140 files changed, 1412 insertions, 710 deletions
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 4c35f0822d06..23dac3babfe3 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4204,9 +4204,18 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
        /* devices that don't properly handle queued TRIM commands */
-        { "Micron_M[56]*",              NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Crucial_CT*M500*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Micron_M5[15]0*",            "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Crucial_CT*M550*",           "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Crucial_CT*MX100*",          "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Samsung SSD 850 PRO*",       NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
-        { "Crucial_CT*SSD*",            NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
        /*
         * As defined, the DRAT (Deterministic Read After Trim) and RZAT
@@ -4226,6 +4235,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         */
        { "INTEL*SSDSC2MH*",            NULL,   0, },
+        { "Micron*",                    NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Crucial*",                   NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
        { "INTEL*SSD*",                 NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
        { "SSD*INTEL*",                 NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
        { "Samsung*SSD*",               NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
@@ -4737,7 +4748,7 @@ struct ata_queued_cmd *ata_qc_new_init(struct ata_device *dev, int tag)
                return NULL;
        /* libsas case */
-        if (!ap->scsi_host) {
+        if (ap->flags & ATA_FLAG_SAS_HOST) {
                tag = ata_sas_allocate_tag(ap);
                if (tag < 0)
                        return NULL;
@@ -4776,7 +4787,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
        tag = qc->tag;
        if (likely(ata_tag_valid(tag))) {
                qc->tag = ATA_TAG_POISON;
-                if (!ap->scsi_host)
+                if (ap->flags & ATA_FLAG_SAS_HOST)
                        ata_sas_free_tag(tag, ap);
        }
 }
diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index beb8b27d4621..a13587b5c2be 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -243,4 +243,12 @@ extern struct regcache_ops regcache_rbtree_ops;
 extern struct regcache_ops regcache_lzo_ops;
 extern struct regcache_ops regcache_flat_ops;
+static inline const char *regmap_name(const struct regmap *map)
+{
+        if (map->dev)
+                return dev_name(map->dev);
+        return map->name;
+}
 #endif
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index da84f544c544..87db9893b463 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -218,7 +218,7 @@ int regcache_read(struct regmap *map,
                ret = map->cache_ops->read(map, reg, value);
                if (ret == 0)
-                        trace_regmap_reg_read_cache(map->dev, reg, *value);
+                        trace_regmap_reg_read_cache(map, reg, *value);
                return ret;
        }
@@ -311,7 +311,7 @@ int regcache_sync(struct regmap *map)
        dev_dbg(map->dev, "Syncing %s cache\n",
                map->cache_ops->name);
        name = map->cache_ops->name;
-        trace_regcache_sync(map->dev, name, "start");
+        trace_regcache_sync(map, name, "start");
        if (!map->cache_dirty)
                goto out;
@@ -346,7 +346,7 @@ out:
        regmap_async_complete(map);
-        trace_regcache_sync(map->dev, name, "stop");
+        trace_regcache_sync(map, name, "stop");
        return ret;
 }
@@ -381,7 +381,7 @@ int regcache_sync_region(struct regmap *map, unsigned int min,
        name = map->cache_ops->name;
        dev_dbg(map->dev, "Syncing %s cache from %d-%d\n", name, min, max);
-        trace_regcache_sync(map->dev, name, "start region");
+        trace_regcache_sync(map, name, "start region");
        if (!map->cache_dirty)
                goto out;
@@ -401,7 +401,7 @@ out:
        regmap_async_complete(map);
-        trace_regcache_sync(map->dev, name, "stop region");
+        trace_regcache_sync(map, name, "stop region");
        return ret;
 }
@@ -428,7 +428,7 @@ int regcache_drop_region(struct regmap *map, unsigned int min,
        map->lock(map->lock_arg);
-        trace_regcache_drop_region(map->dev, min, max);
+        trace_regcache_drop_region(map, min, max);
        ret = map->cache_ops->drop(map, min, max);
@@ -455,7 +455,7 @@ void regcache_cache_only(struct regmap *map, bool enable)
        map->lock(map->lock_arg);
        WARN_ON(map->cache_bypass && enable);
        map->cache_only = enable;
-        trace_regmap_cache_only(map->dev, enable);
+        trace_regmap_cache_only(map, enable);
        map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_only);
@@ -493,7 +493,7 @@ void regcache_cache_bypass(struct regmap *map, bool enable)
        map->lock(map->lock_arg);
        WARN_ON(map->cache_only && enable);
        map->cache_bypass = enable;
-        trace_regmap_cache_bypass(map->dev, enable);
+        trace_regmap_cache_bypass(map, enable);
        map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_bypass);
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index f99b098ddabf..dbfe6a69c3da 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1281,7 +1281,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
        if (map->async && map->bus->async_write) {
                struct regmap_async *async;
-                trace_regmap_async_write_start(map->dev, reg, val_len);
+                trace_regmap_async_write_start(map, reg, val_len);
                spin_lock_irqsave(&map->async_lock, flags);
                async = list_first_entry_or_null(&map->async_free,
@@ -1339,8 +1339,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                return ret;
        }
-        trace_regmap_hw_write_start(map->dev, reg,
+        trace_regmap_hw_write_start(map, reg, val_len / map->format.val_bytes);
-                                    val_len / map->format.val_bytes);
        /* If we're doing a single register write we can probably just
         * send the work_buf directly, otherwise try to do a gather
@@ -1372,8 +1371,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                kfree(buf);
        }
-        trace_regmap_hw_write_done(map->dev, reg,
+        trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
-                                   val_len / map->format.val_bytes);
        return ret;
 }
@@ -1407,12 +1405,12 @@ static int _regmap_bus_formatted_write(void *context, unsigned int reg,
        map->format.format_write(map, reg, val);
-        trace_regmap_hw_write_start(map->dev, reg, 1);
+        trace_regmap_hw_write_start(map, reg, 1);
        ret = map->bus->write(map->bus_context, map->work_buf,
                              map->format.buf_size);
-        trace_regmap_hw_write_done(map->dev, reg, 1);
+        trace_regmap_hw_write_done(map, reg, 1);
        return ret;
 }
@@ -1470,7 +1468,7 @@ int _regmap_write(struct regmap *map, unsigned int reg,
                dev_info(map->dev, "%x <= %x\n", reg, val);
 #endif
-        trace_regmap_reg_write(map->dev, reg, val);
+        trace_regmap_reg_write(map, reg, val);
        return map->reg_write(context, reg, val);
 }
@@ -1773,7 +1771,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
        for (i = 0; i < num_regs; i++) {
                int reg = regs[i].reg;
                int val = regs[i].def;
-                trace_regmap_hw_write_start(map->dev, reg, 1);
+                trace_regmap_hw_write_start(map, reg, 1);
                map->format.format_reg(u8, reg, map->reg_shift);
                u8 += reg_bytes + pad_bytes;
                map->format.format_val(u8, val, 0);
@@ -1788,7 +1786,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
        for (i = 0; i < num_regs; i++) {
                int reg = regs[i].reg;
-                trace_regmap_hw_write_done(map->dev, reg, 1);
+                trace_regmap_hw_write_done(map, reg, 1);
        }
        return ret;
 }
@@ -2059,15 +2057,13 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
         */
        u8[0] |= map->read_flag_mask;
-        trace_regmap_hw_read_start(map->dev, reg,
+        trace_regmap_hw_read_start(map, reg, val_len / map->format.val_bytes);
-                                   val_len / map->format.val_bytes);
        ret = map->bus->read(map->bus_context, map->work_buf,
                             map->format.reg_bytes + map->format.pad_bytes,
                             val, val_len);
-        trace_regmap_hw_read_done(map->dev, reg,
+        trace_regmap_hw_read_done(map, reg, val_len / map->format.val_bytes);
-                                  val_len / map->format.val_bytes);
        return ret;
 }
@@ -2123,7 +2119,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
                        dev_info(map->dev, "%x => %x\n", reg, *val);
 #endif
-                trace_regmap_reg_read(map->dev, reg, *val);
+                trace_regmap_reg_read(map, reg, *val);
                if (!map->cache_bypass)
                        regcache_write(map, reg, *val);
@@ -2480,7 +2476,7 @@ void regmap_async_complete_cb(struct regmap_async *async, int ret)
        struct regmap *map = async->map;
        bool wake;
-        trace_regmap_async_io_complete(map->dev);
+        trace_regmap_async_io_complete(map);
        spin_lock(&map->async_lock);
        list_move(&async->list, &map->async_free);
@@ -2525,7 +2521,7 @@ int regmap_async_complete(struct regmap *map)
        if (!map->bus || !map->bus->async_write)
                return 0;
-        trace_regmap_async_complete_start(map->dev);
+        trace_regmap_async_complete_start(map);
        wait_event(map->async_waitq, regmap_async_is_done(map));
@@ -2534,7 +2530,7 @@ int regmap_async_complete(struct regmap *map)
        map->async_ret = 0;
        spin_unlock_irqrestore(&map->async_lock, flags);
-        trace_regmap_async_complete_done(map->dev);
+        trace_regmap_async_complete_done(map);
        return ret;
 }
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 4bc2a5cb9935..a98c41f72c63 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -803,10 +803,6 @@ static int __init nbd_init(void)
                return -EINVAL;
        }
-        nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
-        if (!nbd_dev)
-                return -ENOMEM;
        part_shift = 0;
        if (max_part > 0) {
                part_shift = fls(max_part);
@@ -828,6 +824,10 @@ static int __init nbd_init(void)
        if (nbds_max > 1UL << (MINORBITS - part_shift))
                return -EINVAL;
+        nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
+        if (!nbd_dev)
+                return -ENOMEM;
        for (i = 0; i < nbds_max; i++) {
                struct gendisk *disk = alloc_disk(1 << part_shift);
                if (!disk)
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index ceb32dd52a6c..e23be20a3417 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -3003,6 +3003,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        }
        get_device(dev->device);
+        INIT_LIST_HEAD(&dev->node);
        INIT_WORK(&dev->probe_work, nvme_async_probe);
        schedule_work(&dev->probe_work);
        return 0;
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 68161f7a07d6..a0b036ccb118 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -192,6 +192,7 @@ config SYS_SUPPORTS_EM_STI
 config SH_TIMER_CMT
        bool "Renesas CMT timer driver" if COMPILE_TEST
        depends on GENERIC_CLOCKEVENTS
+        depends on HAS_IOMEM
        default SYS_SUPPORTS_SH_CMT
        help
          This enables build of a clocksource and clockevent driver for
@@ -201,6 +202,7 @@ config SH_TIMER_CMT
 config SH_TIMER_MTU2
        bool "Renesas MTU2 timer driver" if COMPILE_TEST
        depends on GENERIC_CLOCKEVENTS
+        depends on HAS_IOMEM
        default SYS_SUPPORTS_SH_MTU2
        help
          This enables build of a clockevent driver for the Multi-Function
@@ -210,6 +212,7 @@ config SH_TIMER_MTU2
 config SH_TIMER_TMU
        bool "Renesas TMU timer driver" if COMPILE_TEST
        depends on GENERIC_CLOCKEVENTS
+        depends on HAS_IOMEM
        default SYS_SUPPORTS_SH_TMU
        help
          This enables build of a clocksource and clockevent driver for
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 5dcbf90b8015..58597fbcc046 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -17,7 +17,6 @@
 #include <linux/irq.h>
 #include <linux/irqreturn.h>
 #include <linux/reset.h>
-#include <linux/sched_clock.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
@@ -137,11 +136,6 @@ static struct irqaction sun5i_timer_irq = {
        .dev_id = &sun5i_clockevent,
 };
-static u64 sun5i_timer_sched_read(void)
-{
-        return ~readl(timer_base + TIMER_CNTVAL_LO_REG(1));
-}
 static void __init sun5i_timer_init(struct device_node *node)
 {
        struct reset_control *rstc;
@@ -172,7 +166,6 @@ static void __init sun5i_timer_init(struct device_node *node)
        writel(TIMER_CTL_ENABLE | TIMER_CTL_RELOAD,
               timer_base + TIMER_CTL_REG(1));
-        sched_clock_register(sun5i_timer_sched_read, 32, rate);
        clocksource_mmio_init(timer_base + TIMER_CNTVAL_LO_REG(1), node->name,
                              rate, 340, 32, clocksource_mmio_readl_down);
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 0723096fb50a..c92d6a70ccf3 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -475,6 +475,7 @@ static int bcm2835_dma_terminate_all(struct dma_chan *chan)
         * c->desc is NULL and exit.)
         */
        if (c->desc) {
+                bcm2835_dma_desc_free(&c->desc->vd);
                c->desc = NULL;
                bcm2835_dma_abort(c->chan_base);
diff --git a/drivers/dma/dma-jz4740.c b/drivers/dma/dma-jz4740.c
index 4527a3ebeac4..84884418fd30 100644
--- a/drivers/dma/dma-jz4740.c
+++ b/drivers/dma/dma-jz4740.c
@@ -511,6 +511,9 @@ static void jz4740_dma_desc_free(struct virt_dma_desc *vdesc)
        kfree(container_of(vdesc, struct jz4740_dma_desc, vdesc));
 }
+#define JZ4740_DMA_BUSWIDTHS (BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | \
+        BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | BIT(DMA_SLAVE_BUSWIDTH_4_BYTES))
 static int jz4740_dma_probe(struct platform_device *pdev)
 {
        struct jz4740_dmaengine_chan *chan;
@@ -548,6 +551,10 @@ static int jz4740_dma_probe(struct platform_device *pdev)
        dd->device_prep_dma_cyclic = jz4740_dma_prep_dma_cyclic;
        dd->device_config = jz4740_dma_slave_config;
        dd->device_terminate_all = jz4740_dma_terminate_all;
+        dd->src_addr_widths = JZ4740_DMA_BUSWIDTHS;
+        dd->dst_addr_widths = JZ4740_DMA_BUSWIDTHS;
+        dd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+        dd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
        dd->dev = &pdev->dev;
        INIT_LIST_HEAD(&dd->channels);
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 276157f22612..53dbd3b3384c 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -260,6 +260,13 @@ static int edma_terminate_all(struct dma_chan *chan)
         */
        if (echan->edesc) {
                int cyclic = echan->edesc->cyclic;
+                /*
+                 * free the running request descriptor
+                 * since it is not in any of the vdesc lists
+                 */
+                edma_desc_free(&echan->edesc->vdesc);
                echan->edesc = NULL;
                edma_stop(echan->ch_num);
                /* Move the cyclic channel back to default queue */
diff --git a/drivers/dma/moxart-dma.c b/drivers/dma/moxart-dma.c
index 15cab7d79525..b4634109e010 100644
--- a/drivers/dma/moxart-dma.c
+++ b/drivers/dma/moxart-dma.c
@@ -193,8 +193,10 @@ static int moxart_terminate_all(struct dma_chan *chan)
        spin_lock_irqsave(&ch->vc.lock, flags);
-        if (ch->desc)
+        if (ch->desc) {
+                moxart_dma_desc_free(&ch->desc->vd);
                ch->desc = NULL;
+        }
        ctrl = readl(ch->base + REG_OFF_CTRL);
        ctrl &= ~(APB_DMA_ENABLE | APB_DMA_FIN_INT_EN | APB_DMA_ERR_INT_EN);
diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
index 7dd6dd121681..167dbaf65742 100644
--- a/drivers/dma/omap-dma.c
+++ b/drivers/dma/omap-dma.c
@@ -981,6 +981,7 @@ static int omap_dma_terminate_all(struct dma_chan *chan)
         * c->desc is NULL and exit.)
         */
        if (c->desc) {
+                omap_dma_desc_free(&c->desc->vd);
                c->desc = NULL;
                /* Avoid stopping the dma twice */
                if (!c->paused)
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 69fac068669f..2eebd28b4c40 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -86,10 +86,13 @@ static void dmi_table(u8 *buf, u32 len, int num,
        int i = 0;
        /*
-         *      Stop when we see all the items the table claimed to have
+         * Stop when we have seen all the items the table claimed to have
-         *      OR we run off the end of the table (also happens)
+         * (SMBIOS < 3.0 only) OR we reach an end-of-table marker OR we run
+         * off the end of the table (should never happen but sometimes does
+         * on bogus implementations.)
         */
-        while ((i < num) && (data - buf + sizeof(struct dmi_header)) <= len) {
+        while ((!num || i < num) &&
+               (data - buf + sizeof(struct dmi_header)) <= len) {
                const struct dmi_header *dm = (const struct dmi_header *)data;
                /*
@@ -529,21 +532,10 @@ static int __init dmi_smbios3_present(const u8 *buf)
        if (memcmp(buf, "_SM3_", 5) == 0 &&
            buf[6] < 32 && dmi_checksum(buf, buf[6])) {
                dmi_ver = get_unaligned_be16(buf + 7);
+                dmi_num = 0;                    /* No longer specified */
                dmi_len = get_unaligned_le32(buf + 12);
                dmi_base = get_unaligned_le64(buf + 16);
-                /*
-                 * The 64-bit SMBIOS 3.0 entry point no longer has a field
-                 * containing the number of structures present in the table.
-                 * Instead, it defines the table size as a maximum size, and
-                 * relies on the end-of-table structure type (#127) to be used
-                 * to signal the end of the table.
-                 * So let's define dmi_num as an upper bound as well: each
-                 * structure has a 4 byte header, so dmi_len / 4 is an upper
-                 * bound for the number of structures in the table.
