
        req.port_id = cpu_to_le16(pf->port_id);
        req.rx_stat_size = cpu_to_le16(sizeof(struct rx_port_stats_ext));
        req.rx_stat_host_addr = cpu_to_le64(bp->hw_rx_port_stats_ext_map);
-        req.tx_stat_size = cpu_to_le16(sizeof(struct tx_port_stats_ext));
+        tx_stat_size = bp->hw_tx_port_stats_ext ?
+                       sizeof(*bp->hw_tx_port_stats_ext) : 0;
+        req.tx_stat_size = cpu_to_le16(tx_stat_size);
        req.tx_stat_host_addr = cpu_to_le64(bp->hw_tx_port_stats_ext_map);
        mutex_lock(&bp->hwrm_cmd_lock);
        rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
        if (!rc) {
                bp->fw_rx_stats_ext_size = le16_to_cpu(resp->rx_stat_size) / 8;
-                bp->fw_tx_stats_ext_size = le16_to_cpu(resp->tx_stat_size) / 8;
+                bp->fw_tx_stats_ext_size = tx_stat_size ?
+                        le16_to_cpu(resp->tx_stat_size) / 8 : 0;
        } else {
                bp->fw_rx_stats_ext_size = 0;
                bp->fw_tx_stats_ext_size = 0;
@@ -8961,8 +8964,15 @@ static int bnxt_cfg_rx_mode(struct bnxt *bp)
 skip_uc:
        rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0);
+        if (rc && vnic->mc_list_count) {
+                netdev_info(bp->dev, "Failed setting MC filters rc: %d, turning on ALL_MCAST mode\n",
+                            rc);
+                vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
+                vnic->mc_list_count = 0;
+                rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0);
+        }
        if (rc)
-                netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %x\n",
+                netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %d\n",
                           rc);
        return rc;
@@ -10699,6 +10709,7 @@ init_err_cleanup_tc:
        bnxt_clear_int_mode(bp);
 init_err_pci_clean:
+        bnxt_free_hwrm_short_cmd_req(bp);
        bnxt_free_hwrm_resources(bp);
        bnxt_free_ctx_mem(bp);
        kfree(bp->ctx);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
index 062a600fa5a7..21428537e231 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
@@ -333,6 +333,9 @@ static int stm32mp1_parse_data(struct stm32_dwmac *dwmac,
         */
        dwmac->irq_pwr_wakeup = platform_get_irq_byname(pdev,
                                                        "stm32_pwr_wakeup");
+        if (dwmac->irq_pwr_wakeup == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
        if (!dwmac->clk_eth_ck && dwmac->irq_pwr_wakeup >= 0) {
                err = device_init_wakeup(&pdev->dev, true);
                if (err) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index cc1e887e47b5..26db6aa002d1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -160,7 +160,7 @@ static const struct dmi_system_id quark_pci_dmi[] = {
                .driver_data = (void *)&galileo_stmmac_dmi_data,
        },
        /*
-         * There are 2 types of SIMATIC IOT2000: IOT20202 and IOT2040.
+         * There are 2 types of SIMATIC IOT2000: IOT2020 and IOT2040.
         * The asset tag "6ES7647-0AA00-0YA2" is only for IOT2020 which
         * has only one pci network device while other asset tags are
         * for IOT2040 which has two.
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index c589f5ae75bb..8bb53ec8d9cf 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -533,6 +533,8 @@ mcr20a_start(struct ieee802154_hw *hw)
        dev_dbg(printdev(lp), "no slotted operation\n");
        ret = regmap_update_bits(lp->regmap_dar, DAR_PHY_CTRL1,
                                 DAR_PHY_CTRL1_SLOTTED, 0x0);
+        if (ret < 0)
+                return ret;
        /* enable irq */
        enable_irq(lp->spi->irq);
@@ -540,11 +542,15 @@ mcr20a_start(struct ieee802154_hw *hw)
        /* Unmask SEQ interrupt */
        ret = regmap_update_bits(lp->regmap_dar, DAR_PHY_CTRL2,
                                 DAR_PHY_CTRL2_SEQMSK, 0x0);
+        if (ret < 0)
+                return ret;
        /* Start the RX sequence */
        dev_dbg(printdev(lp), "start the RX sequence\n");
        ret = regmap_update_bits(lp->regmap_dar, DAR_PHY_CTRL1,
                                 DAR_PHY_CTRL1_XCVSEQ_MASK, MCR20A_XCVSEQ_RX);
+        if (ret < 0)
+                return ret;
        return 0;
 }
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index a7e8c8113d97..a7796134e3be 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1597,9 +1597,10 @@ static int marvell_get_sset_count(struct phy_device *phydev)
 static void marvell_get_strings(struct phy_device *phydev, u8 *data)
 {
+        int count = marvell_get_sset_count(phydev);
        int i;
-        for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++) {
+        for (i = 0; i < count; i++) {
                strlcpy(data + i * ETH_GSTRING_LEN,
                        marvell_hw_stats[i].string, ETH_GSTRING_LEN);
        }
@@ -1627,9 +1628,10 @@ static u64 marvell_get_stat(struct phy_device *phydev, int i)
 static void marvell_get_stats(struct phy_device *phydev,
                              struct ethtool_stats *stats, u64 *data)
 {
+        int count = marvell_get_sset_count(phydev);