-                 */
-                dmi_num = dmi_len / 4;
                if (dmi_walk_early(dmi_decode) == 0) {
                        pr_info("SMBIOS %d.%d present.\n",
                                dmi_ver >> 8, dmi_ver & 0xFF);
diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index a6952ba343a8..a65b75161aa4 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -334,7 +334,7 @@ static struct irq_domain_ops mpc8xxx_gpio_irq_ops = {
        .xlate  = irq_domain_xlate_twocell,
 };
-static struct of_device_id mpc8xxx_gpio_ids[] __initdata = {
+static struct of_device_id mpc8xxx_gpio_ids[] = {
        { .compatible = "fsl,mpc8349-gpio", },
        { .compatible = "fsl,mpc8572-gpio", },
        { .compatible = "fsl,mpc8610-gpio", },
diff --git a/drivers/gpio/gpio-syscon.c b/drivers/gpio/gpio-syscon.c
index 257e2989215c..045a952576c7 100644
--- a/drivers/gpio/gpio-syscon.c
+++ b/drivers/gpio/gpio-syscon.c
@@ -219,7 +219,7 @@ static int syscon_gpio_probe(struct platform_device *pdev)
                ret = of_property_read_u32_index(np, "gpio,syscon-dev", 2,
                                                 &priv->dir_reg_offset);
                if (ret)
-                        dev_err(dev, "can't read the dir register offset!\n");
+                        dev_dbg(dev, "can't read the dir register offset!\n");
                priv->dir_reg_offset <<= 3;
        }
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index c0929d938ced..df990f29757a 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -201,6 +201,10 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
        if (!handler)
                return AE_BAD_PARAMETER;
+        pin = acpi_gpiochip_pin_to_gpio_offset(chip, pin);
+        if (pin < 0)
+                return AE_BAD_PARAMETER;
        desc = gpiochip_request_own_desc(chip, pin, "ACPI:Event");
        if (IS_ERR(desc)) {
                dev_err(chip->dev, "Failed to request GPIO\n");
@@ -551,6 +555,12 @@ acpi_gpio_adr_space_handler(u32 function, acpi_physical_address address,
                struct gpio_desc *desc;
                bool found;
+                pin = acpi_gpiochip_pin_to_gpio_offset(chip, pin);
+                if (pin < 0) {
+                        status = AE_BAD_PARAMETER;
+                        goto out;
+                }
                mutex_lock(&achip->conn_lock);
                found = false;
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index f6d04c7b5115..679b10e34fb5 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -525,17 +525,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
 }
 EXPORT_SYMBOL(drm_framebuffer_reference);
-static void drm_framebuffer_free_bug(struct kref *kref)
-{
-        BUG();
-}
-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
-{
-        DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
-        kref_put(&fb->refcount, drm_framebuffer_free_bug);
-}
 /**
 * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
 * @fb: fb to unregister
@@ -1320,7 +1309,7 @@ void drm_plane_force_disable(struct drm_plane *plane)
                return;
        }
        /* disconnect the plane from the fb and crtc: */
-        __drm_framebuffer_unreference(plane->old_fb);
+        drm_framebuffer_unreference(plane->old_fb);
        plane->old_fb = NULL;
        plane->fb = NULL;
        plane->crtc = NULL;
diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c
index 732cb6f8e653..4c0aa97aaf03 100644
--- a/drivers/gpu/drm/drm_edid_load.c
+++ b/drivers/gpu/drm/drm_edid_load.c
@@ -287,6 +287,7 @@ int drm_load_edid_firmware(struct drm_connector *connector)
        drm_mode_connector_update_edid_property(connector, edid);
        ret = drm_add_edid_modes(connector, edid);
+        drm_edid_to_eld(connector, edid);
        kfree(edid);
        return ret;
diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
index 6591d48c1b9d..3fee587bc284 100644
--- a/drivers/gpu/drm/drm_probe_helper.c
+++ b/drivers/gpu/drm/drm_probe_helper.c
@@ -174,6 +174,7 @@ static int drm_helper_probe_single_connector_modes_merge_bits(struct drm_connect
                        struct edid *edid = (struct edid *) connector->edid_blob_ptr->data;
                        count = drm_add_edid_modes(connector, edid);
+                        drm_edid_to_eld(connector, edid);
                } else
                        count = (*connector_funcs->get_modes)(connector);
        }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index c300e22da8ac..33a10ce967ea 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -147,6 +147,7 @@ struct fimd_win_data {
        unsigned int            ovl_height;
        unsigned int            fb_width;
        unsigned int            fb_height;
+        unsigned int            fb_pitch;
        unsigned int            bpp;
        unsigned int            pixel_format;
        dma_addr_t              dma_addr;
@@ -532,13 +533,14 @@ static void fimd_win_mode_set(struct exynos_drm_crtc *crtc,
        win_data->offset_y = plane->crtc_y;
        win_data->ovl_width = plane->crtc_width;
        win_data->ovl_height = plane->crtc_height;
+        win_data->fb_pitch = plane->pitch;
        win_data->fb_width = plane->fb_width;
        win_data->fb_height = plane->fb_height;
        win_data->dma_addr = plane->dma_addr[0] + offset;
        win_data->bpp = plane->bpp;
        win_data->pixel_format = plane->pixel_format;
-        win_data->buf_offsize = (plane->fb_width - plane->crtc_width) *
+        win_data->buf_offsize =
-                                (plane->bpp >> 3);
+                plane->pitch - (plane->crtc_width * (plane->bpp >> 3));
        win_data->line_size = plane->crtc_width * (plane->bpp >> 3);
        DRM_DEBUG_KMS("offset_x = %d, offset_y = %d\n",
@@ -704,7 +706,7 @@ static void fimd_win_commit(struct exynos_drm_crtc *crtc, int zpos)
        writel(val, ctx->regs + VIDWx_BUF_START(win, 0));
        /* buffer end address */
-        size = win_data->fb_width * win_data->ovl_height * (win_data->bpp >> 3);
+        size = win_data->fb_pitch * win_data->ovl_height * (win_data->bpp >> 3);
        val = (unsigned long)(win_data->dma_addr + size);
        writel(val, ctx->regs + VIDWx_BUF_END(win, 0));
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 3518bc4654c5..2e3bc57ea50e 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -55,6 +55,7 @@ struct hdmi_win_data {
        unsigned int            fb_x;
        unsigned int            fb_y;
        unsigned int            fb_width;
+        unsigned int            fb_pitch;
        unsigned int            fb_height;
        unsigned int            src_width;
        unsigned int            src_height;
@@ -438,7 +439,7 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
        } else {
                luma_addr[0] = win_data->dma_addr;
                chroma_addr[0] = win_data->dma_addr
-                        + (win_data->fb_width * win_data->fb_height);
+                        + (win_data->fb_pitch * win_data->fb_height);
        }
        if (win_data->scan_flags & DRM_MODE_FLAG_INTERLACE) {
@@ -447,8 +448,8 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
                        luma_addr[1] = luma_addr[0] + 0x40;
                        chroma_addr[1] = chroma_addr[0] + 0x40;
                } else {
-                        luma_addr[1] = luma_addr[0] + win_data->fb_width;
+                        luma_addr[1] = luma_addr[0] + win_data->fb_pitch;
-                        chroma_addr[1] = chroma_addr[0] + win_data->fb_width;
+                        chroma_addr[1] = chroma_addr[0] + win_data->fb_pitch;
                }
        } else {
                ctx->interlace = false;
@@ -469,10 +470,10 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
        vp_reg_writemask(res, VP_MODE, val, VP_MODE_FMT_MASK);
        /* setting size of input image */
-        vp_reg_write(res, VP_IMG_SIZE_Y, VP_IMG_HSIZE(win_data->fb_width) |
+        vp_reg_write(res, VP_IMG_SIZE_Y, VP_IMG_HSIZE(win_data->fb_pitch) |
                VP_IMG_VSIZE(win_data->fb_height));
        /* chroma height has to reduced by 2 to avoid chroma distorions */
-        vp_reg_write(res, VP_IMG_SIZE_C, VP_IMG_HSIZE(win_data->fb_width) |
+        vp_reg_write(res, VP_IMG_SIZE_C, VP_IMG_HSIZE(win_data->fb_pitch) |
                VP_IMG_VSIZE(win_data->fb_height / 2));
        vp_reg_write(res, VP_SRC_WIDTH, win_data->src_width);
@@ -559,7 +560,7 @@ static void mixer_graph_buffer(struct mixer_context *ctx, int win)
        /* converting dma address base and source offset */
        dma_addr = win_data->dma_addr
                + (win_data->fb_x * win_data->bpp >> 3)
-                + (win_data->fb_y * win_data->fb_width * win_data->bpp >> 3);
+                + (win_data->fb_y * win_data->fb_pitch);
        src_x_offset = 0;
        src_y_offset = 0;
@@ -576,7 +577,8 @@ static void mixer_graph_buffer(struct mixer_context *ctx, int win)
                MXR_GRP_CFG_FORMAT_VAL(fmt), MXR_GRP_CFG_FORMAT_MASK);
        /* setup geometry */
-        mixer_reg_write(res, MXR_GRAPHIC_SPAN(win), win_data->fb_width);
+        mixer_reg_write(res, MXR_GRAPHIC_SPAN(win),
+                        win_data->fb_pitch / (win_data->bpp >> 3));
        /* setup display size */
        if (ctx->mxr_ver == MXR_VER_128_0_0_184 &&
@@ -961,6 +963,7 @@ static void mixer_win_mode_set(struct exynos_drm_crtc *crtc,
        win_data->fb_y = plane->fb_y;
        win_data->fb_width = plane->fb_width;
        win_data->fb_height = plane->fb_height;
+        win_data->fb_pitch = plane->pitch;
        win_data->src_width = plane->src_width;
        win_data->src_height = plane->src_height;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 5b205863b659..27ea6bdebce7 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2737,24 +2737,11 @@ i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
        WARN_ON(i915_verify_lists(ring->dev));
-        /* Move any buffers on the active list that are no longer referenced
+        /* Retire requests first as we use it above for the early return.
-         * by the ringbuffer to the flushing/inactive lists as appropriate,
+         * If we retire requests last, we may use a later seqno and so clear
-         * before we free the context associated with the requests.
+         * the requests lists without clearing the active list, leading to
+         * confusion.
         */
-        while (!list_empty(&ring->active_list)) {
-                struct drm_i915_gem_object *obj;
-                obj = list_first_entry(&ring->active_list,
-                                      struct drm_i915_gem_object,
-                                      ring_list);
-                if (!i915_gem_request_completed(obj->last_read_req, true))
-                        break;
-                i915_gem_object_move_to_inactive(obj);
-        }
        while (!list_empty(&ring->request_list)) {
                struct drm_i915_gem_request *request;
                struct intel_ringbuffer *ringbuf;
@@ -2789,6 +2776,23 @@ i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
                i915_gem_free_request(request);
        }
+        /* Move any buffers on the active list that are no longer referenced
+         * by the ringbuffer to the flushing/inactive lists as appropriate,
+         * before we free the context associated with the requests.
+         */
+        while (!list_empty(&ring->active_list)) {
+                struct drm_i915_gem_object *obj;
+                obj = list_first_entry(&ring->active_list,
+                                      struct drm_i915_gem_object,
+                                      ring_list);
+                if (!i915_gem_request_completed(obj->last_read_req, true))
+                        break;
+                i915_gem_object_move_to_inactive(obj);
+        }
        if (unlikely(ring->trace_irq_req &&
                     i915_gem_request_completed(ring->trace_irq_req, true))) {
                ring->irq_put(ring);
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index b773368fc62c..38a742532c4f 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1487,7 +1487,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                goto err;
        }
-        if (i915_needs_cmd_parser(ring)) {
+        if (i915_needs_cmd_parser(ring) && args->batch_len) {
                batch_obj = i915_gem_execbuffer_parse(ring,
                                                      &shadow_exec_entry,
                                                      eb,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 6d22128d97b1..f75173c20f47 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2438,8 +2438,15 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc,
        if (!intel_crtc->base.primary->fb)
                return;
-        if (intel_alloc_plane_obj(intel_crtc, plane_config))
+        if (intel_alloc_plane_obj(intel_crtc, plane_config)) {
+                struct drm_plane *primary = intel_crtc->base.primary;
+                primary->state->crtc = &intel_crtc->base;
+                primary->crtc = &intel_crtc->base;
+                update_state_fb(primary);
                return;
+        }
        kfree(intel_crtc->base.primary->fb);
        intel_crtc->base.primary->fb = NULL;
@@ -2462,11 +2469,15 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc,
                        continue;
                if (i915_gem_obj_ggtt_offset(obj) == plane_config->base) {
+                        struct drm_plane *primary = intel_crtc->base.primary;
                        if (obj->tiling_mode != I915_TILING_NONE)
                                dev_priv->preserve_bios_swizzle = true;
                        drm_framebuffer_reference(c->primary->fb);
-                        intel_crtc->base.primary->fb = c->primary->fb;
+                        primary->fb = c->primary->fb;
+                        primary->state->crtc = &intel_crtc->base;
+                        primary->crtc = &intel_crtc->base;
                        obj->frontbuffer_bits |= INTEL_FRONTBUFFER_PRIMARY(intel_crtc->pipe);
                        break;
                }
@@ -6663,7 +6674,6 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
                      plane_config->size);
        crtc->base.primary->fb = fb;
-        update_state_fb(crtc->base.primary);
 }
 static void chv_crtc_clock_get(struct intel_crtc *crtc,
@@ -7704,7 +7714,6 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
                      plane_config->size);
        crtc->base.primary->fb = fb;
-        update_state_fb(crtc->base.primary);
        return;
 error:
@@ -7798,7 +7807,6 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
                      plane_config->size);
        crtc->base.primary->fb = fb;
-        update_state_fb(crtc->base.primary);
 }
 static bool ironlake_get_pipe_config(struct intel_crtc *crtc,
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 0a52c44ad03d..9c5451c97942 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -1322,7 +1322,7 @@ int intel_sprite_set_colorkey(struct drm_device *dev, void *data,
        drm_modeset_lock_all(dev);
        plane = drm_plane_find(dev, set->plane_id);
-        if (!plane) {
+        if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) {
                ret = -ENOENT;
                goto out_unlock;
        }
@@ -1349,7 +1349,7 @@ int intel_sprite_get_colorkey(struct drm_device *dev, void *data,
        drm_modeset_lock_all(dev);
        plane = drm_plane_find(dev, get->plane_id);
-        if (!plane) {
+        if (!plane || plane->type != DRM_PLANE_TYPE_OVERLAY) {
                ret = -ENOENT;
                goto out_unlock;
        }
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index c648e1996dab..243a36c93b8f 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -2129,6 +2129,7 @@
 #define VCE_UENC_REG_CLOCK_GATING       0x207c0
 #define VCE_SYS_INT_EN                  0x21300
 #       define VCE_SYS_INT_TRAP_INTERRUPT_EN    (1 << 3)
+#define VCE_LMI_VCPU_CACHE_40BIT_BAR    0x2145c
 #define VCE_LMI_CTRL2                   0x21474
 #define VCE_LMI_CTRL                    0x21498
 #define VCE_LMI_VM_CTRL                 0x214a0
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 5587603b4a89..33d5a4f4eebd 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1565,6 +1565,7 @@ struct radeon_dpm {
        int                     new_active_crtc_count;
        u32                     current_active_crtcs;
        int                     current_active_crtc_count;
+        bool single_display;
        struct radeon_dpm_dynamic_state dyn_state;
        struct radeon_dpm_fan fan;
        u32 tdp_limit;
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 63ccb8fa799c..d27e4ccb848c 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)
 static bool radeon_read_bios(struct radeon_device *rdev)
 {
-        uint8_t __iomem *bios;
+        uint8_t __iomem *bios, val1, val2;
        size_t size;
        rdev->bios = NULL;
@@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev)
                return false;
        }
-        if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
+        val1 = readb(&bios[0]);
+        val2 = readb(&bios[1]);
+        if (size == 0 || val1 != 0x55 || val2 != 0xaa) {
                pci_unmap_rom(rdev->pdev, bios);
                return false;
        }
-        rdev->bios = kmemdup(bios, size, GFP_KERNEL);
+        rdev->bios = kzalloc(size, GFP_KERNEL);
        if (rdev->bios == NULL) {
                pci_unmap_rom(rdev->pdev, bios);
                return false;
        }
+        memcpy_fromio(rdev->bios, bios, size);
        pci_unmap_rom(rdev->pdev, bios);
        return true;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_mn.c b/drivers/gpu/drm/radeon/radeon_mn.c
index a69bd441dd2d..572b4dbec186 100644
--- a/drivers/gpu/drm/radeon/radeon_mn.c
+++ b/drivers/gpu/drm/radeon/radeon_mn.c
@@ -122,7 +122,6 @@ static void radeon_mn_invalidate_range_start(struct mmu_notifier *mn,
        it = interval_tree_iter_first(&rmn->objects, start, end);
        while (it) {
                struct radeon_bo *bo;
-                struct fence *fence;
                int r;
                bo = container_of(it, struct radeon_bo, mn_it);
@@ -134,12 +133,10 @@ static void radeon_mn_invalidate_range_start(struct mmu_notifier *mn,
                        continue;
                }
-                fence = reservation_object_get_excl(bo->tbo.resv);
+                r = reservation_object_wait_timeout_rcu(bo->tbo.resv, true,
-                if (fence) {
+                        false, MAX_SCHEDULE_TIMEOUT);
-                        r = radeon_fence_wait((struct radeon_fence *)fence, false);
+                if (r)
-                        if (r)
+                        DRM_ERROR("(%d) failed to wait for user bo\n", r);
-                                DRM_ERROR("(%d) failed to wait for user bo\n", r);
-                }
                radeon_ttm_placement_from_domain(bo, RADEON_GEM_DOMAIN_CPU);
                r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false);
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 33cf4108386d..c1ba83a8dd8c 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -837,12 +837,8 @@ static void radeon_dpm_thermal_work_handler(struct work_struct *work)
        radeon_pm_compute_clocks(rdev);
 }
-static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
+static bool radeon_dpm_single_display(struct radeon_device *rdev)
-                                                     enum radeon_pm_state_type dpm_state)
 {
-        int i;
-        struct radeon_ps *ps;
-        u32 ui_class;
        bool single_display = (rdev->pm.dpm.new_active_crtc_count < 2) ?
                true : false;
@@ -858,6 +854,17 @@ static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
        if (single_display && (r600_dpm_get_vrefresh(rdev) >= 120))
                single_display = false;
+        return single_display;
+}
+static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
+                                                     enum radeon_pm_state_type dpm_state)
+{
+        int i;
+        struct radeon_ps *ps;
+        u32 ui_class;
+        bool single_display = radeon_dpm_single_display(rdev);
        /* certain older asics have a separare 3D performance state,
         * so try that first if the user selected performance
         */
@@ -983,6 +990,7 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
        struct radeon_ps *ps;
        enum radeon_pm_state_type dpm_state;
        int ret;
+        bool single_display = radeon_dpm_single_display(rdev);
        /* if dpm init failed */
        if (!rdev->pm.dpm_enabled)
@@ -1007,6 +1015,9 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
                /* vce just modifies an existing state so force a change */
                if (ps->vce_active != rdev->pm.dpm.vce_active)
                        goto force;
+                /* user has made a display change (such as timing) */
+                if (rdev->pm.dpm.single_display != single_display)
+                        goto force;
                if ((rdev->family < CHIP_BARTS) || (rdev->flags & RADEON_IS_IGP)) {
                        /* for pre-BTC and APUs if the num crtcs changed but state is the same,
                         * all we need to do is update the display configuration.
@@ -1069,6 +1080,7 @@ force:
        rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
        rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
+        rdev->pm.dpm.single_display = single_display;
        /* wait for the rings to drain */
        for (i = 0; i < RADEON_NUM_RINGS; i++) {
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 2456f69efd23..8c7872339c2a 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -495,7 +495,7 @@ static int radeon_debugfs_ring_info(struct seq_file *m, void *data)
        seq_printf(m, "%u free dwords in ring\n", ring->ring_free_dw);
        seq_printf(m, "%u dwords in ring\n", count);
-        if (!ring->ready)
+        if (!ring->ring)
                return 0;
        /* print 8 dw before current rptr as often it's the last executed
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index d02aa1d0f588..b292aca0f342 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -598,6 +598,10 @@ static void radeon_ttm_tt_unpin_userptr(struct ttm_tt *ttm)
        enum dma_data_direction direction = write ?