        int i;
-        for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++)
+        for (i = 0; i < count; i++)
                data[i] = marvell_get_stat(phydev, i);
 }
diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
index f4e93f5fc204..ea90db3c7705 100644
--- a/drivers/net/slip/slhc.c
+++ b/drivers/net/slip/slhc.c
@@ -153,7 +153,7 @@ out_fail:
 void
 slhc_free(struct slcompress *comp)
 {
-        if ( comp == NULLSLCOMPR )
+        if ( IS_ERR_OR_NULL(comp) )
                return;
        if ( comp->tstate != NULLSLSTATE )
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 18c4e5d17b05..5c3ac97519b7 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1131,9 +1131,16 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x0846, 0x68d3, 8)},    /* Netgear Aircard 779S */
        {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
        {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
+        {QMI_FIXED_INTF(0x1435, 0x0918, 3)},    /* Wistron NeWeb D16Q1 */
+        {QMI_FIXED_INTF(0x1435, 0x0918, 4)},    /* Wistron NeWeb D16Q1 */
+        {QMI_FIXED_INTF(0x1435, 0x0918, 5)},    /* Wistron NeWeb D16Q1 */
+        {QMI_FIXED_INTF(0x1435, 0x3185, 4)},    /* Wistron NeWeb M18Q5 */
+        {QMI_FIXED_INTF(0x1435, 0xd111, 4)},    /* M9615A DM11-1 D51QC */
        {QMI_FIXED_INTF(0x1435, 0xd181, 3)},    /* Wistron NeWeb D18Q1 */
        {QMI_FIXED_INTF(0x1435, 0xd181, 4)},    /* Wistron NeWeb D18Q1 */
        {QMI_FIXED_INTF(0x1435, 0xd181, 5)},    /* Wistron NeWeb D18Q1 */
+        {QMI_FIXED_INTF(0x1435, 0xd182, 4)},    /* Wistron NeWeb D18 */
+        {QMI_FIXED_INTF(0x1435, 0xd182, 5)},    /* Wistron NeWeb D18 */
        {QMI_FIXED_INTF(0x1435, 0xd191, 4)},    /* Wistron NeWeb D19Q1 */
        {QMI_QUIRK_SET_DTR(0x1508, 0x1001, 4)}, /* Fibocom NL668 series */
        {QMI_FIXED_INTF(0x16d8, 0x6003, 0)},    /* CMOTech 6003 */
@@ -1189,6 +1196,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x19d2, 0x0265, 4)},    /* ONDA MT8205 4G LTE */
        {QMI_FIXED_INTF(0x19d2, 0x0284, 4)},    /* ZTE MF880 */
        {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
+        {QMI_FIXED_INTF(0x19d2, 0x0396, 3)},    /* ZTE ZM8620 */
        {QMI_FIXED_INTF(0x19d2, 0x0412, 4)},    /* Telewell TW-LTE 4G */
        {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
        {QMI_FIXED_INTF(0x19d2, 0x1010, 4)},    /* ZTE (Vodafone) K3571-Z */
@@ -1209,7 +1217,9 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x19d2, 0x1425, 2)},
        {QMI_FIXED_INTF(0x19d2, 0x1426, 2)},    /* ZTE MF91 */
        {QMI_FIXED_INTF(0x19d2, 0x1428, 2)},    /* Telewell TW-LTE 4G v2 */
+        {QMI_FIXED_INTF(0x19d2, 0x1432, 3)},    /* ZTE ME3620 */
        {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
+        {QMI_FIXED_INTF(0x2001, 0x7e16, 3)},    /* D-Link DWM-221 */
        {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},    /* D-Link DWM-221 B1 */
        {QMI_FIXED_INTF(0x2001, 0x7e35, 4)},    /* D-Link DWM-222 */
        {QMI_FIXED_INTF(0x2020, 0x2031, 4)},    /* Olicard 600 */
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index 24b983edb357..eca87f7c5b6c 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -1855,7 +1855,7 @@ void ath10k_ce_dump_registers(struct ath10k *ar,
        struct ath10k_ce_crash_data ce_data;
        u32 addr, id;
-        lockdep_assert_held(&ar->data_lock);
+        lockdep_assert_held(&ar->dump_mutex);
        ath10k_err(ar, "Copy Engine register dump:\n");
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 835b8de92d55..aff585658fc0 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -3119,6 +3119,7 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
                goto err_free_wq;
        mutex_init(&ar->conf_mutex);
+        mutex_init(&ar->dump_mutex);
        spin_lock_init(&ar->data_lock);
        INIT_LIST_HEAD(&ar->peers);
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index e08a17b01e03..e35aae5146f1 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -1063,6 +1063,9 @@ struct ath10k {
        /* prevents concurrent FW reconfiguration */
        struct mutex conf_mutex;
+        /* protects coredump data */
+        struct mutex dump_mutex;
        /* protects shared structure data */
        spinlock_t data_lock;
diff --git a/drivers/net/wireless/ath/ath10k/coredump.c b/drivers/net/wireless/ath/ath10k/coredump.c
index 33838d9c1cb6..45a355fb62b9 100644
--- a/drivers/net/wireless/ath/ath10k/coredump.c
+++ b/drivers/net/wireless/ath/ath10k/coredump.c
@@ -1102,7 +1102,7 @@ struct ath10k_fw_crash_data *ath10k_coredump_new(struct ath10k *ar)
 {
        struct ath10k_fw_crash_data *crash_data = ar->coredump.fw_crash_data;
-        lockdep_assert_held(&ar->data_lock);
+        lockdep_assert_held(&ar->dump_mutex);
        if (ath10k_coredump_mask == 0)
                /* coredump disabled */
@@ -1146,7 +1146,7 @@ static struct ath10k_dump_file_data *ath10k_coredump_build(struct ath10k *ar)
        if (!buf)
                return NULL;
-        spin_lock_bh(&ar->data_lock);
+        mutex_lock(&ar->dump_mutex);
        dump_data = (struct ath10k_dump_file_data *)(buf);