                DMA_BIDIRECTIONAL : DMA_TO_DEVICE;
+        /* double check that we don't free the table twice */
+        if (!ttm->sg->sgl)
+                return;
        /* free the sg table and pages again */
        dma_unmap_sg(rdev->dev, ttm->sg->sgl, ttm->sg->nents, direction);
diff --git a/drivers/gpu/drm/radeon/vce_v2_0.c b/drivers/gpu/drm/radeon/vce_v2_0.c
index 1ac7bb825a1b..fbbe78fbd087 100644
--- a/drivers/gpu/drm/radeon/vce_v2_0.c
+++ b/drivers/gpu/drm/radeon/vce_v2_0.c
@@ -156,6 +156,9 @@ int vce_v2_0_resume(struct radeon_device *rdev)
        WREG32(VCE_LMI_SWAP_CNTL1, 0);
        WREG32(VCE_LMI_VM_CTRL, 0);
+        WREG32(VCE_LMI_VCPU_CACHE_40BIT_BAR, addr >> 8);
+        addr &= 0xff;
        size = RADEON_GPU_PAGE_ALIGN(rdev->vce_fw->size);
        WREG32(VCE_VCPU_CACHE_OFFSET0, addr & 0x7fffffff);
        WREG32(VCE_VCPU_CACHE_SIZE0, size);
diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
index 1096da327130..75c6d2103e07 100644
--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -659,7 +659,7 @@ static irqreturn_t bma180_trigger_handler(int irq, void *p)
        mutex_lock(&data->mutex);
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                         indio_dev->masklength) {
                ret = bma180_get_data_reg(data, bit);
                if (ret < 0) {
diff --git a/drivers/iio/accel/bmc150-accel.c b/drivers/iio/accel/bmc150-accel.c
index 066d0c04072c..75567fd457dc 100644
--- a/drivers/iio/accel/bmc150-accel.c
+++ b/drivers/iio/accel/bmc150-accel.c
@@ -168,14 +168,14 @@ static const struct {
        int val;
        int val2;
        u8 bw_bits;
-} bmc150_accel_samp_freq_table[] = { {7, 810000, 0x08},
+} bmc150_accel_samp_freq_table[] = { {15, 620000, 0x08},
-                                     {15, 630000, 0x09},
+                                     {31, 260000, 0x09},
-                                     {31, 250000, 0x0A},
+                                     {62, 500000, 0x0A},
-                                     {62, 500000, 0x0B},
+                                     {125, 0, 0x0B},
-                                     {125, 0, 0x0C},
+                                     {250, 0, 0x0C},
-                                     {250, 0, 0x0D},
+                                     {500, 0, 0x0D},
-                                     {500, 0, 0x0E},
+                                     {1000, 0, 0x0E},
-                                     {1000, 0, 0x0F} };
+                                     {2000, 0, 0x0F} };
 static const struct {
        int bw_bits;
@@ -840,7 +840,7 @@ static int bmc150_accel_validate_trigger(struct iio_dev *indio_dev,
 }
 static IIO_CONST_ATTR_SAMP_FREQ_AVAIL(
-                "7.810000 15.630000 31.250000 62.500000 125 250 500 1000");
+                "15.620000 31.260000 62.50000 125 250 500 1000 2000");
 static struct attribute *bmc150_accel_attributes[] = {
        &iio_const_attr_sampling_frequency_available.dev_attr.attr,
@@ -986,7 +986,7 @@ static irqreturn_t bmc150_accel_trigger_handler(int irq, void *p)
        int bit, ret, i = 0;
        mutex_lock(&data->mutex);
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                         indio_dev->masklength) {
                ret = i2c_smbus_read_word_data(data->client,
                                               BMC150_ACCEL_AXIS_TO_REG(bit));
diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index 567de269cc00..1a6379525fa4 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -956,7 +956,7 @@ static irqreturn_t kxcjk1013_trigger_handler(int irq, void *p)
        mutex_lock(&data->mutex);
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                         indio_dev->masklength) {
                ret = kxcjk1013_get_acc_reg(data, bit);
                if (ret < 0) {
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 202daf889be2..46379b1fb25b 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -137,7 +137,8 @@ config AXP288_ADC
 config CC10001_ADC
        tristate "Cosmic Circuits 10001 ADC driver"
-        depends on HAS_IOMEM || HAVE_CLK || REGULATOR
+        depends on HAVE_CLK || REGULATOR
+        depends on HAS_IOMEM
        select IIO_BUFFER
        select IIO_TRIGGERED_BUFFER
        help
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index ff61ae55dd3f..8a0eb4a04fb5 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -544,7 +544,6 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
 {
        struct iio_dev *idev = iio_trigger_get_drvdata(trig);
        struct at91_adc_state *st = iio_priv(idev);
-        struct iio_buffer *buffer = idev->buffer;
        struct at91_adc_reg_desc *reg = st->registers;
        u32 status = at91_adc_readl(st, reg->trigger_register);
        int value;
@@ -564,7 +563,7 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
                at91_adc_writel(st, reg->trigger_register,
                                status | value);
-                for_each_set_bit(bit, buffer->scan_mask,
+                for_each_set_bit(bit, idev->active_scan_mask,
                                 st->num_channels) {
                        struct iio_chan_spec const *chan = idev->channels + bit;
                        at91_adc_writel(st, AT91_ADC_CHER,
@@ -579,7 +578,7 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
                at91_adc_writel(st, reg->trigger_register,
                                status & ~value);
-                for_each_set_bit(bit, buffer->scan_mask,
+                for_each_set_bit(bit, idev->active_scan_mask,
                                 st->num_channels) {
                        struct iio_chan_spec const *chan = idev->channels + bit;
                        at91_adc_writel(st, AT91_ADC_CHDR,
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 2e5cc4409f78..a0e7161f040c 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -188,12 +188,11 @@ static int tiadc_buffer_preenable(struct iio_dev *indio_dev)
 static int tiadc_buffer_postenable(struct iio_dev *indio_dev)
 {
        struct tiadc_device *adc_dev = iio_priv(indio_dev);
-        struct iio_buffer *buffer = indio_dev->buffer;
        unsigned int enb = 0;
        u8 bit;
        tiadc_step_config(indio_dev);
-        for_each_set_bit(bit, buffer->scan_mask, adc_dev->channels)
+        for_each_set_bit(bit, indio_dev->active_scan_mask, adc_dev->channels)
                enb |= (get_adc_step_bit(adc_dev, bit) << 1);
        adc_dev->buffer_en_ch_steps = enb;
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index 8ec353c01d98..e63b8e76d4c3 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -141,9 +141,13 @@ struct vf610_adc {
        struct regulator *vref;
        struct vf610_adc_feature adc_feature;
+        u32 sample_freq_avail[5];
        struct completion completion;
 };
+static const u32 vf610_hw_avgs[] = { 1, 4, 8, 16, 32 };
 #define VF610_ADC_CHAN(_idx, _chan_type) {                      \
        .type = (_chan_type),                                   \
        .indexed = 1,                                           \
@@ -180,35 +184,47 @@ static const struct iio_chan_spec vf610_adc_iio_channels[] = {
        /* sentinel */
 };
-/*
+static inline void vf610_adc_calculate_rates(struct vf610_adc *info)
- * ADC sample frequency, unit is ADCK cycles.
+{
- * ADC clk source is ipg clock, which is the same as bus clock.
+        unsigned long adck_rate, ipg_rate = clk_get_rate(info->clk);
- *
+        int i;
- * ADC conversion time = SFCAdder + AverageNum x (BCT + LSTAdder)
- * SFCAdder: fixed to 6 ADCK cycles
+        /*
- * AverageNum: 1, 4, 8, 16, 32 samples for hardware average.
+         * Calculate ADC sample frequencies
- * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
+         * Sample time unit is ADCK cycles. ADCK clk source is ipg clock,
- * LSTAdder(Long Sample Time): fixed to 3 ADCK cycles
+         * which is the same as bus clock.
- *
+         *
- * By default, enable 12 bit resolution mode, clock source
+         * ADC conversion time = SFCAdder + AverageNum x (BCT + LSTAdder)
- * set to ipg clock, So get below frequency group:
+         * SFCAdder: fixed to 6 ADCK cycles
- */
+         * AverageNum: 1, 4, 8, 16, 32 samples for hardware average.
-static const u32 vf610_sample_freq_avail[5] =
+         * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
-{1941176, 559332, 286957, 145374, 73171};
+         * LSTAdder(Long Sample Time): fixed to 3 ADCK cycles
+         */
+        adck_rate = ipg_rate / info->adc_feature.clk_div;
+        for (i = 0; i < ARRAY_SIZE(vf610_hw_avgs); i++)
+                info->sample_freq_avail[i] =
+                        adck_rate / (6 + vf610_hw_avgs[i] * (25 + 3));
+}
 static inline void vf610_adc_cfg_init(struct vf610_adc *info)
 {
+        struct vf610_adc_feature *adc_feature = &info->adc_feature;
        /* set default Configuration for ADC controller */
-        info->adc_feature.clk_sel = VF610_ADCIOC_BUSCLK_SET;
+        adc_feature->clk_sel = VF610_ADCIOC_BUSCLK_SET;
-        info->adc_feature.vol_ref = VF610_ADCIOC_VR_VREF_SET;
+        adc_feature->vol_ref = VF610_ADCIOC_VR_VREF_SET;
+        adc_feature->calibration = true;
+        adc_feature->ovwren = true;
+        adc_feature->res_mode = 12;
+        adc_feature->sample_rate = 1;
+        adc_feature->lpm = true;
-        info->adc_feature.calibration = true;
+        /* Use a save ADCK which is below 20MHz on all devices */
-        info->adc_feature.ovwren = true;
+        adc_feature->clk_div = 8;
-        info->adc_feature.clk_div = 1;
+        vf610_adc_calculate_rates(info);
-        info->adc_feature.res_mode = 12;
-        info->adc_feature.sample_rate = 1;
-        info->adc_feature.lpm = true;
 }
 static void vf610_adc_cfg_post_set(struct vf610_adc *info)
@@ -290,12 +306,10 @@ static void vf610_adc_cfg_set(struct vf610_adc *info)
        cfg_data = readl(info->regs + VF610_REG_ADC_CFG);
-        /* low power configuration */
        cfg_data &= ~VF610_ADC_ADLPC_EN;
        if (adc_feature->lpm)
                cfg_data |= VF610_ADC_ADLPC_EN;
-        /* disable high speed */
        cfg_data &= ~VF610_ADC_ADHSC_EN;
        writel(cfg_data, info->regs + VF610_REG_ADC_CFG);
@@ -435,10 +449,27 @@ static irqreturn_t vf610_adc_isr(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
-static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("1941176, 559332, 286957, 145374, 73171");
+static ssize_t vf610_show_samp_freq_avail(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct vf610_adc *info = iio_priv(dev_to_iio_dev(dev));
+        size_t len = 0;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(info->sample_freq_avail); i++)
+                len += scnprintf(buf + len, PAGE_SIZE - len,
+                        "%u ", info->sample_freq_avail[i]);
+        /* replace trailing space by newline */
+        buf[len - 1] = '\n';
+        return len;
+}
+static IIO_DEV_ATTR_SAMP_FREQ_AVAIL(vf610_show_samp_freq_avail);
 static struct attribute *vf610_attributes[] = {
-        &iio_const_attr_sampling_frequency_available.dev_attr.attr,
+        &iio_dev_attr_sampling_frequency_available.dev_attr.attr,
        NULL
 };
@@ -502,7 +533,7 @@ static int vf610_read_raw(struct iio_dev *indio_dev,
                return IIO_VAL_FRACTIONAL_LOG2;
        case IIO_CHAN_INFO_SAMP_FREQ:
-                *val = vf610_sample_freq_avail[info->adc_feature.sample_rate];
+                *val = info->sample_freq_avail[info->adc_feature.sample_rate];
                *val2 = 0;
                return IIO_VAL_INT;
@@ -525,9 +556,9 @@ static int vf610_write_raw(struct iio_dev *indio_dev,
        switch (mask) {
                case IIO_CHAN_INFO_SAMP_FREQ:
                        for (i = 0;
-                                i < ARRAY_SIZE(vf610_sample_freq_avail);
+                                i < ARRAY_SIZE(info->sample_freq_avail);
                                i++)
-                                if (val == vf610_sample_freq_avail[i]) {
+                                if (val == info->sample_freq_avail[i]) {
                                        info->adc_feature.sample_rate = i;
                                        vf610_adc_sample_set(info);
                                        return 0;
diff --git a/drivers/iio/gyro/bmg160.c b/drivers/iio/gyro/bmg160.c
index 60451b328242..ccf3ea7e1afa 100644
--- a/drivers/iio/gyro/bmg160.c
+++ b/drivers/iio/gyro/bmg160.c
@@ -822,7 +822,7 @@ static irqreturn_t bmg160_trigger_handler(int irq, void *p)
        int bit, ret, i = 0;
        mutex_lock(&data->mutex);
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                         indio_dev->masklength) {
                ret = i2c_smbus_read_word_data(data->client,
                                               BMG160_AXIS_TO_REG(bit));
diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
index e0017c22bb9c..f53e9a803a0e 100644
--- a/drivers/iio/imu/adis_trigger.c
+++ b/drivers/iio/imu/adis_trigger.c
@@ -60,7 +60,7 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
        iio_trigger_set_drvdata(adis->trig, adis);
        ret = iio_trigger_register(adis->trig);
-        indio_dev->trig = adis->trig;
+        indio_dev->trig = iio_trigger_get(adis->trig);
        if (ret)
                goto error_free_irq;
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index d8d5bed65e07..ef76afe2643c 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -410,42 +410,46 @@ error_read_raw:
        }
 }
-static int inv_mpu6050_write_fsr(struct inv_mpu6050_state *st, int fsr)
+static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val)
 {
-        int result;
+        int result, i;
        u8 d;
-        if (fsr < 0 || fsr > INV_MPU6050_MAX_GYRO_FS_PARAM)
+        for (i = 0; i < ARRAY_SIZE(gyro_scale_6050); ++i) {
-                return -EINVAL;
+                if (gyro_scale_6050[i] == val) {
-        if (fsr == st->chip_config.fsr)
+                        d = (i << INV_MPU6050_GYRO_CONFIG_FSR_SHIFT);
-                return 0;
+                        result = inv_mpu6050_write_reg(st,
+                                        st->reg->gyro_config, d);
+                        if (result)
+                                return result;
-        d = (fsr << INV_MPU6050_GYRO_CONFIG_FSR_SHIFT);
+                        st->chip_config.fsr = i;
-        result = inv_mpu6050_write_reg(st, st->reg->gyro_config, d);
+                        return 0;
-        if (result)
+                }
-                return result;
+        }
-        st->chip_config.fsr = fsr;
-        return 0;
+        return -EINVAL;
 }
-static int inv_mpu6050_write_accel_fs(struct inv_mpu6050_state *st, int fs)
+static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val)
 {
-        int result;
+        int result, i;
        u8 d;
-        if (fs < 0 || fs > INV_MPU6050_MAX_ACCL_FS_PARAM)
+        for (i = 0; i < ARRAY_SIZE(accel_scale); ++i) {
-                return -EINVAL;
+                if (accel_scale[i] == val) {
-        if (fs == st->chip_config.accl_fs)
+                        d = (i << INV_MPU6050_ACCL_CONFIG_FSR_SHIFT);
-                return 0;
+                        result = inv_mpu6050_write_reg(st,
+                                        st->reg->accl_config, d);
+                        if (result)
+                                return result;
-        d = (fs << INV_MPU6050_ACCL_CONFIG_FSR_SHIFT);
+                        st->chip_config.accl_fs = i;
-        result = inv_mpu6050_write_reg(st, st->reg->accl_config, d);
+                        return 0;
-        if (result)
+                }
-                return result;
+        }
-        st->chip_config.accl_fs = fs;
-        return 0;
+        return -EINVAL;
 }
 static int inv_mpu6050_write_raw(struct iio_dev *indio_dev,
@@ -471,10 +475,10 @@ static int inv_mpu6050_write_raw(struct iio_dev *indio_dev,
        case IIO_CHAN_INFO_SCALE:
                switch (chan->type) {
                case IIO_ANGL_VEL:
-                        result = inv_mpu6050_write_fsr(st, val);
+                        result = inv_mpu6050_write_gyro_scale(st, val2);
                        break;
                case IIO_ACCEL:
-                        result = inv_mpu6050_write_accel_fs(st, val);
+                        result = inv_mpu6050_write_accel_scale(st, val2);
                        break;
                default:
                        result = -EINVAL;
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
index 0cd306a72a6e..ba27e277511f 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
@@ -24,6 +24,16 @@
 #include <linux/poll.h>
 #include "inv_mpu_iio.h"
+static void inv_clear_kfifo(struct inv_mpu6050_state *st)
+{
+        unsigned long flags;
+        /* take the spin lock sem to avoid interrupt kick in */
+        spin_lock_irqsave(&st->time_stamp_lock, flags);
+        kfifo_reset(&st->timestamps);
+        spin_unlock_irqrestore(&st->time_stamp_lock, flags);
+}
 int inv_reset_fifo(struct iio_dev *indio_dev)
 {
        int result;
@@ -50,6 +60,10 @@ int inv_reset_fifo(struct iio_dev *indio_dev)
                                        INV_MPU6050_BIT_FIFO_RST);
        if (result)
                goto reset_fifo_fail;
+        /* clear timestamps fifo */
+        inv_clear_kfifo(st);
        /* enable interrupt */
        if (st->chip_config.accl_fifo_enable ||
            st->chip_config.gyro_fifo_enable) {
@@ -83,16 +97,6 @@ reset_fifo_fail:
        return result;
 }
-static void inv_clear_kfifo(struct inv_mpu6050_state *st)
-{
-        unsigned long flags;
-        /* take the spin lock sem to avoid interrupt kick in */
-        spin_lock_irqsave(&st->time_stamp_lock, flags);
-        kfifo_reset(&st->timestamps);
-        spin_unlock_irqrestore(&st->time_stamp_lock, flags);
-}
 /**
 * inv_mpu6050_irq_handler() - Cache a timestamp at each data ready interrupt.
 */
@@ -184,7 +188,6 @@ end_session:
 flush_fifo:
        /* Flush HW and SW FIFOs. */
        inv_reset_fifo(indio_dev);
-        inv_clear_kfifo(st);
        mutex_unlock(&indio_dev->mlock);
        iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/imu/kmx61.c b/drivers/iio/imu/kmx61.c
index 5cc3692acf37..b3a36376c719 100644
--- a/drivers/iio/imu/kmx61.c
+++ b/drivers/iio/imu/kmx61.c
@@ -1227,7 +1227,7 @@ static irqreturn_t kmx61_trigger_handler(int irq, void *p)
                base = KMX61_MAG_XOUT_L;
        mutex_lock(&data->lock);
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                         indio_dev->masklength) {
                ret = kmx61_read_measurement(data, base, bit);
                if (ret < 0) {
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index aaba9d3d980e..4df97f650e44 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -847,8 +847,7 @@ static int iio_device_add_channel_sysfs(struct iio_dev *indio_dev,
 * @attr_list: List of IIO device attributes
 *
 * This function frees the memory allocated for each of the IIO device
- * attributes in the list. Note: if you want to reuse the list after calling
+ * attributes in the list.
- * this function you have to reinitialize it using INIT_LIST_HEAD().
 */
 void iio_free_chan_devattr_list(struct list_head *attr_list)
 {
@@ -856,6 +855,7 @@ void iio_free_chan_devattr_list(struct list_head *attr_list)
        list_for_each_entry_safe(p, n, attr_list, l) {
                kfree(p->dev_attr.attr.name);
+                list_del(&p->l);
                kfree(p);
        }
 }
@@ -936,6 +936,7 @@ static void iio_device_unregister_sysfs(struct iio_dev *indio_dev)
        iio_free_chan_devattr_list(&indio_dev->channel_attr_list);
        kfree(indio_dev->chan_attr_group.attrs);
+        indio_dev->chan_attr_group.attrs = NULL;
 }
 static void iio_dev_release(struct device *device)
diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
index a4b397048f71..a99692ba91bc 100644
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -500,6 +500,7 @@ int iio_device_register_eventset(struct iio_dev *indio_dev)
 error_free_setup_event_lines:
        iio_free_chan_devattr_list(&indio_dev->event_interface->dev_attr_list);
        kfree(indio_dev->event_interface);
+        indio_dev->event_interface = NULL;
        return ret;
 }
diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
index 74dff4e4a11a..89fca3a70750 100644
--- a/drivers/iio/proximity/sx9500.c
+++ b/drivers/iio/proximity/sx9500.c
@@ -494,7 +494,7 @@ static irqreturn_t sx9500_trigger_handler(int irq, void *private)
        mutex_lock(&data->mutex);
-        for_each_set_bit(bit, indio_dev->buffer->scan_mask,
+        for_each_set_bit(bit, indio_dev->active_scan_mask,
                         indio_dev->masklength) {
                ret = sx9500_read_proximity(data, &indio_dev->channels[bit],
                                            &val);
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index aec7a6aa2951..8c014b5dab4c 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -99,6 +99,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
        if (dmasync)
                dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+        /*
+         * If the combination of the addr and size requested for this memory
+         * region causes an integer overflow, return error.