        strlcpy(dump_data->df_magic, "ATH10K-FW-DUMP",
@@ -1213,7 +1213,7 @@ static struct ath10k_dump_file_data *ath10k_coredump_build(struct ath10k *ar)
                sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len;
        }
-        spin_unlock_bh(&ar->data_lock);
+        mutex_unlock(&ar->dump_mutex);
        return dump_data;
 }
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 41e89db244d2..9c703d287333 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -5774,7 +5774,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
        }
        if (changed & BSS_CHANGED_MCAST_RATE &&
-            !WARN_ON(ath10k_mac_vif_chan(arvif->vif, &def))) {
+            !ath10k_mac_vif_chan(arvif->vif, &def)) {
                band = def.chan->band;
                rateidx = vif->bss_conf.mcast_rate[band] - 1;
@@ -5812,7 +5812,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
        }
        if (changed & BSS_CHANGED_BASIC_RATES) {
-                if (WARN_ON(ath10k_mac_vif_chan(vif, &def))) {
+                if (ath10k_mac_vif_chan(vif, &def)) {
                        mutex_unlock(&ar->conf_mutex);
                        return;
                }
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 271f92c24d44..2c27f407a851 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -1441,7 +1441,7 @@ static void ath10k_pci_dump_registers(struct ath10k *ar,
        __le32 reg_dump_values[REG_DUMP_COUNT_QCA988X] = {};
        int i, ret;
-        lockdep_assert_held(&ar->data_lock);
+        lockdep_assert_held(&ar->dump_mutex);
        ret = ath10k_pci_diag_read_hi(ar, &reg_dump_values[0],
                                      hi_failure_state,
@@ -1656,7 +1656,7 @@ static void ath10k_pci_dump_memory(struct ath10k *ar,
        int ret, i;
        u8 *buf;
-        lockdep_assert_held(&ar->data_lock);
+        lockdep_assert_held(&ar->dump_mutex);
        if (!crash_data)
                return;
@@ -1734,14 +1734,19 @@ static void ath10k_pci_dump_memory(struct ath10k *ar,
        }
 }
-static void ath10k_pci_fw_crashed_dump(struct ath10k *ar)
+static void ath10k_pci_fw_dump_work(struct work_struct *work)
 {
+        struct ath10k_pci *ar_pci = container_of(work, struct ath10k_pci,
+                                                 dump_work);
        struct ath10k_fw_crash_data *crash_data;
+        struct ath10k *ar = ar_pci->ar;
        char guid[UUID_STRING_LEN + 1];
-        spin_lock_bh(&ar->data_lock);
+        mutex_lock(&ar->dump_mutex);
+        spin_lock_bh(&ar->data_lock);
        ar->stats.fw_crash_counter++;
+        spin_unlock_bh(&ar->data_lock);
        crash_data = ath10k_coredump_new(ar);
@@ -1756,11 +1761,18 @@ static void ath10k_pci_fw_crashed_dump(struct ath10k *ar)
        ath10k_ce_dump_registers(ar, crash_data);
        ath10k_pci_dump_memory(ar, crash_data);
-        spin_unlock_bh(&ar->data_lock);
+        mutex_unlock(&ar->dump_mutex);
        queue_work(ar->workqueue, &ar->restart_work);
 }
+static void ath10k_pci_fw_crashed_dump(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        queue_work(ar->workqueue, &ar_pci->dump_work);
+}
 void ath10k_pci_hif_send_complete_check(struct ath10k *ar, u8 pipe,
                                        int force)
 {
@@ -3442,6 +3454,8 @@ int ath10k_pci_setup_resource(struct ath10k *ar)
        spin_lock_init(&ar_pci->ps_lock);
        mutex_init(&ar_pci->ce_diag_mutex);
+        INIT_WORK(&ar_pci->dump_work, ath10k_pci_fw_dump_work);
        timer_setup(&ar_pci->rx_post_retry, ath10k_pci_rx_replenish_retry, 0);
        if (QCA_REV_6174(ar) || QCA_REV_9377(ar))
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index 3773c79f322f..4455ed6c5275 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -121,6 +121,8 @@ struct ath10k_pci {
        /* For protecting ce_diag */
        struct mutex ce_diag_mutex;
+        struct work_struct dump_work;
        struct ath10k_ce ce;
        struct timer_list rx_post_retry;
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
index fc915ecfb06e..17b34f6e4515 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
@@ -207,7 +207,7 @@ static const struct iwl_ht_params iwl_22000_ht_params = {
 #define IWL_DEVICE_AX210                                                \
        IWL_DEVICE_AX200_COMMON,                                        \
        .device_family = IWL_DEVICE_FAMILY_AX210,                       \
-        .base_params = &iwl_22000_base_params,                          \
+        .base_params = &iwl_22560_base_params,                          \
        .csr = &iwl_csr_v1,                                             \
        .min_txq_size = 128,                                            \
        .gp2_reg_addr = 0xd02c68,                                       \
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/5000.c b/drivers/net/wireless/intel/iwlwifi/cfg/5000.c
index 575a7022d045..3846064d51a5 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/5000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/5000.c
@@ -1,7 +1,7 @@
 /******************************************************************************
 *
 * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -136,6 +136,7 @@ const struct iwl_cfg iwl5350_agn_cfg = {
        .ht_params = &iwl5000_ht_params,
        .led_mode = IWL_LED_BLINK,
        .internal_wimax_coex = true,
+        .csr = &iwl_csr_v1,
 };
 #define IWL_DEVICE_5150                                         \
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index abfdcabdcbf7..cd622af90077 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -93,7 +93,7 @@ struct iwl_ucode_header {
        } u;
 };
-#define IWL_UCODE_INI_TLV_GROUP BIT(24)
+#define IWL_UCODE_INI_TLV_GROUP 0x1000000
 /*
 * new TLV uCode file layout
@@ -148,11 +148,14 @@ enum iwl_ucode_tlv_type {
        IWL_UCODE_TLV_UMAC_DEBUG_ADDRS  = 54,
        IWL_UCODE_TLV_LMAC_DEBUG_ADDRS  = 55,
        IWL_UCODE_TLV_FW_RECOVERY_INFO  = 57,
-        IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION    = IWL_UCODE_INI_TLV_GROUP | 0x1,
-        IWL_UCODE_TLV_TYPE_HCMD                 = IWL_UCODE_INI_TLV_GROUP | 0x2,
+        IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION    = IWL_UCODE_INI_TLV_GROUP + 0x1,
-        IWL_UCODE_TLV_TYPE_REGIONS              = IWL_UCODE_INI_TLV_GROUP | 0x3,
+        IWL_UCODE_TLV_DEBUG_BASE = IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION,
-        IWL_UCODE_TLV_TYPE_TRIGGERS             = IWL_UCODE_INI_TLV_GROUP | 0x4,
+        IWL_UCODE_TLV_TYPE_HCMD                 = IWL_UCODE_INI_TLV_GROUP + 0x2,
-        IWL_UCODE_TLV_TYPE_DEBUG_FLOW           = IWL_UCODE_INI_TLV_GROUP | 0x5,
+        IWL_UCODE_TLV_TYPE_REGIONS              = IWL_UCODE_INI_TLV_GROUP + 0x3,
+        IWL_UCODE_TLV_TYPE_TRIGGERS             = IWL_UCODE_INI_TLV_GROUP + 0x4,
+        IWL_UCODE_TLV_TYPE_DEBUG_FLOW           = IWL_UCODE_INI_TLV_GROUP + 0x5,
+        IWL_UCODE_TLV_DEBUG_MAX = IWL_UCODE_TLV_TYPE_DEBUG_FLOW,
        /* TLVs 0x1000-0x2000 are for internal driver usage */
        IWL_UCODE_TLV_FW_DBG_DUMP_LST   = 0x1000,
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
index 9107302cc444..0e8664375298 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -129,7 +129,8 @@ void iwl_alloc_dbg_tlv(struct iwl_trans *trans, size_t len, const u8 *data,
                len -= ALIGN(tlv_len, 4);
                data += sizeof(*tlv) + ALIGN(tlv_len, 4);
-                if (!(tlv_type & IWL_UCODE_INI_TLV_GROUP))
+                if (tlv_type < IWL_UCODE_TLV_DEBUG_BASE ||
+                    tlv_type > IWL_UCODE_TLV_DEBUG_MAX)
                        continue;
                hdr = (void *)&tlv->data[0];
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
index 9bf2407c9b4b..f043eefabb4e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
@@ -773,6 +773,11 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                return;
        mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
+        if (IS_ERR_OR_NULL(mvmvif->dbgfs_dir)) {
+                IWL_ERR(mvm, "Failed to create debugfs directory under %pd\n",
+                        dbgfs_dir);
+                return;
+        }
        if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM &&
            ((vif->type == NL80211_IFTYPE_STATION && !vif->p2p) ||
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 00a47f6f1d81..ab68b5d53ec9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1121,7 +1121,9 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
        ret = iwl_mvm_load_rt_fw(mvm);
        if (ret) {
                IWL_ERR(mvm, "Failed to start RT ucode: %d\n", ret);
-                iwl_fw_dbg_error_collect(&mvm->fwrt, FW_DBG_TRIGGER_DRIVER);
+                if (ret != -ERFKILL)
+                        iwl_fw_dbg_error_collect(&mvm->fwrt,
+                                                 FW_DBG_TRIGGER_DRIVER);
                goto error;
        }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 55d399899d1c..8da9e5572fcf 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -834,7 +834,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
        mutex_lock(&mvm->mutex);
        iwl_mvm_ref(mvm, IWL_MVM_REF_INIT_UCODE);
        err = iwl_run_init_mvm_ucode(mvm, true);
-        if (err)
+        if (err && err != -ERFKILL)
                iwl_fw_dbg_error_collect(&mvm->fwrt, FW_DBG_TRIGGER_DRIVER);
        if (!iwlmvm_mod_params.init_dbg || !err)
                iwl_mvm_stop_device(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 0b1b208de767..1824566d08fc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -169,9 +169,9 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
 }
 /* iwl_mvm_create_skb Adds the rxb to a new skb */
-static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
+static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
-                               u16 len, u8 crypt_len,
+                              struct ieee80211_hdr *hdr, u16 len, u8 crypt_len,
-                               struct iwl_rx_cmd_buffer *rxb)
+                              struct iwl_rx_cmd_buffer *rxb)
 {
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
@@ -204,6 +204,20 @@ static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
         * present before copying packet data.
         */
        hdrlen += crypt_len;
+        if (WARN_ONCE(headlen < hdrlen,
+                      "invalid packet lengths (hdrlen=%d, len=%d, crypt_len=%d)\n",
+                      hdrlen, len, crypt_len)) {
+                /*
+                 * We warn and trace because we want to be able to see
+                 * it in trace-cmd as well.
+                 */
+                IWL_DEBUG_RX(mvm,
+                             "invalid packet lengths (hdrlen=%d, len=%d, crypt_len=%d)\n",
+                             hdrlen, len, crypt_len);
+                return -EINVAL;
+        }
        skb_put_data(skb, hdr, hdrlen);
        skb_put_data(skb, (u8 *)hdr + hdrlen + pad_len, headlen - hdrlen);
@@ -216,6 +230,8 @@ static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
                skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,
                                fraglen, rxb->truesize);
        }
+        return 0;
 }
 static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,
@@ -1671,7 +1687,11 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
                        rx_status->boottime_ns = ktime_get_boot_ns();
        }
-        iwl_mvm_create_skb(skb, hdr, len, crypt_len, rxb);
+        if (iwl_mvm_create_skb(mvm, skb, hdr, len, crypt_len, rxb)) {
+                kfree_skb(skb);
+                goto out;
+        }
        if (!iwl_mvm_reorder(mvm, napi, queue, sta, skb, desc))
                iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue,
                                                sta, csi);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index c5baaae8d38e..cccb8bbd7ea7 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -3654,20 +3654,27 @@ out_no_pci:
 void iwl_trans_pcie_sync_nmi(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        unsigned long timeout = jiffies + IWL_TRANS_NMI_TIMEOUT;
+        u32 inta_addr, sw_err_bit;
+        if (trans_pcie->msix_enabled) {
+                inta_addr = CSR_MSIX_HW_INT_CAUSES_AD;
+                sw_err_bit = MSIX_HW_INT_CAUSES_REG_SW_ERR;
+        } else {
+                inta_addr = CSR_INT;
+                sw_err_bit = CSR_INT_BIT_SW_ERR;
+        }
        iwl_disable_interrupts(trans);
        iwl_force_nmi(trans);
        while (time_after(timeout, jiffies)) {
-                u32 inta_hw = iwl_read32(trans,
+                u32 inta_hw = iwl_read32(trans, inta_addr);
-                                         CSR_MSIX_HW_INT_CAUSES_AD);
                /* Error detected by uCode */
-                if (inta_hw & MSIX_HW_INT_CAUSES_REG_SW_ERR) {
+                if (inta_hw & sw_err_bit) {
                        /* Clear causes register */
-                        iwl_write32(trans, CSR_MSIX_HW_INT_CAUSES_AD,
+                        iwl_write32(trans, inta_addr, inta_hw & sw_err_bit);
-                                    inta_hw &
-                                    MSIX_HW_INT_CAUSES_REG_SW_ERR);
                        break;
                }
diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
index a85648342d15..d5a70340a945 100644
--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
@@ -181,7 +181,7 @@ static int mwifiex_sdio_resume(struct device *dev)
        adapter = card->adapter;
-        if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
+        if (!test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
                mwifiex_dbg(adapter, WARN,
                            "device already resumed\n");
                return 0;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 7c1b362f599a..766f5779db92 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -6262,8 +6262,7 @@ static int __init pci_setup(char *str)
                        } else if (!strncmp(str, "pcie_scan_all", 13)) {
                                pci_add_flags(PCI_SCAN_ALL_PCIE_DEVS);
                        } else if (!strncmp(str, "disable_acs_redir=", 18)) {
-                                disable_acs_redir_param =
+                                disable_acs_redir_param = str + 18;
-                                        kstrdup(str + 18, GFP_KERNEL);
                        } else {
                                printk(KERN_ERR "PCI: Unknown option `%s'\n",
                                                str);
@@ -6274,3 +6273,19 @@ static int __init pci_setup(char *str)
        return 0;
 }
 early_param("pci", pci_setup);
+/*
+ * 'disable_acs_redir_param' is initialized in pci_setup(), above, to point
+ * to data in the __initdata section which will be freed after the init
+ * sequence is complete. We can't allocate memory in pci_setup() because some
+ * architectures do not have any memory allocation service available during
+ * an early_param() call. So we allocate memory and copy the variable here
+ * before the init section is freed.