+         */
+        if ((PAGE_ALIGN(addr + size) <= size) ||
+            (PAGE_ALIGN(addr + size) <= addr))
+                return ERR_PTR(-EINVAL);
        if (!can_do_mlock())
                return ERR_PTR(-EPERM);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 1bd15ebc01f2..27bcdbc950c9 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1154,10 +1154,28 @@ out:
        mutex_unlock(&alps_mutex);
 }
-static void alps_report_bare_ps2_packet(struct input_dev *dev,
+static void alps_report_bare_ps2_packet(struct psmouse *psmouse,
                                        unsigned char packet[],
                                        bool report_buttons)
 {
+        struct alps_data *priv = psmouse->private;
+        struct input_dev *dev;
+        /* Figure out which device to use to report the bare packet */
+        if (priv->proto_version == ALPS_PROTO_V2 &&
+            (priv->flags & ALPS_DUALPOINT)) {
+                /* On V2 devices the DualPoint Stick reports bare packets */
+                dev = priv->dev2;
+        } else if (unlikely(IS_ERR_OR_NULL(priv->dev3))) {
+                /* Register dev3 mouse if we received PS/2 packet first time */
+                if (!IS_ERR(priv->dev3))
+                        psmouse_queue_work(psmouse, &priv->dev3_register_work,
+                                           0);
+                return;
+        } else {
+                dev = priv->dev3;
+        }
        if (report_buttons)
                alps_report_buttons(dev, NULL,
                                packet[0] & 1, packet[0] & 2, packet[0] & 4);
@@ -1232,8 +1250,8 @@ static psmouse_ret_t alps_handle_interleaved_ps2(struct psmouse *psmouse)
                 * de-synchronization.
                 */
-                alps_report_bare_ps2_packet(priv->dev2,
+                alps_report_bare_ps2_packet(psmouse, &psmouse->packet[3],
-                                            &psmouse->packet[3], false);
+                                            false);
                /*
                 * Continue with the standard ALPS protocol handling,
@@ -1289,18 +1307,9 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
         * properly we only do this if the device is fully synchronized.
         */
        if (!psmouse->out_of_sync_cnt && (psmouse->packet[0] & 0xc8) == 0x08) {
-                /* Register dev3 mouse if we received PS/2 packet first time */
-                if (unlikely(!priv->dev3))
-                        psmouse_queue_work(psmouse,
-                                           &priv->dev3_register_work, 0);
                if (psmouse->pktcnt == 3) {
-                        /* Once dev3 mouse device is registered report data */
+                        alps_report_bare_ps2_packet(psmouse, psmouse->packet,
-                        if (likely(!IS_ERR_OR_NULL(priv->dev3)))
+                                                    true);
-                                alps_report_bare_ps2_packet(priv->dev3,
-                                                            psmouse->packet,
-                                                            true);
                        return PSMOUSE_FULL_PACKET;
                }
                return PSMOUSE_GOOD_DATA;
@@ -2281,10 +2290,12 @@ static int alps_set_protocol(struct psmouse *psmouse,
                priv->set_abs_params = alps_set_abs_params_mt;
                priv->nibble_commands = alps_v3_nibble_commands;
                priv->addr_command = PSMOUSE_CMD_RESET_WRAP;
-                priv->x_max = 1360;
-                priv->y_max = 660;
                priv->x_bits = 23;
                priv->y_bits = 12;
+                if (alps_dolphin_get_device_area(psmouse, priv))
+                        return -EIO;
                break;
        case ALPS_PROTO_V6:
@@ -2303,9 +2314,8 @@ static int alps_set_protocol(struct psmouse *psmouse,
                priv->set_abs_params = alps_set_abs_params_mt;
                priv->nibble_commands = alps_v3_nibble_commands;
                priv->addr_command = PSMOUSE_CMD_RESET_WRAP;
+                priv->x_max = 0xfff;
-                if (alps_dolphin_get_device_area(psmouse, priv))
+                priv->y_max = 0x7ff;
-                        return -EIO;
                if (priv->fw_ver[1] != 0xba)
                        priv->flags |= ALPS_BUTTONPAD;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 95898333834f..630af73e98c4 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -157,6 +157,11 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
        },
        {
                (const char * const []){"LEN2006", NULL},
+                {2691, 2691},
+                1024, 5045, 2457, 4832
+        },
+        {
+                (const char * const []){"LEN2006", NULL},
                {ANY_BOARD_ID, ANY_BOARD_ID},
                1264, 5675, 1171, 4688
        },
@@ -192,7 +197,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
        "LEN2003",
        "LEN2004", /* L440 */
        "LEN2005",
-        "LEN2006",
+        "LEN2006", /* Edge E440/E540 */
        "LEN2007",
        "LEN2008",
        "LEN2009",
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index fc13dd56953e..a3adde6519f0 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1288,10 +1288,13 @@ static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain,
                return 0;
        spin_lock_irqsave(&smmu_domain->pgtbl_lock, flags);
-        if (smmu_domain->smmu->features & ARM_SMMU_FEAT_TRANS_OPS)
+        if (smmu_domain->smmu->features & ARM_SMMU_FEAT_TRANS_OPS &&
+                        smmu_domain->stage == ARM_SMMU_DOMAIN_S1) {
                ret = arm_smmu_iova_to_phys_hard(domain, iova);
-        else
+        } else {
                ret = ops->iova_to_phys(ops, iova);
+        }
        spin_unlock_irqrestore(&smmu_domain->pgtbl_lock, flags);
        return ret;
@@ -1556,7 +1559,7 @@ static int arm_smmu_device_cfg_probe(struct arm_smmu_device *smmu)
                return -ENODEV;
        }
-        if (smmu->version == 1 || (!(id & ID0_ATOSNS) && (id & ID0_S1TS))) {
+        if ((id & ID0_S1TS) && ((smmu->version == 1) || (id & ID0_ATOSNS))) {
                smmu->features |= ARM_SMMU_FEAT_TRANS_OPS;
                dev_notice(smmu->dev, "\taddress translation ops\n");
        }
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index ae4c1a854e57..2d1e05bdbb53 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1742,9 +1742,8 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
 static void domain_exit(struct dmar_domain *domain)
 {
-        struct dmar_drhd_unit *drhd;
-        struct intel_iommu *iommu;
        struct page *freelist = NULL;
+        int i;
        /* Domain 0 is reserved, so dont process it */
        if (!domain)
@@ -1764,8 +1763,8 @@ static void domain_exit(struct dmar_domain *domain)
        /* clear attached or cached domains */
        rcu_read_lock();
-        for_each_active_iommu(iommu, drhd)
+        for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
-                iommu_detach_domain(domain, iommu);
+                iommu_detach_domain(domain, g_iommus[i]);
        rcu_read_unlock();
        dma_free_pagelist(freelist);
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index 10186cac7716..bc39bdf7b99b 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -851,6 +851,7 @@ static int ipmmu_remove(struct platform_device *pdev)
 static const struct of_device_id ipmmu_of_ids[] = {
        { .compatible = "renesas,ipmmu-vmsa", },
+        { }
 };
 static struct platform_driver ipmmu_driver = {
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 596b0a9eee99..9687f8afebff 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -169,7 +169,7 @@ static void its_encode_cmd(struct its_cmd_block *cmd, u8 cmd_nr)
 static void its_encode_devid(struct its_cmd_block *cmd, u32 devid)
 {
-        cmd->raw_cmd[0] &= ~(0xffffUL << 32);
+        cmd->raw_cmd[0] &= BIT_ULL(32) - 1;
        cmd->raw_cmd[0] |= ((u64)devid) << 32;
 }
@@ -802,6 +802,7 @@ static int its_alloc_tables(struct its_node *its)
        int i;
        int psz = SZ_64K;
        u64 shr = GITS_BASER_InnerShareable;
+        u64 cache = GITS_BASER_WaWb;
        for (i = 0; i < GITS_BASER_NR_REGS; i++) {
                u64 val = readq_relaxed(its->base + GITS_BASER + i * 8);
@@ -848,7 +849,7 @@ retry_baser:
                val = (virt_to_phys(base)                                |
                       (type << GITS_BASER_TYPE_SHIFT)                   |
                       ((entry_size - 1) << GITS_BASER_ENTRY_SIZE_SHIFT) |
-                       GITS_BASER_WaWb                                   |
+                       cache                                             |
                       shr                                               |
                       GITS_BASER_VALID);
@@ -874,9 +875,12 @@ retry_baser:
                         * Shareability didn't stick. Just use
                         * whatever the read reported, which is likely
                         * to be the only thing this redistributor
-                         * supports.
+                         * supports. If that's zero, make it
+                         * non-cacheable as well.
                         */
                        shr = tmp & GITS_BASER_SHAREABILITY_MASK;
+                        if (!shr)
+                                cache = GITS_BASER_nC;
                        goto retry_baser;
                }
@@ -980,16 +984,39 @@ static void its_cpu_init_lpis(void)
        tmp = readq_relaxed(rbase + GICR_PROPBASER);
        if ((tmp ^ val) & GICR_PROPBASER_SHAREABILITY_MASK) {
+                if (!(tmp & GICR_PROPBASER_SHAREABILITY_MASK)) {
+                        /*
+                         * The HW reports non-shareable, we must
+                         * remove the cacheability attributes as
+                         * well.
+                         */
+                        val &= ~(GICR_PROPBASER_SHAREABILITY_MASK |
+                                 GICR_PROPBASER_CACHEABILITY_MASK);
+                        val |= GICR_PROPBASER_nC;
+                        writeq_relaxed(val, rbase + GICR_PROPBASER);
+                }
                pr_info_once("GIC: using cache flushing for LPI property table\n");
                gic_rdists->flags |= RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING;
        }
        /* set PENDBASE */
        val = (page_to_phys(pend_page) |
-               GICR_PROPBASER_InnerShareable |
+               GICR_PENDBASER_InnerShareable |
-               GICR_PROPBASER_WaWb);
+               GICR_PENDBASER_WaWb);
        writeq_relaxed(val, rbase + GICR_PENDBASER);
+        tmp = readq_relaxed(rbase + GICR_PENDBASER);
+        if (!(tmp & GICR_PENDBASER_SHAREABILITY_MASK)) {
+                /*
+                 * The HW reports non-shareable, we must remove the
+                 * cacheability attributes as well.
+                 */
+                val &= ~(GICR_PENDBASER_SHAREABILITY_MASK |
+                         GICR_PENDBASER_CACHEABILITY_MASK);
+                val |= GICR_PENDBASER_nC;
+                writeq_relaxed(val, rbase + GICR_PENDBASER);
+        }
        /* Enable LPIs */
        val = readl_relaxed(rbase + GICR_CTLR);
@@ -1026,7 +1053,7 @@ static void its_cpu_init_collection(void)
                         * This ITS wants a linear CPU number.
                         */
                        target = readq_relaxed(gic_data_rdist_rd_base() + GICR_TYPER);
-                        target = GICR_TYPER_CPU_NUMBER(target);
+                        target = GICR_TYPER_CPU_NUMBER(target) << 16;
                }
                /* Perform collection mapping */
@@ -1422,14 +1449,26 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
        writeq_relaxed(baser, its->base + GITS_CBASER);
        tmp = readq_relaxed(its->base + GITS_CBASER);
-        writeq_relaxed(0, its->base + GITS_CWRITER);
-        writel_relaxed(GITS_CTLR_ENABLE, its->base + GITS_CTLR);
-        if ((tmp ^ baser) & GITS_BASER_SHAREABILITY_MASK) {
+        if ((tmp ^ baser) & GITS_CBASER_SHAREABILITY_MASK) {
+                if (!(tmp & GITS_CBASER_SHAREABILITY_MASK)) {
+                        /*
+                         * The HW reports non-shareable, we must
+                         * remove the cacheability attributes as
+                         * well.
+                         */
+                        baser &= ~(GITS_CBASER_SHAREABILITY_MASK |
+                                   GITS_CBASER_CACHEABILITY_MASK);
+                        baser |= GITS_CBASER_nC;
+                        writeq_relaxed(baser, its->base + GITS_CBASER);
+                }
                pr_info("ITS: using cache flushing for cmd queue\n");
                its->flags |= ITS_FLAGS_CMDQ_NEEDS_FLUSHING;
        }
+        writeq_relaxed(0, its->base + GITS_CWRITER);
+        writel_relaxed(GITS_CTLR_ENABLE, its->base + GITS_CTLR);
        if (of_property_read_bool(its->msi_chip.of_node, "msi-controller")) {
                its->domain = irq_domain_add_tree(NULL, &its_domain_ops, its);
                if (!its->domain) {
diff --git a/drivers/lguest/Kconfig b/drivers/lguest/Kconfig
index ee035ec4526b..169172d2ba05 100644
--- a/drivers/lguest/Kconfig
+++ b/drivers/lguest/Kconfig
@@ -1,6 +1,6 @@
 config LGUEST
        tristate "Linux hypervisor example code"
-        depends on X86_32 && EVENTFD && TTY
+        depends on X86_32 && EVENTFD && TTY && PCI_DIRECT
        select HVC_DRIVER
        ---help---
          This is a very simple module which allows you to run
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 9b641b38b857..8001fe9e3434 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -433,7 +433,6 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode)
        dm_get(md);
        atomic_inc(&md->open_count);
 out:
        spin_unlock(&_minor_lock);
@@ -442,16 +441,20 @@ out:
 static void dm_blk_close(struct gendisk *disk, fmode_t mode)
 {
-        struct mapped_device *md = disk->private_data;
+        struct mapped_device *md;
        spin_lock(&_minor_lock);
+        md = disk->private_data;
+        if (WARN_ON(!md))
+                goto out;
        if (atomic_dec_and_test(&md->open_count) &&
            (test_bit(DMF_DEFERRED_REMOVE, &md->flags)))
                queue_work(deferred_remove_workqueue, &deferred_remove_work);
        dm_put(md);
+out:
        spin_unlock(&_minor_lock);
 }
@@ -2241,7 +2244,6 @@ static void free_dev(struct mapped_device *md)
        int minor = MINOR(disk_devt(md->disk));
        unlock_fs(md);
-        bdput(md->bdev);
        destroy_workqueue(md->wq);
        if (md->kworker_task)
@@ -2252,19 +2254,22 @@ static void free_dev(struct mapped_device *md)
                mempool_destroy(md->rq_pool);
        if (md->bs)
                bioset_free(md->bs);
-        blk_integrity_unregister(md->disk);
-        del_gendisk(md->disk);
        cleanup_srcu_struct(&md->io_barrier);
        free_table_devices(&md->table_devices);
-        free_minor(minor);
+        dm_stats_cleanup(&md->stats);
        spin_lock(&_minor_lock);
        md->disk->private_data = NULL;
        spin_unlock(&_minor_lock);
+        if (blk_get_integrity(md->disk))
+                blk_integrity_unregister(md->disk);
+        del_gendisk(md->disk);
        put_disk(md->disk);
        blk_cleanup_queue(md->queue);
-        dm_stats_cleanup(&md->stats);
+        bdput(md->bdev);
+        free_minor(minor);
        module_put(THIS_MODULE);
        kfree(md);
 }
@@ -2642,8 +2647,9 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
        might_sleep();
-        spin_lock(&_minor_lock);
        map = dm_get_live_table(md, &srcu_idx);
+        spin_lock(&_minor_lock);
        idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md))));
        set_bit(DMF_FREEING, &md->flags);
        spin_unlock(&_minor_lock);
diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
index f38ec424872e..5615522f8d62 100644
--- a/drivers/mfd/kempld-core.c
+++ b/drivers/mfd/kempld-core.c
@@ -739,7 +739,7 @@ static int __init kempld_init(void)
                for (id = kempld_dmi_table;
                     id->matches[0].slot != DMI_NONE; id++)
                        if (strstr(id->ident, force_device_id))
-                                if (id->callback && id->callback(id))
+                                if (id->callback && !id->callback(id))
                                        break;
                if (id->matches[0].slot == DMI_NONE)
                        return -ENODEV;
diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
index ede50244f265..dbd907d7170e 100644
--- a/drivers/mfd/rtsx_usb.c
+++ b/drivers/mfd/rtsx_usb.c
@@ -196,18 +196,27 @@ EXPORT_SYMBOL_GPL(rtsx_usb_ep0_write_register);
 int rtsx_usb_ep0_read_register(struct rtsx_ucr *ucr, u16 addr, u8 *data)
 {
        u16 value;
+        u8 *buf;
+        int ret;
        if (!data)
                return -EINVAL;
-        *data = 0;
+        buf = kzalloc(sizeof(u8), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
        addr |= EP0_READ_REG_CMD << EP0_OP_SHIFT;
        value = swab16(addr);
-        return usb_control_msg(ucr->pusb_dev,
+        ret = usb_control_msg(ucr->pusb_dev,
                        usb_rcvctrlpipe(ucr->pusb_dev, 0), RTSX_USB_REQ_REG_OP,
                        USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                        value, 0, data, 1, 100);
+                        value, 0, buf, 1, 100);
+        *data = *buf;
+        kfree(buf);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(rtsx_usb_ep0_read_register);
@@ -288,18 +297,27 @@ static int rtsx_usb_get_status_with_bulk(struct rtsx_ucr *ucr, u16 *status)
 int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status)
 {
        int ret;
+        u16 *buf;
        if (!status)
                return -EINVAL;
-        if (polling_pipe == 0)
+        if (polling_pipe == 0) {
+                buf = kzalloc(sizeof(u16), GFP_KERNEL);
+                if (!buf)
+                        return -ENOMEM;
                ret = usb_control_msg(ucr->pusb_dev,
                                usb_rcvctrlpipe(ucr->pusb_dev, 0),
                                RTSX_USB_REQ_POLL,
                                USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                                0, 0, status, 2, 100);
+                                0, 0, buf, 2, 100);
-        else
+                *status = *buf;
+                kfree(buf);
+        } else {
                ret = rtsx_usb_get_status_with_bulk(ucr, status);
+        }
        /* usb_control_msg may return positive when success */
        if (ret < 0)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b979c265fc51..089a4028859d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3850,7 +3850,8 @@ static inline int bond_slave_override(struct bonding *bond,
        /* Find out if any slaves have the same mapping as this skb. */
        bond_for_each_slave_rcu(bond, slave, iter) {
                if (slave->queue_id == skb->queue_mapping) {
-                        if (bond_slave_can_tx(slave)) {
+                        if (bond_slave_is_up(slave) &&
+                            slave->link == BOND_LINK_UP) {
                                bond_dev_queue_xmit(bond, skb, slave->dev);
                                return 0;
                        }
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 80c46ad4cee4..ad0a7e8c2c2b 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -592,13 +592,12 @@ static int flexcan_poll_state(struct net_device *dev, u32 reg_esr)
                rx_state = unlikely(reg_esr & FLEXCAN_ESR_RX_WRN) ?
                           CAN_STATE_ERROR_WARNING : CAN_STATE_ERROR_ACTIVE;
                new_state = max(tx_state, rx_state);
-        } else if (unlikely(flt == FLEXCAN_ESR_FLT_CONF_PASSIVE)) {
+        } else {
                __flexcan_get_berr_counter(dev, &bec);
-                new_state = CAN_STATE_ERROR_PASSIVE;
+                new_state = flt == FLEXCAN_ESR_FLT_CONF_PASSIVE ?