+ */
+static int __init pci_realloc_setup_params(void)
+{
+        disable_acs_redir_param = kstrdup(disable_acs_redir_param, GFP_KERNEL);
+        return 0;
+}
+pure_initcall(pci_realloc_setup_params);
diff --git a/drivers/pci/pcie/Kconfig b/drivers/pci/pcie/Kconfig
index 5cbdbca904ac..362eb8cfa53b 100644
--- a/drivers/pci/pcie/Kconfig
+++ b/drivers/pci/pcie/Kconfig
@@ -142,3 +142,11 @@ config PCIE_PTM
          This is only useful if you have devices that support PTM, but it
          is safe to enable even if you don't.
+config PCIE_BW
+        bool "PCI Express Bandwidth Change Notification"
+        depends on PCIEPORTBUS
+        help
+          This enables PCI Express Bandwidth Change Notification.  If
+          you know link width or rate changes occur only to correct
+          unreliable links, you may answer Y.
diff --git a/drivers/pci/pcie/Makefile b/drivers/pci/pcie/Makefile
index f1d7bc1e5efa..efb9d2e71e9e 100644
--- a/drivers/pci/pcie/Makefile
+++ b/drivers/pci/pcie/Makefile
@@ -3,7 +3,6 @@
 # Makefile for PCI Express features and port driver
 pcieportdrv-y                   := portdrv_core.o portdrv_pci.o err.o
-pcieportdrv-y                   += bw_notification.o
 obj-$(CONFIG_PCIEPORTBUS)       += pcieportdrv.o
@@ -13,3 +12,4 @@ obj-$(CONFIG_PCIEAER_INJECT)	+= aer_inject.o
 obj-$(CONFIG_PCIE_PME)          += pme.o
 obj-$(CONFIG_PCIE_DPC)          += dpc.o
 obj-$(CONFIG_PCIE_PTM)          += ptm.o
+obj-$(CONFIG_PCIE_BW)           += bw_notification.o
diff --git a/drivers/pci/pcie/portdrv.h b/drivers/pci/pcie/portdrv.h
index 1d50dc58ac40..944827a8c7d3 100644
--- a/drivers/pci/pcie/portdrv.h
+++ b/drivers/pci/pcie/portdrv.h
@@ -49,7 +49,11 @@ int pcie_dpc_init(void);
 static inline int pcie_dpc_init(void) { return 0; }
 #endif
+#ifdef CONFIG_PCIE_BW
 int pcie_bandwidth_notification_init(void);
+#else
+static inline int pcie_bandwidth_notification_init(void) { return 0; }
+#endif
 /* Port Type */
 #define PCIE_ANY_PORT                   (~0)
diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
index 7d04f9d087a6..1b330129089f 100644
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
@@ -55,7 +55,8 @@ static int pcie_message_numbers(struct pci_dev *dev, int mask,
         * 7.8.2, 7.10.10, 7.31.2.
         */
-        if (mask & (PCIE_PORT_SERVICE_PME | PCIE_PORT_SERVICE_HP)) {
+        if (mask & (PCIE_PORT_SERVICE_PME | PCIE_PORT_SERVICE_HP |
+                    PCIE_PORT_SERVICE_BWNOTIF)) {
                pcie_capability_read_word(dev, PCI_EXP_FLAGS, &reg16);
                *pme = (reg16 & PCI_EXP_FLAGS_IRQ) >> 9;
                nvec = *pme + 1;
diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c
index 08d5037fd052..6887870ba32c 100644
--- a/drivers/power/supply/cpcap-battery.c
+++ b/drivers/power/supply/cpcap-battery.c
@@ -221,6 +221,9 @@ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata,
        int avg_current;
        u32 cc_lsb;
+        if (!divider)
+                return 0;
        sample &= 0xffffff;             /* 24-bits, unsigned */
        offset &= 0x7ff;                /* 10-bits, signed */
diff --git a/drivers/power/supply/power_supply_sysfs.c b/drivers/power/supply/power_supply_sysfs.c
index dce24f596160..5358a80d854f 100644
--- a/drivers/power/supply/power_supply_sysfs.c
+++ b/drivers/power/supply/power_supply_sysfs.c
@@ -383,15 +383,11 @@ int power_supply_uevent(struct device *dev, struct kobj_uevent_env *env)
        char *prop_buf;
        char *attrname;
-        dev_dbg(dev, "uevent\n");
        if (!psy || !psy->desc) {
                dev_dbg(dev, "No power supply yet\n");
                return ret;
        }
-        dev_dbg(dev, "POWER_SUPPLY_NAME=%s\n", psy->desc->name);
        ret = add_uevent_var(env, "POWER_SUPPLY_NAME=%s", psy->desc->name);
        if (ret)
                return ret;
@@ -427,8 +423,6 @@ int power_supply_uevent(struct device *dev, struct kobj_uevent_env *env)
                        goto out;
                }
-                dev_dbg(dev, "prop %s=%s\n", attrname, prop_buf);
                ret = add_uevent_var(env, "POWER_SUPPLY_%s=%s", attrname, prop_buf);
                kfree(attrname);
                if (ret)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 8987cec9549d..ebcadaad89d1 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -473,11 +473,6 @@ static int usb_unbind_interface(struct device *dev)
                pm_runtime_disable(dev);
        pm_runtime_set_suspended(dev);
-        /* Undo any residual pm_autopm_get_interface_* calls */
-        for (r = atomic_read(&intf->pm_usage_cnt); r > 0; --r)
-                usb_autopm_put_interface_no_suspend(intf);
-        atomic_set(&intf->pm_usage_cnt, 0);
        if (!error)
                usb_autosuspend_device(udev);
@@ -1633,7 +1628,6 @@ void usb_autopm_put_interface(struct usb_interface *intf)
        int                     status;
        usb_mark_last_busy(udev);
-        atomic_dec(&intf->pm_usage_cnt);
        status = pm_runtime_put_sync(&intf->dev);
        dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
                        __func__, atomic_read(&intf->dev.power.usage_count),
@@ -1662,7 +1656,6 @@ void usb_autopm_put_interface_async(struct usb_interface *intf)
        int                     status;
        usb_mark_last_busy(udev);
-        atomic_dec(&intf->pm_usage_cnt);
        status = pm_runtime_put(&intf->dev);
        dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
                        __func__, atomic_read(&intf->dev.power.usage_count),
@@ -1684,7 +1677,6 @@ void usb_autopm_put_interface_no_suspend(struct usb_interface *intf)
        struct usb_device       *udev = interface_to_usbdev(intf);
        usb_mark_last_busy(udev);
-        atomic_dec(&intf->pm_usage_cnt);
        pm_runtime_put_noidle(&intf->dev);
 }
 EXPORT_SYMBOL_GPL(usb_autopm_put_interface_no_suspend);
@@ -1715,8 +1707,6 @@ int usb_autopm_get_interface(struct usb_interface *intf)
        status = pm_runtime_get_sync(&intf->dev);
        if (status < 0)
                pm_runtime_put_sync(&intf->dev);
-        else
-                atomic_inc(&intf->pm_usage_cnt);
        dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
                        __func__, atomic_read(&intf->dev.power.usage_count),
                        status);
@@ -1750,8 +1740,6 @@ int usb_autopm_get_interface_async(struct usb_interface *intf)
        status = pm_runtime_get(&intf->dev);
        if (status < 0 && status != -EINPROGRESS)
                pm_runtime_put_noidle(&intf->dev);
-        else
-                atomic_inc(&intf->pm_usage_cnt);
        dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
                        __func__, atomic_read(&intf->dev.power.usage_count),
                        status);
@@ -1775,7 +1763,6 @@ void usb_autopm_get_interface_no_resume(struct usb_interface *intf)
        struct usb_device       *udev = interface_to_usbdev(intf);
        usb_mark_last_busy(udev);
-        atomic_inc(&intf->pm_usage_cnt);
        pm_runtime_get_noresume(&intf->dev);
 }
 EXPORT_SYMBOL_GPL(usb_autopm_get_interface_no_resume);
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 82239f27c4cc..e844bb7b5676 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -820,9 +820,11 @@ int usb_string(struct usb_device *dev, int index, char *buf, size_t size)
        if (dev->state == USB_STATE_SUSPENDED)
                return -EHOSTUNREACH;
-        if (size <= 0 || !buf || !index)
+        if (size <= 0 || !buf)
                return -EINVAL;
        buf[0] = 0;
+        if (index <= 0 || index >= 256)
+                return -EINVAL;
        tbuf = kmalloc(256, GFP_NOIO);
        if (!tbuf)
                return -ENOMEM;
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index baf72f95f0f1..213b52508621 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -979,8 +979,18 @@ static int dummy_udc_start(struct usb_gadget *g,
        struct dummy_hcd        *dum_hcd = gadget_to_dummy_hcd(g);
        struct dummy            *dum = dum_hcd->dum;
-        if (driver->max_speed == USB_SPEED_UNKNOWN)
+        switch (g->speed) {
+        /* All the speeds we support */
+        case USB_SPEED_LOW:
+        case USB_SPEED_FULL:
+        case USB_SPEED_HIGH:
+        case USB_SPEED_SUPER:
+                break;
+        default:
+                dev_err(dummy_dev(dum_hcd), "Unsupported driver max speed %d\n",
+                                driver->max_speed);
                return -EINVAL;
+        }
        /*
         * SLAVE side init ... the layer above hardware, which
@@ -1784,9 +1794,10 @@ static void dummy_timer(struct timer_list *t)
                /* Bus speed is 500000 bytes/ms, so use a little less */
                total = 490000;
                break;
-        default:
+        default:        /* Can't happen */
                dev_err(dummy_dev(dum_hcd), "bogus device speed\n");
-                return;
+                total = 0;
+                break;
        }
        /* FIXME if HZ != 1000 this will probably misbehave ... */
@@ -1828,7 +1839,7 @@ restart:
                /* Used up this frame's bandwidth? */
                if (total <= 0)
-                        break;
+                        continue;
                /* find the gadget's ep for this request (if configured) */
                address = usb_pipeendpoint (urb->pipe);
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 6d9fd5f64903..7b306aa22d25 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -314,6 +314,7 @@ static void yurex_disconnect(struct usb_interface *interface)
        usb_deregister_dev(interface, &yurex_class);
        /* prevent more I/O from starting */
+        usb_poison_urb(dev->urb);
        mutex_lock(&dev->io_mutex);
        dev->interface = NULL;
        mutex_unlock(&dev->io_mutex);
diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index 31b024441938..cc794e25a0b6 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -763,18 +763,16 @@ static void rts51x_suspend_timer_fn(struct timer_list *t)