+                            CAN_STATE_ERROR_PASSIVE : CAN_STATE_BUS_OFF;
                rx_state = bec.rxerr >= bec.txerr ? new_state : 0;
                tx_state = bec.rxerr <= bec.txerr ? new_state : 0;
-        } else {
-                new_state = CAN_STATE_BUS_OFF;
        }
        /* state hasn't changed */
@@ -1158,12 +1157,19 @@ static int flexcan_probe(struct platform_device *pdev)
        const struct flexcan_devtype_data *devtype_data;
        struct net_device *dev;
        struct flexcan_priv *priv;
+        struct regulator *reg_xceiver;
        struct resource *mem;
        struct clk *clk_ipg = NULL, *clk_per = NULL;
        void __iomem *base;
        int err, irq;
        u32 clock_freq = 0;
+        reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
+        if (PTR_ERR(reg_xceiver) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
+        else if (IS_ERR(reg_xceiver))
+                reg_xceiver = NULL;
        if (pdev->dev.of_node)
                of_property_read_u32(pdev->dev.of_node,
                                                "clock-frequency", &clock_freq);
@@ -1224,9 +1230,7 @@ static int flexcan_probe(struct platform_device *pdev)
        priv->pdata = dev_get_platdata(&pdev->dev);
        priv->devtype_data = devtype_data;
-        priv->reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
+        priv->reg_xceiver = reg_xceiver;
-        if (IS_ERR(priv->reg_xceiver))
-                priv->reg_xceiver = NULL;
        netif_napi_add(dev, &priv->napi, flexcan_poll, FLEXCAN_NAPI_WEIGHT);
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 009acc8641fc..8b4d3e6875eb 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -901,6 +901,8 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *
        }
        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
        init_usb_anchor(&dev->rx_submitted);
        atomic_set(&dev->active_channels, 0);
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index e97a08ce0b90..57611fd91229 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -25,7 +25,6 @@
 #include <linux/can/dev.h>
 #include <linux/can/error.h>
-#define MAX_TX_URBS                     16
 #define MAX_RX_URBS                     4
 #define START_TIMEOUT                   1000 /* msecs */
 #define STOP_TIMEOUT                    1000 /* msecs */
@@ -443,6 +442,7 @@ struct kvaser_usb_error_summary {
        };
 };
+/* Context for an outstanding, not yet ACKed, transmission */
 struct kvaser_usb_tx_urb_context {
        struct kvaser_usb_net_priv *priv;
        u32 echo_index;
@@ -456,8 +456,13 @@ struct kvaser_usb {
        struct usb_endpoint_descriptor *bulk_in, *bulk_out;
        struct usb_anchor rx_submitted;
+        /* @max_tx_urbs: Firmware-reported maximum number of oustanding,
+         * not yet ACKed, transmissions on this device. This value is
+         * also used as a sentinel for marking free tx contexts.
+         */
        u32 fw_version;
        unsigned int nchannels;
+        unsigned int max_tx_urbs;
        enum kvaser_usb_family family;
        bool rxinitdone;
@@ -467,19 +472,18 @@ struct kvaser_usb {
 struct kvaser_usb_net_priv {
        struct can_priv can;
+        struct can_berr_counter bec;
-        spinlock_t tx_contexts_lock;
-        int active_tx_contexts;
-        struct kvaser_usb_tx_urb_context tx_contexts[MAX_TX_URBS];
-        struct usb_anchor tx_submitted;
-        struct completion start_comp, stop_comp;
        struct kvaser_usb *dev;
        struct net_device *netdev;
        int channel;
-        struct can_berr_counter bec;
+        struct completion start_comp, stop_comp;
+        struct usb_anchor tx_submitted;
+        spinlock_t tx_contexts_lock;
+        int active_tx_contexts;
+        struct kvaser_usb_tx_urb_context tx_contexts[];
 };
 static const struct usb_device_id kvaser_usb_table[] = {
@@ -592,8 +596,8 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
                         * for further details.
                         */
                        if (tmp->len == 0) {
-                                pos = round_up(pos,
+                                pos = round_up(pos, le16_to_cpu(dev->bulk_in->
-                                               dev->bulk_in->wMaxPacketSize);
+                                                                wMaxPacketSize));
                                continue;
                        }
@@ -657,9 +661,13 @@ static int kvaser_usb_get_software_info(struct kvaser_usb *dev)
        switch (dev->family) {
        case KVASER_LEAF:
                dev->fw_version = le32_to_cpu(msg.u.leaf.softinfo.fw_version);
+                dev->max_tx_urbs =
+                        le16_to_cpu(msg.u.leaf.softinfo.max_outstanding_tx);
                break;
        case KVASER_USBCAN:
                dev->fw_version = le32_to_cpu(msg.u.usbcan.softinfo.fw_version);
+                dev->max_tx_urbs =
+                        le16_to_cpu(msg.u.usbcan.softinfo.max_outstanding_tx);
                break;
        }
@@ -715,7 +723,7 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
        stats = &priv->netdev->stats;
-        context = &priv->tx_contexts[tid % MAX_TX_URBS];
+        context = &priv->tx_contexts[tid % dev->max_tx_urbs];
        /* Sometimes the state change doesn't come after a bus-off event */
        if (priv->can.restart_ms &&
@@ -744,7 +752,7 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
        can_get_echo_skb(priv->netdev, context->echo_index);
-        context->echo_index = MAX_TX_URBS;
+        context->echo_index = dev->max_tx_urbs;
        --priv->active_tx_contexts;
        netif_wake_queue(priv->netdev);
@@ -1329,7 +1337,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
                 * number of events in case of a heavy rx load on the bus.
                 */
                if (msg->len == 0) {
-                        pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
+                        pos = round_up(pos, le16_to_cpu(dev->bulk_in->
+                                                        wMaxPacketSize));
                        continue;
                }
@@ -1512,11 +1521,13 @@ error:
 static void kvaser_usb_reset_tx_urb_contexts(struct kvaser_usb_net_priv *priv)
 {
-        int i;
+        int i, max_tx_urbs;
+        max_tx_urbs = priv->dev->max_tx_urbs;
        priv->active_tx_contexts = 0;
-        for (i = 0; i < MAX_TX_URBS; i++)
+        for (i = 0; i < max_tx_urbs; i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
+                priv->tx_contexts[i].echo_index = max_tx_urbs;
 }
 /* This method might sleep. Do not call it in the atomic context
@@ -1702,14 +1713,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                *msg_tx_can_flags |= MSG_FLAG_REMOTE_FRAME;
        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
-        for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++) {
+        for (i = 0; i < dev->max_tx_urbs; i++) {
-                if (priv->tx_contexts[i].echo_index == MAX_TX_URBS) {
+                if (priv->tx_contexts[i].echo_index == dev->max_tx_urbs) {
                        context = &priv->tx_contexts[i];
                        context->echo_index = i;
                        can_put_echo_skb(skb, netdev, context->echo_index);
                        ++priv->active_tx_contexts;
-                        if (priv->active_tx_contexts >= MAX_TX_URBS)
+                        if (priv->active_tx_contexts >= dev->max_tx_urbs)
                                netif_stop_queue(netdev);
                        break;
@@ -1743,7 +1754,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                spin_lock_irqsave(&priv->tx_contexts_lock, flags);
                can_free_echo_skb(netdev, context->echo_index);
-                context->echo_index = MAX_TX_URBS;
+                context->echo_index = dev->max_tx_urbs;
                --priv->active_tx_contexts;
                netif_wake_queue(netdev);
@@ -1881,7 +1892,9 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
        if (err)
                return err;
-        netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS);
+        netdev = alloc_candev(sizeof(*priv) +
+                              dev->max_tx_urbs * sizeof(*priv->tx_contexts),
+                              dev->max_tx_urbs);
        if (!netdev) {
                dev_err(&intf->dev, "Cannot alloc candev\n");
                return -ENOMEM;
@@ -2009,6 +2022,13 @@ static int kvaser_usb_probe(struct usb_interface *intf,
                return err;
        }
+        dev_dbg(&intf->dev, "Firmware version: %d.%d.%d\n",
+                ((dev->fw_version >> 24) & 0xff),
+                ((dev->fw_version >> 16) & 0xff),
+                (dev->fw_version & 0xffff));
+        dev_dbg(&intf->dev, "Max oustanding tx = %d URBs\n", dev->max_tx_urbs);
        err = kvaser_usb_get_card_info(dev);
        if (err) {
                dev_err(&intf->dev,
@@ -2016,11 +2036,6 @@ static int kvaser_usb_probe(struct usb_interface *intf,
                return err;
        }
-        dev_dbg(&intf->dev, "Firmware version: %d.%d.%d\n",
-                ((dev->fw_version >> 24) & 0xff),
-                ((dev->fw_version >> 16) & 0xff),
-                (dev->fw_version & 0xffff));
        for (i = 0; i < dev->nchannels; i++) {
                err = kvaser_usb_init_one(intf, id, i);
                if (err) {
diff --git a/drivers/net/can/usb/peak_usb/pcan_ucan.h b/drivers/net/can/usb/peak_usb/pcan_ucan.h
index 1ba7c25002e1..e8fc4952c6b0 100644
--- a/drivers/net/can/usb/peak_usb/pcan_ucan.h
+++ b/drivers/net/can/usb/peak_usb/pcan_ucan.h
@@ -26,8 +26,8 @@
 #define PUCAN_CMD_FILTER_STD            0x008
 #define PUCAN_CMD_TX_ABORT              0x009
 #define PUCAN_CMD_WR_ERR_CNT            0x00a
-#define PUCAN_CMD_RX_FRAME_ENABLE       0x00b
+#define PUCAN_CMD_SET_EN_OPTION         0x00b
-#define PUCAN_CMD_RX_FRAME_DISABLE      0x00c
+#define PUCAN_CMD_CLR_DIS_OPTION        0x00c
 #define PUCAN_CMD_END_OF_COLLECTION     0x3ff
 /* uCAN received messages list */
@@ -101,14 +101,15 @@ struct __packed pucan_wr_err_cnt {
        u16     unused;
 };
-/* uCAN RX_FRAME_ENABLE command fields */
+/* uCAN SET_EN/CLR_DIS _OPTION command fields */
-#define PUCAN_FLTEXT_ERROR              0x0001
+#define PUCAN_OPTION_ERROR              0x0001
-#define PUCAN_FLTEXT_BUSLOAD            0x0002
+#define PUCAN_OPTION_BUSLOAD            0x0002
+#define PUCAN_OPTION_CANDFDISO          0x0004
-struct __packed pucan_filter_ext {
+struct __packed pucan_options {
        __le16  opcode_channel;
-        __le16  ext_mask;
+        __le16  options;
        u32     unused;
 };
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index 0bac0f14edc3..a9221ad9f1a0 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -110,13 +110,13 @@ struct __packed pcan_ufd_led {
        u8      unused[5];
 };
-/* Extended usage of uCAN commands CMD_RX_FRAME_xxxABLE for PCAN-USB Pro FD */
+/* Extended usage of uCAN commands CMD_xxx_xx_OPTION for PCAN-USB Pro FD */
 #define PCAN_UFD_FLTEXT_CALIBRATION     0x8000
-struct __packed pcan_ufd_filter_ext {
+struct __packed pcan_ufd_options {
        __le16  opcode_channel;
-        __le16  ext_mask;
+        __le16  ucan_mask;
        u16     unused;
        __le16  usb_mask;
 };
@@ -251,6 +251,27 @@ static int pcan_usb_fd_build_restart_cmd(struct peak_usb_device *dev, u8 *buf)
        /* moves the pointer forward */
        pc += sizeof(struct pucan_wr_err_cnt);
+        /* add command to switch from ISO to non-ISO mode, if fw allows it */
+        if (dev->can.ctrlmode_supported & CAN_CTRLMODE_FD_NON_ISO) {
+                struct pucan_options *puo = (struct pucan_options *)pc;
+                puo->opcode_channel =
+                        (dev->can.ctrlmode & CAN_CTRLMODE_FD_NON_ISO) ?
+                        pucan_cmd_opcode_channel(dev,
+                                                 PUCAN_CMD_CLR_DIS_OPTION) :
+                        pucan_cmd_opcode_channel(dev, PUCAN_CMD_SET_EN_OPTION);
+                puo->options = cpu_to_le16(PUCAN_OPTION_CANDFDISO);
+                /* to be sure that no other extended bits will be taken into
+                 * account
+                 */
+                puo->unused = 0;
+                /* moves the pointer forward */
+                pc += sizeof(struct pucan_options);
+        }
        /* next, go back to operational mode */
        cmd = (struct pucan_command *)pc;
        cmd->opcode_channel = pucan_cmd_opcode_channel(dev,
@@ -321,21 +342,21 @@ static int pcan_usb_fd_set_filter_std(struct peak_usb_device *dev, int idx,
        return pcan_usb_fd_send_cmd(dev, cmd);
 }
-/* set/unset notifications filter:
+/* set/unset options
 *
- *      onoff   sets(1)/unset(0) notifications
+ *      onoff   set(1)/unset(0) options
- *      mask    each bit defines a kind of notification to set/unset
+ *      mask    each bit defines a kind of options to set/unset
 */
-static int pcan_usb_fd_set_filter_ext(struct peak_usb_device *dev,
+static int pcan_usb_fd_set_options(struct peak_usb_device *dev,
-                                      bool onoff, u16 ext_mask, u16 usb_mask)
+                                   bool onoff, u16 ucan_mask, u16 usb_mask)
 {
-        struct pcan_ufd_filter_ext *cmd = pcan_usb_fd_cmd_buffer(dev);
+        struct pcan_ufd_options *cmd = pcan_usb_fd_cmd_buffer(dev);
        cmd->opcode_channel = pucan_cmd_opcode_channel(dev,
-                                        (onoff) ? PUCAN_CMD_RX_FRAME_ENABLE :
+                                        (onoff) ? PUCAN_CMD_SET_EN_OPTION :
-                                                  PUCAN_CMD_RX_FRAME_DISABLE);
+                                                  PUCAN_CMD_CLR_DIS_OPTION);
-        cmd->ext_mask = cpu_to_le16(ext_mask);
+        cmd->ucan_mask = cpu_to_le16(ucan_mask);
        cmd->usb_mask = cpu_to_le16(usb_mask);
        /* send the command */
@@ -770,9 +791,9 @@ static int pcan_usb_fd_start(struct peak_usb_device *dev)
                                       &pcan_usb_pro_fd);
                /* enable USB calibration messages */
-                err = pcan_usb_fd_set_filter_ext(dev, 1,
+                err = pcan_usb_fd_set_options(dev, 1,
-                                                 PUCAN_FLTEXT_ERROR,
+                                              PUCAN_OPTION_ERROR,
-                                                 PCAN_UFD_FLTEXT_CALIBRATION);
+                                              PCAN_UFD_FLTEXT_CALIBRATION);
        }
        pdev->usb_if->dev_opened_count++;
@@ -806,9 +827,9 @@ static int pcan_usb_fd_stop(struct peak_usb_device *dev)
        /* turn off special msgs for that interface if no other dev opened */
        if (pdev->usb_if->dev_opened_count == 1)
-                pcan_usb_fd_set_filter_ext(dev, 0,
+                pcan_usb_fd_set_options(dev, 0,
-                                           PUCAN_FLTEXT_ERROR,
+                                        PUCAN_OPTION_ERROR,
-                                           PCAN_UFD_FLTEXT_CALIBRATION);
+                                        PCAN_UFD_FLTEXT_CALIBRATION);
        pdev->usb_if->dev_opened_count--;
        return 0;
@@ -860,8 +881,14 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev)
                         pdev->usb_if->fw_info.fw_version[2],
                         dev->adapter->ctrl_count);
-                /* the currently supported hw is non-ISO */
+                /* check for ability to switch between ISO/non-ISO modes */
-                dev->can.ctrlmode = CAN_CTRLMODE_FD_NON_ISO;
+                if (pdev->usb_if->fw_info.fw_version[0] >= 2) {
+                        /* firmware >= 2.x supports ISO/non-ISO switching */
+                        dev->can.ctrlmode_supported |= CAN_CTRLMODE_FD_NON_ISO;
+                } else {
+                        /* firmware < 2.x only supports fixed(!) non-ISO */
+                        dev->can.ctrlmode |= CAN_CTRLMODE_FD_NON_ISO;
+                }
                /* tell the hardware the can driver is running */
                err = pcan_usb_fd_drv_loaded(dev, 1);
@@ -937,9 +964,9 @@ static void pcan_usb_fd_exit(struct peak_usb_device *dev)
        if (dev->ctrl_idx == 0) {
                /* turn off calibration message if any device were opened */
                if (pdev->usb_if->dev_opened_count > 0)
-                        pcan_usb_fd_set_filter_ext(dev, 0,
+                        pcan_usb_fd_set_options(dev, 0,
-                                                   PUCAN_FLTEXT_ERROR,
+                                                PUCAN_OPTION_ERROR,
-                                                   PCAN_UFD_FLTEXT_CALIBRATION);
+                                                PCAN_UFD_FLTEXT_CALIBRATION);
                /* tell USB adapter that the driver is being unloaded */
                pcan_usb_fd_drv_loaded(dev, 0);
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index 11d6e6561df1..15a8190a6f75 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1543,7 +1543,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 {
        struct pcnet32_private *lp;
        int i, media;
-        int fdx, mii, fset, dxsuflo;
+        int fdx, mii, fset, dxsuflo, sram;
        int chip_version;
        char *chipname;
        struct net_device *dev;
@@ -1580,7 +1580,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        }
        /* initialize variables */
-        fdx = mii = fset = dxsuflo = 0;
+        fdx = mii = fset = dxsuflo = sram = 0;
        chip_version = (chip_version >> 12) & 0xffff;
        switch (chip_version) {
@@ -1613,6 +1613,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                chipname = "PCnet/FAST III 79C973";     /* PCI */
                fdx = 1;
                mii = 1;
+                sram = 1;
                break;
        case 0x2626:
                chipname = "PCnet/Home 79C978"; /* PCI */
@@ -1636,6 +1637,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                chipname = "PCnet/FAST III 79C975";     /* PCI */
                fdx = 1;
                mii = 1;
+                sram = 1;
                break;
        case 0x2628:
                chipname = "PCnet/PRO 79C976";
@@ -1664,6 +1666,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                dxsuflo = 1;
        }
+        /*
+         * The Am79C973/Am79C975 controllers come with 12K of SRAM
+         * which we can use for the Tx/Rx buffers but most importantly,
+         * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
+         * Tx fifo underflows.
+         */
+        if (sram) {
+                /*
+                 * The SRAM is being configured in two steps. First we
+                 * set the SRAM size in the BCR25:SRAM_SIZE bits. According
+                 * to the datasheet, each bit corresponds to a 512-byte
+                 * page so we can have at most 24 pages. The SRAM_SIZE
+                 * holds the value of the upper 8 bits of the 16-bit SRAM size.
+                 * The low 8-bits start at 0x00 and end at 0xff. So the
+                 * address range is from 0x0000 up to 0x17ff. Therefore,
+                 * the SRAM_SIZE is set to 0x17. The next step is to set
+                 * the BCR26:SRAM_BND midway through so the Tx and Rx
+                 * buffers can share the SRAM equally.
+                 */
+                a->write_bcr(ioaddr, 25, 0x17);
+                a->write_bcr(ioaddr, 26, 0xc);
+                /* And finally enable the NOUFLO bit */
+                a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
+        }
        dev = alloc_etherdev(sizeof(*lp));
        if (!dev) {
                ret = -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 756053c028be..4085c4b31047 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1811,7 +1811,7 @@ struct bnx2x {
        int                     stats_state;
        /* used for synchronization of concurrent threads statistics handling */
-        spinlock_t              stats_lock;
+        struct mutex            stats_lock;
        /* used by dmae command loader */
        struct dmae_command     stats_dmae;
@@ -1935,8 +1935,6 @@ struct bnx2x {
        int fp_array_size;
        u32 dump_preset_idx;
-        bool                                    stats_started;
-        struct semaphore                        stats_sema;
        u8                                      phys_port_id[ETH_ALEN];
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 996e215fc324..1ec635f54994 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -129,8 +129,8 @@ struct bnx2x_mac_vals {
        u32 xmac_val;
        u32 emac_addr;
        u32 emac_val;
-        u32 umac_addr;
+        u32 umac_addr[2];
-        u32 umac_val;
+        u32 umac_val[2];
        u32 bmac_addr;
        u32 bmac_val[2];
 };
@@ -7866,6 +7866,20 @@ int bnx2x_init_hw_func_cnic(struct bnx2x *bp)
        return 0;
 }
+/* previous driver DMAE transaction may have occurred when pre-boot stage ended
+ * and boot began, or when kdump kernel was loaded. Either case would invalidate
+ * the addresses of the transaction, resulting in was-error bit set in the pci
+ * causing all hw-to-host pcie transactions to timeout. If this happened we want
+ * to clear the interrupt which detected this from the pglueb and the was done
+ * bit
+ */
+static void bnx2x_clean_pglue_errors(struct bnx2x *bp)
+{
+        if (!CHIP_IS_E1x(bp))
+                REG_WR(bp, PGLUE_B_REG_WAS_ERROR_PF_7_0_CLR,
+                       1 << BP_ABS_FUNC(bp));
+}
 static int bnx2x_init_hw_func(struct bnx2x *bp)
 {
        int port = BP_PORT(bp);
@@ -7958,8 +7972,7 @@ static int bnx2x_init_hw_func(struct bnx2x *bp)
        bnx2x_init_block(bp, BLOCK_PGLUE_B, init_phase);
-        if (!CHIP_IS_E1x(bp))
+        bnx2x_clean_pglue_errors(bp);
-                REG_WR(bp, PGLUE_B_REG_WAS_ERROR_PF_7_0_CLR, func);
        bnx2x_init_block(bp, BLOCK_ATC, init_phase);
        bnx2x_init_block(bp, BLOCK_DMAE, init_phase);
@@ -10141,6 +10154,25 @@ static u32 bnx2x_get_pretend_reg(struct bnx2x *bp)
        return base + (BP_ABS_FUNC(bp)) * stride;
 }
+static bool bnx2x_prev_unload_close_umac(struct bnx2x *bp,
+                                         u8 port, u32 reset_reg,
+                                         struct bnx2x_mac_vals *vals)
+{
+        u32 mask = MISC_REGISTERS_RESET_REG_2_UMAC0 << port;
+        u32 base_addr;
+        if (!(mask & reset_reg))
+                return false;
+        BNX2X_DEV_INFO("Disable umac Rx %02x\n", port);
+        base_addr = port ? GRCBASE_UMAC1 : GRCBASE_UMAC0;
+        vals->umac_addr[port] = base_addr + UMAC_REG_COMMAND_CONFIG;
+        vals->umac_val[port] = REG_RD(bp, vals->umac_addr[port]);
+        REG_WR(bp, vals->umac_addr[port], 0);
+        return true;
+}
 static void bnx2x_prev_unload_close_mac(struct bnx2x *bp,
                                        struct bnx2x_mac_vals *vals)
 {
@@ -10149,10 +10181,7 @@ static void bnx2x_prev_unload_close_mac(struct bnx2x *bp,
        u8 port = BP_PORT(bp);
        /* reset addresses as they also mark which values were changed */
-        vals->bmac_addr = 0;
+        memset(vals, 0, sizeof(*vals));
-        vals->umac_addr = 0;
-        vals->xmac_addr = 0;
-        vals->emac_addr = 0;
        reset_reg = REG_RD(bp, MISC_REG_RESET_REG_2);
@@ -10201,15 +10230,11 @@ static void bnx2x_prev_unload_close_mac(struct bnx2x *bp,
                        REG_WR(bp, vals->xmac_addr, 0);
                        mac_stopped = true;
                }
-                mask = MISC_REGISTERS_RESET_REG_2_UMAC0 << port;
-                if (mask & reset_reg) {
+                mac_stopped |= bnx2x_prev_unload_close_umac(bp, 0,
-                        BNX2X_DEV_INFO("Disable umac Rx\n");
+                                                            reset_reg, vals);
-                        base_addr = BP_PORT(bp) ? GRCBASE_UMAC1 : GRCBASE_UMAC0;
+                mac_stopped |= bnx2x_prev_unload_close_umac(bp, 1,
-                        vals->umac_addr = base_addr + UMAC_REG_COMMAND_CONFIG;
+                                                            reset_reg, vals);
-                        vals->umac_val = REG_RD(bp, vals->umac_addr);
-                        REG_WR(bp, vals->umac_addr, 0);
-                        mac_stopped = true;
-                }
        }
        if (mac_stopped)
@@ -10505,8 +10530,11 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
                /* Close the MAC Rx to prevent BRB from filling up */
                bnx2x_prev_unload_close_mac(bp, &mac_vals);
-                /* close LLH filters towards the BRB */
+                /* close LLH filters for both ports towards the BRB */
                bnx2x_set_rx_filter(&bp->link_params, 0);
+                bp->link_params.port ^= 1;
+                bnx2x_set_rx_filter(&bp->link_params, 0);
+                bp->link_params.port ^= 1;
                /* Check if the UNDI driver was previously loaded */
                if (bnx2x_prev_is_after_undi(bp)) {
@@ -10553,8 +10581,10 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
        if (mac_vals.xmac_addr)
                REG_WR(bp, mac_vals.xmac_addr, mac_vals.xmac_val);
-        if (mac_vals.umac_addr)
+        if (mac_vals.umac_addr[0])
-                REG_WR(bp, mac_vals.umac_addr, mac_vals.umac_val);
+                REG_WR(bp, mac_vals.umac_addr[0], mac_vals.umac_val[0]);
+        if (mac_vals.umac_addr[1])
+                REG_WR(bp, mac_vals.umac_addr[1], mac_vals.umac_val[1]);
        if (mac_vals.emac_addr)
                REG_WR(bp, mac_vals.emac_addr, mac_vals.emac_val);
        if (mac_vals.bmac_addr) {
@@ -10571,26 +10601,6 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
        return bnx2x_prev_mcp_done(bp);
 }
-/* previous driver DMAE transaction may have occurred when pre-boot stage ended
- * and boot began, or when kdump kernel was loaded. Either case would invalidate
- * the addresses of the transaction, resulting in was-error bit set in the pci
- * causing all hw-to-host pcie transactions to timeout. If this happened we want
- * to clear the interrupt which detected this from the pglueb and the was done
- * bit
- */
-static void bnx2x_prev_interrupted_dmae(struct bnx2x *bp)
-{
-        if (!CHIP_IS_E1x(bp)) {
-                u32 val = REG_RD(bp, PGLUE_B_REG_PGLUE_B_INT_STS);
-                if (val & PGLUE_B_PGLUE_B_INT_STS_REG_WAS_ERROR_ATTN) {
-                        DP(BNX2X_MSG_SP,
-                           "'was error' bit was found to be set in pglueb upon startup. Clearing\n");
-                        REG_WR(bp, PGLUE_B_REG_WAS_ERROR_PF_7_0_CLR,
-                               1 << BP_FUNC(bp));
-                }
-        }
-}
 static int bnx2x_prev_unload(struct bnx2x *bp)
 {
        int time_counter = 10;
@@ -10600,7 +10610,7 @@ static int bnx2x_prev_unload(struct bnx2x *bp)
        /* clear hw from errors which may have resulted from an interrupted
         * dmae transaction.
         */
-        bnx2x_prev_interrupted_dmae(bp);
+        bnx2x_clean_pglue_errors(bp);
        /* Release previously held locks */
        hw_lock_reg = (BP_FUNC(bp) <= 5) ?
@@ -12037,9 +12047,8 @@ static int bnx2x_init_bp(struct bnx2x *bp)
        mutex_init(&bp->port.phy_mutex);
        mutex_init(&bp->fw_mb_mutex);
        mutex_init(&bp->drv_info_mutex);
+        mutex_init(&bp->stats_lock);
        bp->drv_info_mng_owner = false;
-        spin_lock_init(&bp->stats_lock);
-        sema_init(&bp->stats_sema, 1);
        INIT_DELAYED_WORK(&bp->sp_task, bnx2x_sp_task);
        INIT_DELAYED_WORK(&bp->sp_rtnl_task, bnx2x_sp_rtnl_task);
@@ -13668,9 +13677,9 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
        cancel_delayed_work_sync(&bp->sp_task);
        cancel_delayed_work_sync(&bp->period_task);
-        spin_lock_bh(&bp->stats_lock);
+        mutex_lock(&bp->stats_lock);
        bp->stats_state = STATS_STATE_DISABLED;
-        spin_unlock_bh(&bp->stats_lock);
+        mutex_unlock(&bp->stats_lock);
        bnx2x_save_statistics(bp);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index e5aca2de1871..cfe3c7695455 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -2238,7 +2238,9 @@ int bnx2x_vf_close(struct bnx2x *bp, struct bnx2x_virtf *vf)
                cookie.vf = vf;
                cookie.state = VF_ACQUIRED;
-                bnx2x_stats_safe_exec(bp, bnx2x_set_vf_state, &cookie);
+                rc = bnx2x_stats_safe_exec(bp, bnx2x_set_vf_state, &cookie);
+                if (rc)
+                        goto op_err;
        }
        DP(BNX2X_MSG_IOV, "set state to acquired\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index d1608297c773..800ab44a07ce 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -123,36 +123,28 @@ static void bnx2x_dp_stats(struct bnx2x *bp)
 */
 static void bnx2x_storm_stats_post(struct bnx2x *bp)
 {
-        if (!bp->stats_pending) {
+        int rc;
-                int rc;
-                spin_lock_bh(&bp->stats_lock);
+        if (bp->stats_pending)
+                return;
-                if (bp->stats_pending) {
-                        spin_unlock_bh(&bp->stats_lock);
-                        return;
-                }
-                bp->fw_stats_req->hdr.drv_stats_counter =
-                        cpu_to_le16(bp->stats_counter++);
-                DP(BNX2X_MSG_STATS, "Sending statistics ramrod %d\n",
+        bp->fw_stats_req->hdr.drv_stats_counter =
-                   le16_to_cpu(bp->fw_stats_req->hdr.drv_stats_counter));
+                cpu_to_le16(bp->stats_counter++);
-                /* adjust the ramrod to include VF queues statistics */
+        DP(BNX2X_MSG_STATS, "Sending statistics ramrod %d\n",
-                bnx2x_iov_adjust_stats_req(bp);
+           le16_to_cpu(bp->fw_stats_req->hdr.drv_stats_counter));
-                bnx2x_dp_stats(bp);
-                /* send FW stats ramrod */
+        /* adjust the ramrod to include VF queues statistics */
-                rc = bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_STAT_QUERY, 0,
+        bnx2x_iov_adjust_stats_req(bp);
-                                   U64_HI(bp->fw_stats_req_mapping),
+        bnx2x_dp_stats(bp);
-                                   U64_LO(bp->fw_stats_req_mapping),
-                                   NONE_CONNECTION_TYPE);
-                if (rc == 0)
-                        bp->stats_pending = 1;
-                spin_unlock_bh(&bp->stats_lock);
+        /* send FW stats ramrod */
-        }
+        rc = bnx2x_sp_post(bp, RAMROD_CMD_ID_COMMON_STAT_QUERY, 0,
+                           U64_HI(bp->fw_stats_req_mapping),
+                           U64_LO(bp->fw_stats_req_mapping),
+                           NONE_CONNECTION_TYPE);
+        if (rc == 0)
+                bp->stats_pending = 1;
 }
 static void bnx2x_hw_stats_post(struct bnx2x *bp)
@@ -221,7 +213,7 @@ static void bnx2x_stats_comp(struct bnx2x *bp)
 */
 /* should be called under stats_sema */
-static void __bnx2x_stats_pmf_update(struct bnx2x *bp)
+static void bnx2x_stats_pmf_update(struct bnx2x *bp)
 {
        struct dmae_command *dmae;
        u32 opcode;
@@ -519,7 +511,7 @@ static void bnx2x_func_stats_init(struct bnx2x *bp)
 }
 /* should be called under stats_sema */
-static void __bnx2x_stats_start(struct bnx2x *bp)
+static void bnx2x_stats_start(struct bnx2x *bp)
 {
        if (IS_PF(bp)) {
                if (bp->port.pmf)
@@ -531,34 +523,13 @@ static void __bnx2x_stats_start(struct bnx2x *bp)
                bnx2x_hw_stats_post(bp);
                bnx2x_storm_stats_post(bp);
        }
-        bp->stats_started = true;
-}
-static void bnx2x_stats_start(struct bnx2x *bp)
-{
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
-        __bnx2x_stats_start(bp);
-        up(&bp->stats_sema);
 }
 static void bnx2x_stats_pmf_start(struct bnx2x *bp)
 {
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
        bnx2x_stats_comp(bp);
-        __bnx2x_stats_pmf_update(bp);
+        bnx2x_stats_pmf_update(bp);
-        __bnx2x_stats_start(bp);
+        bnx2x_stats_start(bp);
-        up(&bp->stats_sema);
-}
-static void bnx2x_stats_pmf_update(struct bnx2x *bp)
-{
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
-        __bnx2x_stats_pmf_update(bp);
-        up(&bp->stats_sema);
 }
 static void bnx2x_stats_restart(struct bnx2x *bp)
@@ -568,11 +539,9 @@ static void bnx2x_stats_restart(struct bnx2x *bp)
         */
        if (IS_VF(bp))
                return;
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
        bnx2x_stats_comp(bp);
-        __bnx2x_stats_start(bp);
+        bnx2x_stats_start(bp);
-        up(&bp->stats_sema);
 }
 static void bnx2x_bmac_stats_update(struct bnx2x *bp)
@@ -1246,18 +1215,12 @@ static void bnx2x_stats_update(struct bnx2x *bp)
 {
        u32 *stats_comp = bnx2x_sp(bp, stats_comp);
-        /* we run update from timer context, so give up
+        if (bnx2x_edebug_stats_stopped(bp))
-         * if somebody is in the middle of transition
-         */
-        if (down_trylock(&bp->stats_sema))
                return;
-        if (bnx2x_edebug_stats_stopped(bp) || !bp->stats_started)
-                goto out;
        if (IS_PF(bp)) {
                if (*stats_comp != DMAE_COMP_VAL)
-                        goto out;
+                        return;
                if (bp->port.pmf)
                        bnx2x_hw_stats_update(bp);
@@ -1267,7 +1230,7 @@ static void bnx2x_stats_update(struct bnx2x *bp)
                                BNX2X_ERR("storm stats were not updated for 3 times\n");
                                bnx2x_panic();
                        }
-                        goto out;
+                        return;
                }
        } else {
                /* vf doesn't collect HW statistics, and doesn't get completions
@@ -1281,7 +1244,7 @@ static void bnx2x_stats_update(struct bnx2x *bp)
        /* vf is done */
        if (IS_VF(bp))
-                goto out;
+                return;
        if (netif_msg_timer(bp)) {
                struct bnx2x_eth_stats *estats = &bp->eth_stats;
@@ -1292,9 +1255,6 @@ static void bnx2x_stats_update(struct bnx2x *bp)
        bnx2x_hw_stats_post(bp);
        bnx2x_storm_stats_post(bp);
-out:
-        up(&bp->stats_sema);
 }
 static void bnx2x_port_stats_stop(struct bnx2x *bp)
@@ -1358,12 +1318,7 @@ static void bnx2x_port_stats_stop(struct bnx2x *bp)
 static void bnx2x_stats_stop(struct bnx2x *bp)
 {
-        int update = 0;
+        bool update = false;
-        if (down_timeout(&bp->stats_sema, HZ/10))
-                BNX2X_ERR("Unable to acquire stats lock\n");
-        bp->stats_started = false;
        bnx2x_stats_comp(bp);
@@ -1381,8 +1336,6 @@ static void bnx2x_stats_stop(struct bnx2x *bp)
                bnx2x_hw_stats_post(bp);
                bnx2x_stats_comp(bp);
        }
-        up(&bp->stats_sema);
 }
 static void bnx2x_stats_do_nothing(struct bnx2x *bp)
@@ -1410,18 +1363,28 @@ static const struct {
 void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event)
 {
-        enum bnx2x_stats_state state;
+        enum bnx2x_stats_state state = bp->stats_state;
-        void (*action)(struct bnx2x *bp);
        if (unlikely(bp->panic))
                return;
-        spin_lock_bh(&bp->stats_lock);
+        /* Statistics update run from timer context, and we don't want to stop
-        state = bp->stats_state;
+         * that context in case someone is in the middle of a transition.
+         * For other events, wait a bit until lock is taken.
+         */
+        if (!mutex_trylock(&bp->stats_lock)) {
+                if (event == STATS_EVENT_UPDATE)
+                        return;
+                DP(BNX2X_MSG_STATS,
+                   "Unlikely stats' lock contention [event %d]\n", event);
+                mutex_lock(&bp->stats_lock);
+        }
+        bnx2x_stats_stm[state][event].action(bp);
        bp->stats_state = bnx2x_stats_stm[state][event].next_state;
-        action = bnx2x_stats_stm[state][event].action;
-        spin_unlock_bh(&bp->stats_lock);
-        action(bp);
+        mutex_unlock(&bp->stats_lock);
        if ((event != STATS_EVENT_UPDATE) || netif_msg_timer(bp))
                DP(BNX2X_MSG_STATS, "state %d -> event %d -> state %d\n",
@@ -1998,13 +1961,34 @@ void bnx2x_afex_collect_stats(struct bnx2x *bp, void *void_afex_stats,
        }
 }
-void bnx2x_stats_safe_exec(struct bnx2x *bp,
+int bnx2x_stats_safe_exec(struct bnx2x *bp,
-                           void (func_to_exec)(void *cookie),
+                          void (func_to_exec)(void *cookie),
-                           void *cookie){
+                          void *cookie)
-        if (down_timeout(&bp->stats_sema, HZ/10))
+{
-                BNX2X_ERR("Unable to acquire stats lock\n");
+        int cnt = 10, rc = 0;
+        /* Wait for statistics to end [while blocking further requests],
+         * then run supplied function 'safely'.
+         */
+        mutex_lock(&bp->stats_lock);
        bnx2x_stats_comp(bp);
+        while (bp->stats_pending && cnt--)
+                if (bnx2x_storm_stats_update(bp))
+                        usleep_range(1000, 2000);
+        if (bp->stats_pending) {
+                BNX2X_ERR("Failed to wait for stats pending to clear [possibly FW is stuck]\n");
+                rc = -EBUSY;
+                goto out;
+        }
        func_to_exec(cookie);
-        __bnx2x_stats_start(bp);
-        up(&bp->stats_sema);
+out:
+        /* No need to restart statistics - if they're enabled, the timer
+         * will restart the statistics.
+         */
+        mutex_unlock(&bp->stats_lock);
+        return rc;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
index 2beceaefdeea..965539a9dabe 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
@@ -539,9 +539,9 @@ struct bnx2x;
 void bnx2x_memset_stats(struct bnx2x *bp);
 void bnx2x_stats_init(struct bnx2x *bp);
 void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event);
-void bnx2x_stats_safe_exec(struct bnx2x *bp,
+int bnx2x_stats_safe_exec(struct bnx2x *bp,
-                           void (func_to_exec)(void *cookie),
+                          void (func_to_exec)(void *cookie),
-                           void *cookie);
+                          void *cookie);
 /**
 * bnx2x_save_statistics - save statistics when unloading.