                break;
        case RTS51X_STAT_IDLE:
        case RTS51X_STAT_SS:
-                usb_stor_dbg(us, "RTS51X_STAT_SS, intf->pm_usage_cnt:%d, power.usage:%d\n",
+                usb_stor_dbg(us, "RTS51X_STAT_SS, power.usage:%d\n",
-                             atomic_read(&us->pusb_intf->pm_usage_cnt),
                             atomic_read(&us->pusb_intf->dev.power.usage_count));
-                if (atomic_read(&us->pusb_intf->pm_usage_cnt) > 0) {
+                if (atomic_read(&us->pusb_intf->dev.power.usage_count) > 0) {
                        usb_stor_dbg(us, "Ready to enter SS state\n");
                        rts51x_set_stat(chip, RTS51X_STAT_SS);
                        /* ignore mass storage interface's children */
                        pm_suspend_ignore_children(&us->pusb_intf->dev, true);
                        usb_autopm_put_interface_async(us->pusb_intf);
-                        usb_stor_dbg(us, "RTS51X_STAT_SS 01, intf->pm_usage_cnt:%d, power.usage:%d\n",
+                        usb_stor_dbg(us, "RTS51X_STAT_SS 01, power.usage:%d\n",
-                                     atomic_read(&us->pusb_intf->pm_usage_cnt),
                                     atomic_read(&us->pusb_intf->dev.power.usage_count));
                }
                break;
@@ -807,11 +805,10 @@ static void rts51x_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
        int ret;
        if (working_scsi(srb)) {
-                usb_stor_dbg(us, "working scsi, intf->pm_usage_cnt:%d, power.usage:%d\n",
+                usb_stor_dbg(us, "working scsi, power.usage:%d\n",
-                             atomic_read(&us->pusb_intf->pm_usage_cnt),
                             atomic_read(&us->pusb_intf->dev.power.usage_count));
-                if (atomic_read(&us->pusb_intf->pm_usage_cnt) <= 0) {
+                if (atomic_read(&us->pusb_intf->dev.power.usage_count) <= 0) {
                        ret = usb_autopm_get_interface(us->pusb_intf);
                        usb_stor_dbg(us, "working scsi, ret=%d\n", ret);
                }
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 97b09a42a10c..dbfb2f24d71e 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -361,16 +361,10 @@ static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
        }
        if (usb_endpoint_xfer_isoc(epd)) {
-                /* validate packet size and number of packets */
+                /* validate number of packets */
-                unsigned int maxp, packets, bytes;
-                maxp = usb_endpoint_maxp(epd);
-                maxp *= usb_endpoint_maxp_mult(epd);
-                bytes = pdu->u.cmd_submit.transfer_buffer_length;
-                packets = DIV_ROUND_UP(bytes, maxp);
                if (pdu->u.cmd_submit.number_of_packets < 0 ||
-                    pdu->u.cmd_submit.number_of_packets > packets) {
+                    pdu->u.cmd_submit.number_of_packets >
+                    USBIP_MAX_ISO_PACKETS) {
                        dev_err(&sdev->udev->dev,
                                "CMD_SUBMIT: isoc invalid num packets %d\n",
                                pdu->u.cmd_submit.number_of_packets);
diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index bf8afe9b5883..8be857a4fa13 100644
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -121,6 +121,13 @@ extern struct device_attribute dev_attr_usbip_debug;
 #define USBIP_DIR_OUT   0x00
 #define USBIP_DIR_IN    0x01
+/*
+ * Arbitrary limit for the maximum number of isochronous packets in an URB,
+ * compare for example the uhci_submit_isochronous function in
+ * drivers/usb/host/uhci-q.c
+ */
+#define USBIP_MAX_ISO_PACKETS 1024
 /**
 * struct usbip_header_basic - data pertinent to every request
 * @command: the usbip request type
diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c
index 0f4ecfcdb549..a9fb77585272 100644
--- a/drivers/w1/masters/ds2490.c
+++ b/drivers/w1/masters/ds2490.c
@@ -1016,15 +1016,15 @@ static int ds_probe(struct usb_interface *intf,
        /* alternative 3, 1ms interrupt (greatly speeds search), 64 byte bulk */
        alt = 3;
        err = usb_set_interface(dev->udev,
-                intf->altsetting[alt].desc.bInterfaceNumber, alt);
+                intf->cur_altsetting->desc.bInterfaceNumber, alt);
        if (err) {
                dev_err(&dev->udev->dev, "Failed to set alternative setting %d "
                        "for %d interface: err=%d.\n", alt,
-                        intf->altsetting[alt].desc.bInterfaceNumber, err);
+                        intf->cur_altsetting->desc.bInterfaceNumber, err);
                goto err_out_clear;
        }
-        iface_desc = &intf->altsetting[alt];
+        iface_desc = intf->cur_altsetting;
        if (iface_desc->desc.bNumEndpoints != NUM_EP-1) {
                pr_info("Num endpoints=%d. It is not DS9490R.\n",
                        iface_desc->desc.bNumEndpoints);