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 97842d03675b..c6ff4890d171 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -376,8 +376,6 @@ enum {
 enum {
        INGQ_EXTRAS = 2,        /* firmware event queue and */
                                /*   forwarded interrupts */
-        MAX_EGRQ = MAX_ETH_QSETS*2 + MAX_OFLD_QSETS*2
-                   + MAX_CTRL_QUEUES + MAX_RDMA_QUEUES + MAX_ISCSI_QUEUES,
        MAX_INGQ = MAX_ETH_QSETS + MAX_OFLD_QSETS + MAX_RDMA_QUEUES
                   + MAX_RDMA_CIQS + MAX_ISCSI_QUEUES + INGQ_EXTRAS,
 };
@@ -616,11 +614,13 @@ struct sge {
        unsigned int idma_qid[2];   /* SGE IDMA Hung Ingress Queue ID */
        unsigned int egr_start;
+        unsigned int egr_sz;
        unsigned int ingr_start;
-        void *egr_map[MAX_EGRQ];    /* qid->queue egress queue map */
+        unsigned int ingr_sz;
-        struct sge_rspq *ingr_map[MAX_INGQ]; /* qid->queue ingress queue map */
+        void **egr_map;    /* qid->queue egress queue map */
-        DECLARE_BITMAP(starving_fl, MAX_EGRQ);
+        struct sge_rspq **ingr_map; /* qid->queue ingress queue map */
-        DECLARE_BITMAP(txq_maperr, MAX_EGRQ);
+        unsigned long *starving_fl;
+        unsigned long *txq_maperr;
        struct timer_list rx_timer; /* refills starving FLs */
        struct timer_list tx_timer; /* checks Tx queues */
 };
@@ -1136,6 +1136,8 @@ int cxgb4_t4_bar2_sge_qregs(struct adapter *adapter,
 unsigned int qtimer_val(const struct adapter *adap,
                        const struct sge_rspq *q);
+int t4_init_devlog_params(struct adapter *adapter);
 int t4_init_sge_params(struct adapter *adapter);
 int t4_init_tp_params(struct adapter *adap);
 int t4_filter_field_shift(const struct adapter *adap, int filter_sel);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
index 78854ceb0870..dcb047945290 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
@@ -670,9 +670,13 @@ static int cctrl_tbl_show(struct seq_file *seq, void *v)
                "0.9375" };
        int i;
-        u16 incr[NMTUS][NCCTRL_WIN];
+        u16 (*incr)[NCCTRL_WIN];
        struct adapter *adap = seq->private;
+        incr = kmalloc(sizeof(*incr) * NMTUS, GFP_KERNEL);
+        if (!incr)
+                return -ENOMEM;
        t4_read_cong_tbl(adap, incr);
        for (i = 0; i < NCCTRL_WIN; ++i) {
@@ -685,6 +689,8 @@ static int cctrl_tbl_show(struct seq_file *seq, void *v)
                           adap->params.a_wnd[i],
                           dec_fac[adap->params.b_wnd[i]]);
        }
+        kfree(incr);
        return 0;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index a22cf932ca35..d92995138f7e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -920,7 +920,7 @@ static void quiesce_rx(struct adapter *adap)
 {
        int i;
-        for (i = 0; i < ARRAY_SIZE(adap->sge.ingr_map); i++) {
+        for (i = 0; i < adap->sge.ingr_sz; i++) {
                struct sge_rspq *q = adap->sge.ingr_map[i];
                if (q && q->handler) {
@@ -934,6 +934,21 @@ static void quiesce_rx(struct adapter *adap)
        }
 }
+/* Disable interrupt and napi handler */
+static void disable_interrupts(struct adapter *adap)
+{
+        if (adap->flags & FULL_INIT_DONE) {
+                t4_intr_disable(adap);
+                if (adap->flags & USING_MSIX) {
+                        free_msix_queue_irqs(adap);
+                        free_irq(adap->msix_info[0].vec, adap);
+                } else {
+                        free_irq(adap->pdev->irq, adap);
+                }
+                quiesce_rx(adap);
+        }
+}
 /*
 * Enable NAPI scheduling and interrupt generation for all Rx queues.
 */
@@ -941,7 +956,7 @@ static void enable_rx(struct adapter *adap)
 {
        int i;
-        for (i = 0; i < ARRAY_SIZE(adap->sge.ingr_map); i++) {
+        for (i = 0; i < adap->sge.ingr_sz; i++) {
                struct sge_rspq *q = adap->sge.ingr_map[i];
                if (!q)
@@ -970,8 +985,8 @@ static int setup_sge_queues(struct adapter *adap)
        int err, msi_idx, i, j;
        struct sge *s = &adap->sge;
-        bitmap_zero(s->starving_fl, MAX_EGRQ);
+        bitmap_zero(s->starving_fl, s->egr_sz);
-        bitmap_zero(s->txq_maperr, MAX_EGRQ);
+        bitmap_zero(s->txq_maperr, s->egr_sz);
        if (adap->flags & USING_MSIX)
                msi_idx = 1;         /* vector 0 is for non-queue interrupts */
@@ -983,6 +998,19 @@ static int setup_sge_queues(struct adapter *adap)
                msi_idx = -((int)s->intrq.abs_id + 1);
        }
+        /* NOTE: If you add/delete any Ingress/Egress Queue allocations in here,
+         * don't forget to update the following which need to be
+         * synchronized to and changes here.
+         *
+         * 1. The calculations of MAX_INGQ in cxgb4.h.
+         *
+         * 2. Update enable_msix/name_msix_vecs/request_msix_queue_irqs
+         *    to accommodate any new/deleted Ingress Queues
+         *    which need MSI-X Vectors.
+         *
+         * 3. Update sge_qinfo_show() to include information on the
+         *    new/deleted queues.
+         */
        err = t4_sge_alloc_rxq(adap, &s->fw_evtq, true, adap->port[0],
                               msi_idx, NULL, fwevtq_handler);
        if (err) {
@@ -4244,19 +4272,12 @@ static int cxgb_up(struct adapter *adap)
 static void cxgb_down(struct adapter *adapter)
 {
-        t4_intr_disable(adapter);
        cancel_work_sync(&adapter->tid_release_task);
        cancel_work_sync(&adapter->db_full_task);
        cancel_work_sync(&adapter->db_drop_task);
        adapter->tid_release_task_busy = false;
        adapter->tid_release_head = NULL;
-        if (adapter->flags & USING_MSIX) {
-                free_msix_queue_irqs(adapter);
-                free_irq(adapter->msix_info[0].vec, adapter);
-        } else
-                free_irq(adapter->pdev->irq, adapter);
-        quiesce_rx(adapter);
        t4_sge_stop(adapter);
        t4_free_sge_resources(adapter);
        adapter->flags &= ~FULL_INIT_DONE;
@@ -4733,8 +4754,9 @@ static int adap_init1(struct adapter *adap, struct fw_caps_config_cmd *c)
        if (ret < 0)
                return ret;
-        ret = t4_cfg_pfvf(adap, adap->fn, adap->fn, 0, MAX_EGRQ, 64, MAX_INGQ,
+        ret = t4_cfg_pfvf(adap, adap->fn, adap->fn, 0, adap->sge.egr_sz, 64,
-                          0, 0, 4, 0xf, 0xf, 16, FW_CMD_CAP_PF, FW_CMD_CAP_PF);
+                          MAX_INGQ, 0, 0, 4, 0xf, 0xf, 16, FW_CMD_CAP_PF,
+                          FW_CMD_CAP_PF);
        if (ret < 0)
                return ret;
@@ -5088,10 +5110,15 @@ static int adap_init0(struct adapter *adap)
        enum dev_state state;
        u32 params[7], val[7];
        struct fw_caps_config_cmd caps_cmd;
-        struct fw_devlog_cmd devlog_cmd;
-        u32 devlog_meminfo;
        int reset = 1;
+        /* Grab Firmware Device Log parameters as early as possible so we have
+         * access to it for debugging, etc.
+         */
+        ret = t4_init_devlog_params(adap);
+        if (ret < 0)
+                return ret;
        /* Contact FW, advertising Master capability */
        ret = t4_fw_hello(adap, adap->mbox, adap->mbox, MASTER_MAY, &state);
        if (ret < 0) {
@@ -5169,30 +5196,6 @@ static int adap_init0(struct adapter *adap)
        if (ret < 0)
                goto bye;
-        /* Read firmware device log parameters.  We really need to find a way
-         * to get these parameters initialized with some default values (which
-         * are likely to be correct) for the case where we either don't
-         * attache to the firmware or it's crashed when we probe the adapter.
-         * That way we'll still be able to perform early firmware startup
-         * debugging ...  If the request to get the Firmware's Device Log
-         * parameters fails, we'll live so we don't make that a fatal error.
-         */
-        memset(&devlog_cmd, 0, sizeof(devlog_cmd));
-        devlog_cmd.op_to_write = htonl(FW_CMD_OP_V(FW_DEVLOG_CMD) |
-                                       FW_CMD_REQUEST_F | FW_CMD_READ_F);
-        devlog_cmd.retval_len16 = htonl(FW_LEN16(devlog_cmd));
-        ret = t4_wr_mbox(adap, adap->mbox, &devlog_cmd, sizeof(devlog_cmd),
-                         &devlog_cmd);
-        if (ret == 0) {
-                devlog_meminfo =
-                        ntohl(devlog_cmd.memtype_devlog_memaddr16_devlog);
-                adap->params.devlog.memtype =
-                        FW_DEVLOG_CMD_MEMTYPE_DEVLOG_G(devlog_meminfo);
-                adap->params.devlog.start =
-                        FW_DEVLOG_CMD_MEMADDR16_DEVLOG_G(devlog_meminfo) << 4;
-                adap->params.devlog.size = ntohl(devlog_cmd.memsize_devlog);
-        }
        /*
         * Find out what ports are available to us.  Note that we need to do
         * this before calling adap_init0_no_config() since it needs nports
@@ -5293,6 +5296,51 @@ static int adap_init0(struct adapter *adap)
        adap->tids.nftids = val[4] - val[3] + 1;
        adap->sge.ingr_start = val[5];
+        /* qids (ingress/egress) returned from firmware can be anywhere
+         * in the range from EQ(IQFLINT)_START to EQ(IQFLINT)_END.
+         * Hence driver needs to allocate memory for this range to
+         * store the queue info. Get the highest IQFLINT/EQ index returned
+         * in FW_EQ_*_CMD.alloc command.
+         */
+        params[0] = FW_PARAM_PFVF(EQ_END);
+        params[1] = FW_PARAM_PFVF(IQFLINT_END);
+        ret = t4_query_params(adap, adap->mbox, adap->fn, 0, 2, params, val);
+        if (ret < 0)
+                goto bye;
+        adap->sge.egr_sz = val[0] - adap->sge.egr_start + 1;
+        adap->sge.ingr_sz = val[1] - adap->sge.ingr_start + 1;
+        adap->sge.egr_map = kcalloc(adap->sge.egr_sz,
+                                    sizeof(*adap->sge.egr_map), GFP_KERNEL);
+        if (!adap->sge.egr_map) {
+                ret = -ENOMEM;
+                goto bye;
+        }
+        adap->sge.ingr_map = kcalloc(adap->sge.ingr_sz,
+                                     sizeof(*adap->sge.ingr_map), GFP_KERNEL);
+        if (!adap->sge.ingr_map) {
+                ret = -ENOMEM;
+                goto bye;
+        }
+        /* Allocate the memory for the vaious egress queue bitmaps
+         * ie starving_fl and txq_maperr.
+         */
+        adap->sge.starving_fl = kcalloc(BITS_TO_LONGS(adap->sge.egr_sz),
+                                        sizeof(long), GFP_KERNEL);
+        if (!adap->sge.starving_fl) {
+                ret = -ENOMEM;
+                goto bye;
+        }
+        adap->sge.txq_maperr = kcalloc(BITS_TO_LONGS(adap->sge.egr_sz),
+                                       sizeof(long), GFP_KERNEL);
+        if (!adap->sge.txq_maperr) {
+                ret = -ENOMEM;
+                goto bye;
+        }
        params[0] = FW_PARAM_PFVF(CLIP_START);
        params[1] = FW_PARAM_PFVF(CLIP_END);
        ret = t4_query_params(adap, adap->mbox, adap->fn, 0, 2, params, val);
@@ -5501,6 +5549,10 @@ static int adap_init0(struct adapter *adap)
         * happened to HW/FW, stop issuing commands.
         */
 bye:
+        kfree(adap->sge.egr_map);
+        kfree(adap->sge.ingr_map);
+        kfree(adap->sge.starving_fl);
+        kfree(adap->sge.txq_maperr);
        if (ret != -ETIMEDOUT && ret != -EIO)
                t4_fw_bye(adap, adap->mbox);
        return ret;
@@ -5528,6 +5580,7 @@ static pci_ers_result_t eeh_err_detected(struct pci_dev *pdev,
                netif_carrier_off(dev);
        }
        spin_unlock(&adap->stats_lock);
+        disable_interrupts(adap);
        if (adap->flags & FULL_INIT_DONE)
                cxgb_down(adap);
        rtnl_unlock();
@@ -5912,6 +5965,10 @@ static void free_some_resources(struct adapter *adapter)
        t4_free_mem(adapter->l2t);
        t4_free_mem(adapter->tids.tid_tab);
+        kfree(adapter->sge.egr_map);
+        kfree(adapter->sge.ingr_map);
+        kfree(adapter->sge.starving_fl);
+        kfree(adapter->sge.txq_maperr);
        disable_msi(adapter);
        for_each_port(adapter, i)
@@ -6237,6 +6294,8 @@ static void remove_one(struct pci_dev *pdev)
                if (is_offload(adapter))
                        detach_ulds(adapter);
+                disable_interrupts(adapter);
                for_each_port(adapter, i)
                        if (adapter->port[i]->reg_state == NETREG_REGISTERED)
                                unregister_netdev(adapter->port[i]);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index b4b9f6048fe7..b688b32c21fe 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2171,7 +2171,7 @@ static void sge_rx_timer_cb(unsigned long data)
        struct adapter *adap = (struct adapter *)data;
        struct sge *s = &adap->sge;
-        for (i = 0; i < ARRAY_SIZE(s->starving_fl); i++)
+        for (i = 0; i < BITS_TO_LONGS(s->egr_sz); i++)
                for (m = s->starving_fl[i]; m; m &= m - 1) {
                        struct sge_eth_rxq *rxq;
                        unsigned int id = __ffs(m) + i * BITS_PER_LONG;
@@ -2259,7 +2259,7 @@ static void sge_tx_timer_cb(unsigned long data)
        struct adapter *adap = (struct adapter *)data;
        struct sge *s = &adap->sge;
-        for (i = 0; i < ARRAY_SIZE(s->txq_maperr); i++)
+        for (i = 0; i < BITS_TO_LONGS(s->egr_sz); i++)
                for (m = s->txq_maperr[i]; m; m &= m - 1) {
                        unsigned long id = __ffs(m) + i * BITS_PER_LONG;
                        struct sge_ofld_txq *txq = s->egr_map[id];
@@ -2741,7 +2741,8 @@ void t4_free_sge_resources(struct adapter *adap)
                free_rspq_fl(adap, &adap->sge.intrq, NULL);
        /* clear the reverse egress queue map */
-        memset(adap->sge.egr_map, 0, sizeof(adap->sge.egr_map));
+        memset(adap->sge.egr_map, 0,
+               adap->sge.egr_sz * sizeof(*adap->sge.egr_map));
 }
 void t4_sge_start(struct adapter *adap)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 1abdfa123c6c..ee394dc68303 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -4459,6 +4459,59 @@ int cxgb4_t4_bar2_sge_qregs(struct adapter *adapter,
 }
 /**
+ *      t4_init_devlog_params - initialize adapter->params.devlog
+ *      @adap: the adapter
+ *
+ *      Initialize various fields of the adapter's Firmware Device Log
+ *      Parameters structure.
+ */
+int t4_init_devlog_params(struct adapter *adap)
+{
+        struct devlog_params *dparams = &adap->params.devlog;
+        u32 pf_dparams;
+        unsigned int devlog_meminfo;
+        struct fw_devlog_cmd devlog_cmd;
+        int ret;
+        /* If we're dealing with newer firmware, the Device Log Paramerters
+         * are stored in a designated register which allows us to access the
+         * Device Log even if we can't talk to the firmware.
+         */
+        pf_dparams =
+                t4_read_reg(adap, PCIE_FW_REG(PCIE_FW_PF_A, PCIE_FW_PF_DEVLOG));
+        if (pf_dparams) {
+                unsigned int nentries, nentries128;
+                dparams->memtype = PCIE_FW_PF_DEVLOG_MEMTYPE_G(pf_dparams);
+                dparams->start = PCIE_FW_PF_DEVLOG_ADDR16_G(pf_dparams) << 4;
+                nentries128 = PCIE_FW_PF_DEVLOG_NENTRIES128_G(pf_dparams);
+                nentries = (nentries128 + 1) * 128;
+                dparams->size = nentries * sizeof(struct fw_devlog_e);
+                return 0;
+        }
+        /* Otherwise, ask the firmware for it's Device Log Parameters.
+         */
+        memset(&devlog_cmd, 0, sizeof(devlog_cmd));
+        devlog_cmd.op_to_write = htonl(FW_CMD_OP_V(FW_DEVLOG_CMD) |
+                                       FW_CMD_REQUEST_F | FW_CMD_READ_F);
+        devlog_cmd.retval_len16 = htonl(FW_LEN16(devlog_cmd));
+        ret = t4_wr_mbox(adap, adap->mbox, &devlog_cmd, sizeof(devlog_cmd),
+                         &devlog_cmd);
+        if (ret)
+                return ret;
+        devlog_meminfo = ntohl(devlog_cmd.memtype_devlog_memaddr16_devlog);
+        dparams->memtype = FW_DEVLOG_CMD_MEMTYPE_DEVLOG_G(devlog_meminfo);
+        dparams->start = FW_DEVLOG_CMD_MEMADDR16_DEVLOG_G(devlog_meminfo) << 4;
+        dparams->size = ntohl(devlog_cmd.memsize_devlog);
+        return 0;
+}
+/**
 *      t4_init_sge_params - initialize adap->params.sge
 *      @adapter: the adapter
 *
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index 231a725f6d5d..326674b19983 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -63,6 +63,8 @@
 #define MC_BIST_STATUS_REG(reg_addr, idx) ((reg_addr) + (idx) * 4)
 #define EDC_BIST_STATUS_REG(reg_addr, idx) ((reg_addr) + (idx) * 4)
+#define PCIE_FW_REG(reg_addr, idx) ((reg_addr) + (idx) * 4)
 #define SGE_PF_KDOORBELL_A 0x0
 #define QID_S    15
@@ -707,6 +709,7 @@
 #define PFNUM_V(x) ((x) << PFNUM_S)
 #define PCIE_FW_A 0x30b8
+#define PCIE_FW_PF_A 0x30bc
 #define PCIE_CORE_UTL_SYSTEM_BUS_AGENT_STATUS_A 0x5908
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
index 9b353a88cbda..a4a19e0ec7f5 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
@@ -101,7 +101,7 @@ enum fw_wr_opcodes {
        FW_RI_BIND_MW_WR               = 0x18,
        FW_RI_FR_NSMR_WR               = 0x19,
        FW_RI_INV_LSTAG_WR             = 0x1a,
-        FW_LASTC2E_WR                  = 0x40
+        FW_LASTC2E_WR                  = 0x70
 };
 struct fw_wr_hdr {
@@ -993,6 +993,7 @@ enum fw_memtype_cf {
        FW_MEMTYPE_CF_EXTMEM            = 0x2,
        FW_MEMTYPE_CF_FLASH             = 0x4,
        FW_MEMTYPE_CF_INTERNAL          = 0x5,
+        FW_MEMTYPE_CF_EXTMEM1           = 0x6,
 };
 struct fw_caps_config_cmd {
@@ -1035,6 +1036,7 @@ enum fw_params_mnem {
        FW_PARAMS_MNEM_PFVF             = 2,    /* function params */
        FW_PARAMS_MNEM_REG              = 3,    /* limited register access */
        FW_PARAMS_MNEM_DMAQ             = 4,    /* dma queue params */
+        FW_PARAMS_MNEM_CHNET            = 5,    /* chnet params */
        FW_PARAMS_MNEM_LAST
 };
@@ -3102,7 +3104,8 @@ enum fw_devlog_facility {
        FW_DEVLOG_FACILITY_FCOE         = 0x2E,
        FW_DEVLOG_FACILITY_FOISCSI      = 0x30,
        FW_DEVLOG_FACILITY_FOFCOE       = 0x32,
-        FW_DEVLOG_FACILITY_MAX          = 0x32,
+        FW_DEVLOG_FACILITY_CHNET        = 0x34,
+        FW_DEVLOG_FACILITY_MAX          = 0x34,
 };
 /* log message format */
@@ -3139,4 +3142,36 @@ struct fw_devlog_cmd {
        (((x) >> FW_DEVLOG_CMD_MEMADDR16_DEVLOG_S) & \
         FW_DEVLOG_CMD_MEMADDR16_DEVLOG_M)
+/* P C I E   F W   P F 7   R E G I S T E R */
+/* PF7 stores the Firmware Device Log parameters which allows Host Drivers to
+ * access the "devlog" which needing to contact firmware.  The encoding is
+ * mostly the same as that returned by the DEVLOG command except for the size
+ * which is encoded as the number of entries in multiples-1 of 128 here rather
+ * than the memory size as is done in the DEVLOG command.  Thus, 0 means 128
+ * and 15 means 2048.  This of course in turn constrains the allowed values
+ * for the devlog size ...
+ */
+#define PCIE_FW_PF_DEVLOG               7
+#define PCIE_FW_PF_DEVLOG_NENTRIES128_S 28
+#define PCIE_FW_PF_DEVLOG_NENTRIES128_M 0xf
+#define PCIE_FW_PF_DEVLOG_NENTRIES128_V(x) \
+        ((x) << PCIE_FW_PF_DEVLOG_NENTRIES128_S)
+#define PCIE_FW_PF_DEVLOG_NENTRIES128_G(x) \
+        (((x) >> PCIE_FW_PF_DEVLOG_NENTRIES128_S) & \
+         PCIE_FW_PF_DEVLOG_NENTRIES128_M)
+#define PCIE_FW_PF_DEVLOG_ADDR16_S      4
+#define PCIE_FW_PF_DEVLOG_ADDR16_M      0xffffff
+#define PCIE_FW_PF_DEVLOG_ADDR16_V(x)   ((x) << PCIE_FW_PF_DEVLOG_ADDR16_S)
+#define PCIE_FW_PF_DEVLOG_ADDR16_G(x) \
+        (((x) >> PCIE_FW_PF_DEVLOG_ADDR16_S) & PCIE_FW_PF_DEVLOG_ADDR16_M)
+#define PCIE_FW_PF_DEVLOG_MEMTYPE_S     0
+#define PCIE_FW_PF_DEVLOG_MEMTYPE_M     0xf
+#define PCIE_FW_PF_DEVLOG_MEMTYPE_V(x)  ((x) << PCIE_FW_PF_DEVLOG_MEMTYPE_S)
+#define PCIE_FW_PF_DEVLOG_MEMTYPE_G(x) \
+        (((x) >> PCIE_FW_PF_DEVLOG_MEMTYPE_S) & PCIE_FW_PF_DEVLOG_MEMTYPE_M)
 #endif /* _T4FW_INTERFACE_H_ */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index e2bd3f747858..b9d1cbac0eee 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -36,13 +36,13 @@
 #define __T4FW_VERSION_H__
 #define T4FW_VERSION_MAJOR 0x01
-#define T4FW_VERSION_MINOR 0x0C
+#define T4FW_VERSION_MINOR 0x0D
-#define T4FW_VERSION_MICRO 0x19
+#define T4FW_VERSION_MICRO 0x20
 #define T4FW_VERSION_BUILD 0x00
 #define T5FW_VERSION_MAJOR 0x01
-#define T5FW_VERSION_MINOR 0x0C
+#define T5FW_VERSION_MINOR 0x0D
-#define T5FW_VERSION_MICRO 0x19
+#define T5FW_VERSION_MICRO 0x20
 #define T5FW_VERSION_BUILD 0x00
 #endif
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index 0545f0de1c52..e0d711071afb 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -1004,7 +1004,7 @@ static inline void ring_tx_db(struct adapter *adapter, struct sge_txq *tq,
                                              ? (tq->pidx - 1)
                                              : (tq->size - 1));
                        __be64 *src = (__be64 *)&tq->desc[index];
-                        __be64 __iomem *dst = (__be64 *)(tq->bar2_addr +
+                        __be64 __iomem *dst = (__be64 __iomem *)(tq->bar2_addr +
                                                         SGE_UDB_WCDOORBELL);
                        unsigned int count = EQ_UNIT / sizeof(__be64);
@@ -1018,7 +1018,11 @@ static inline void ring_tx_db(struct adapter *adapter, struct sge_txq *tq,
                         * DMA.
                         */
                        while (count) {
-                                writeq(*src, dst);
+                                /* the (__force u64) is because the compiler
+                                 * doesn't understand the endian swizzling
+                                 * going on
+                                 */
+                                writeq((__force u64)*src, dst);
                                src++;
                                dst++;
                                count--;
@@ -1252,8 +1256,8 @@ int t4vf_eth_xmit(struct sk_buff *skb, struct net_device *dev)
        BUG_ON(DIV_ROUND_UP(ETHTXQ_MAX_HDR, TXD_PER_EQ_UNIT) > 1);
        wr = (void *)&txq->q.desc[txq->q.pidx];
        wr->equiq_to_len16 = cpu_to_be32(wr_mid);
-        wr->r3[0] = cpu_to_be64(0);
+        wr->r3[0] = cpu_to_be32(0);
-        wr->r3[1] = cpu_to_be64(0);
+        wr->r3[1] = cpu_to_be32(0);
        skb_copy_from_linear_data(skb, (void *)wr->ethmacdst, fw_hdr_copy_len);
        end = (u64 *)wr + flits;
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index 1b5506df35b1..280b4a215849 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -210,10 +210,10 @@ int t4vf_wr_mbox_core(struct adapter *adapter, const void *cmd, int size,
                        if (rpl) {
                                /* request bit in high-order BE word */
-                                WARN_ON((be32_to_cpu(*(const u32 *)cmd)
+                                WARN_ON((be32_to_cpu(*(const __be32 *)cmd)
                                         & FW_CMD_REQUEST_F) == 0);
                                get_mbox_rpl(adapter, rpl, size, mbox_data);
-                                WARN_ON((be32_to_cpu(*(u32 *)rpl)
+                                WARN_ON((be32_to_cpu(*(__be32 *)rpl)
                                         & FW_CMD_REQUEST_F) != 0);
                        }
                        t4_write_reg(adapter, mbox_ctl,
@@ -484,7 +484,7 @@ int t4_bar2_sge_qregs(struct adapter *adapter,
         *  o The BAR2 Queue ID.
         *  o The BAR2 Queue ID Offset into the BAR2 page.
         */
-        bar2_page_offset = ((qid >> qpp_shift) << page_shift);
+        bar2_page_offset = ((u64)(qid >> qpp_shift) << page_shift);
        bar2_qid = qid & qpp_mask;
        bar2_qid_offset = bar2_qid * SGE_UDB_SIZE;
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 27de37aa90af..27b9fe99a9bd 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -354,6 +354,7 @@ struct be_vf_cfg {
        u16 vlan_tag;
        u32 tx_rate;
        u32 plink_tracking;
+        u32 privileges;
 };
 enum vf_state {
@@ -423,6 +424,7 @@ struct be_adapter {
        u8 __iomem *csr;        /* CSR BAR used only for BE2/3 */
        u8 __iomem *db;         /* Door Bell */
+        u8 __iomem *pcicfg;     /* On SH,BEx only. Shadow of PCI config space */
        struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
        struct be_dma_mem mbox_mem;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 36916cfa70f9..7f05f309e935 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1902,15 +1902,11 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 {
        int num_eqs, i = 0;
-        if (lancer_chip(adapter) && num > 8) {
+        while (num) {
-                while (num) {
+                num_eqs = min(num, 8);
-                        num_eqs = min(num, 8);
+                __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
-                        __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
+                i += num_eqs;
-                        i += num_eqs;
+                num -= num_eqs;
-                        num -= num_eqs;
-                }
-        } else {
-                __be_cmd_modify_eqd(adapter, set_eqd, num);
        }
        return 0;
@@ -1918,7 +1914,7 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 /* Uses sycnhronous mcc */
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num)
+                       u32 num, u32 domain)
 {
        struct be_mcc_wrb *wrb;
        struct be_cmd_req_vlan_config *req;
@@ -1936,6 +1932,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
        be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
                               OPCODE_COMMON_NTWK_VLAN_CONFIG, sizeof(*req),
                               wrb, NULL);
+        req->hdr.domain = domain;
        req->interface_id = if_id;
        req->untagged = BE_IF_FLAGS_UNTAGGED & be_if_cap_flags(adapter) ? 1 : 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index db761e8e42a3..a7634a3f052a 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -2256,7 +2256,7 @@ int lancer_cmd_get_pport_stats(struct be_adapter *adapter,
 int be_cmd_get_fw_ver(struct be_adapter *adapter);
 int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *, int num);
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num);
+                       u32 num, u32 domain);
 int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
 int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc);
 int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 0a816859aca5..e6b790f0d9dc 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1171,7 +1171,7 @@ static int be_vid_config(struct be_adapter *adapter)
        for_each_set_bit(i, adapter->vids, VLAN_N_VID)
                vids[num++] = cpu_to_le16(i);
-        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num);
+        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num, 0);
        if (status) {
                dev_err(dev, "Setting HW VLAN filtering failed\n");
                /* Set to VLAN promisc mode as setting VLAN filter failed */
@@ -1380,11 +1380,67 @@ static int be_get_vf_config(struct net_device *netdev, int vf,
        return 0;
 }
+static int be_set_vf_tvt(struct be_adapter *adapter, int vf, u16 vlan)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        u16 vids[BE_NUM_VLANS_SUPPORTED];
+        int vf_if_id = vf_cfg->if_handle;
+        int status;
+        /* Enable Transparent VLAN Tagging */
+        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1, vf_if_id, 0);
+        if (status)
+                return status;
+        /* Clear pre-programmed VLAN filters on VF if any, if TVT is enabled */
+        vids[0] = 0;
+        status = be_cmd_vlan_config(adapter, vf_if_id, vids, 1, vf + 1);
+        if (!status)
+                dev_info(&adapter->pdev->dev,
+                         "Cleared guest VLANs on VF%d", vf);
+        /* After TVT is enabled, disallow VFs to program VLAN filters */
+        if (vf_cfg->privileges & BE_PRIV_FILTMGMT) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges &
+                                                  ~BE_PRIV_FILTMGMT, vf + 1);
+                if (!status)
+                        vf_cfg->privileges &= ~BE_PRIV_FILTMGMT;
+        }
+        return 0;
+}
+static int be_clear_vf_tvt(struct be_adapter *adapter, int vf)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        struct device *dev = &adapter->pdev->dev;
+        int status;
+        /* Reset Transparent VLAN Tagging. */
+        status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID, vf + 1,
+                                       vf_cfg->if_handle, 0);
+        if (status)
+                return status;
+        /* Allow VFs to program VLAN filtering */
+        if (!(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges |
+                                                  BE_PRIV_FILTMGMT, vf + 1);
+                if (!status) {
+                        vf_cfg->privileges |= BE_PRIV_FILTMGMT;
+                        dev_info(dev, "VF%d: FILTMGMT priv enabled", vf);
+                }
+        }
+        dev_info(dev,
+                 "Disable/re-enable i/f in VM to clear Transparent VLAN tag");
+        return 0;
+}
 static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 {
        struct be_adapter *adapter = netdev_priv(netdev);
        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
-        int status = 0;
+        int status;
        if (!sriov_enabled(adapter))
                return -EPERM;
@@ -1394,24 +1450,19 @@ static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
        if (vlan || qos) {
                vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan)
+                status = be_set_vf_tvt(adapter, vf, vlan);
-                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                                       vf_cfg->if_handle, 0);
        } else {
-                /* Reset Transparent Vlan Tagging. */
+                status = be_clear_vf_tvt(adapter, vf);
-                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
-                                               vf + 1, vf_cfg->if_handle, 0);
        }
        if (status) {
                dev_err(&adapter->pdev->dev,
-                        "VLAN %d config on VF %d failed : %#x\n", vlan,
+                        "VLAN %d config on VF %d failed : %#x\n", vlan, vf,
-                        vf, status);
+                        status);
                return be_cmd_status(status);
        }
        vf_cfg->vlan_tag = vlan;
        return 0;
 }
@@ -2772,14 +2823,12 @@ void be_detect_error(struct be_adapter *adapter)
                        }
                }
        } else {
-                pci_read_config_dword(adapter->pdev,
+                ue_lo = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_LOW);
-                                      PCICFG_UE_STATUS_LOW, &ue_lo);
+                ue_hi = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_HIGH);
-                pci_read_config_dword(adapter->pdev,
+                ue_lo_mask = ioread32(adapter->pcicfg +
-                                      PCICFG_UE_STATUS_HIGH, &ue_hi);
+                                      PCICFG_UE_STATUS_LOW_MASK);
-                pci_read_config_dword(adapter->pdev,
+                ue_hi_mask = ioread32(adapter->pcicfg +
-                                      PCICFG_UE_STATUS_LOW_MASK, &ue_lo_mask);
+                                      PCICFG_UE_STATUS_HI_MASK);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HI_MASK, &ue_hi_mask);
                ue_lo = (ue_lo & ~ue_lo_mask);
                ue_hi = (ue_hi & ~ue_hi_mask);
@@ -3339,7 +3388,6 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
                        u32 cap_flags, u32 vf)
 {
        u32 en_flags;
-        int status;
        en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
                   BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_PASS_L3L4_ERRORS |
@@ -3347,10 +3395,7 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
        en_flags &= cap_flags;
-        status = be_cmd_if_create(adapter, cap_flags, en_flags,
+        return be_cmd_if_create(adapter, cap_flags, en_flags, if_handle, vf);
-                                  if_handle, vf);
-        return status;
 }
 static int be_vfs_if_create(struct be_adapter *adapter)
@@ -3368,8 +3413,13 @@ static int be_vfs_if_create(struct be_adapter *adapter)
                if (!BE3_chip(adapter)) {
                        status = be_cmd_get_profile_config(adapter, &res,
                                                           vf + 1);
-                        if (!status)
+                        if (!status) {
                                cap_flags = res.if_cap_flags;
+                                /* Prevent VFs from enabling VLAN promiscuous
+                                 * mode
+                                 */
+                                cap_flags &= ~BE_IF_FLAGS_VLAN_PROMISCUOUS;
+                        }
                }
                status = be_if_create(adapter, &vf_cfg->if_handle,
@@ -3403,7 +3453,6 @@ static int be_vf_setup(struct be_adapter *adapter)
        struct device *dev = &adapter->pdev->dev;
        struct be_vf_cfg *vf_cfg;
        int status, old_vfs, vf;
-        u32 privileges;
        old_vfs = pci_num_vf(adapter->pdev);
@@ -3433,15 +3482,18 @@ static int be_vf_setup(struct be_adapter *adapter)
        for_all_vfs(adapter, vf_cfg, vf) {
                /* Allow VFs to programs MAC/VLAN filters */
-                status = be_cmd_get_fn_privileges(adapter, &privileges, vf + 1);
+                status = be_cmd_get_fn_privileges(adapter, &vf_cfg->privileges,
-                if (!status && !(privileges & BE_PRIV_FILTMGMT)) {
+                                                  vf + 1);
+                if (!status && !(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
                        status = be_cmd_set_fn_privileges(adapter,
-                                                          privileges |
+                                                          vf_cfg->privileges |
                                                          BE_PRIV_FILTMGMT,
                                                          vf + 1);
-                        if (!status)
+                        if (!status) {
+                                vf_cfg->privileges |= BE_PRIV_FILTMGMT;
                                dev_info(dev, "VF%d has FILTMGMT privilege\n",
                                         vf);
+                        }
                }
                /* Allow full available bandwidth */
@@ -4820,24 +4872,37 @@ static int be_roce_map_pci_bars(struct be_adapter *adapter)
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
+        struct pci_dev *pdev = adapter->pdev;
        u8 __iomem *addr;
        if (BEx_chip(adapter) && be_physfn(adapter)) {
-                adapter->csr = pci_iomap(adapter->pdev, 2, 0);
+                adapter->csr = pci_iomap(pdev, 2, 0);
                if (!adapter->csr)
                        return -ENOMEM;
        }
-        addr = pci_iomap(adapter->pdev, db_bar(adapter), 0);
+        addr = pci_iomap(pdev, db_bar(adapter), 0);
        if (!addr)
                goto pci_map_err;
        adapter->db = addr;
+        if (skyhawk_chip(adapter) || BEx_chip(adapter)) {
+                if (be_physfn(adapter)) {
+                        /* PCICFG is the 2nd BAR in BE2 */
+                        addr = pci_iomap(pdev, BE2_chip(adapter) ? 1 : 0, 0);
+                        if (!addr)
+                                goto pci_map_err;
+                        adapter->pcicfg = addr;
+                } else {
+                        adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
+                }
+        }
        be_roce_map_pci_bars(adapter);
        return 0;
 pci_map_err:
-        dev_err(&adapter->pdev->dev, "Error in mapping PCI BARs\n");
+        dev_err(&pdev->dev, "Error in mapping PCI BARs\n");
        be_unmap_pci_bars(adapter);
        return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 78e1ce09b1ab..f6a3a7abd468 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1954,6 +1954,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
        struct fec_enet_private *fep = netdev_priv(ndev);
        struct device_node *node;
        int err = -ENXIO, i;
+        u32 mii_speed, holdtime;
        /*
         * The i.MX28 dual fec interfaces are not equal.
@@ -1991,10 +1992,33 @@ static int fec_enet_mii_init(struct platform_device *pdev)
         * Reference Manual has an error on this, and gets fixed on i.MX6Q
         * document.
         */
-        fep->phy_speed = DIV_ROUND_UP(clk_get_rate(fep->clk_ipg), 5000000);
+        mii_speed = DIV_ROUND_UP(clk_get_rate(fep->clk_ipg), 5000000);
        if (fep->quirks & FEC_QUIRK_ENET_MAC)
-                fep->phy_speed--;
+                mii_speed--;
-        fep->phy_speed <<= 1;
+        if (mii_speed > 63) {
+                dev_err(&pdev->dev,
+                        "fec clock (%lu) to fast to get right mii speed\n",
+                        clk_get_rate(fep->clk_ipg));
+                err = -EINVAL;
+                goto err_out;
+        }
+        /*
+         * The i.MX28 and i.MX6 types have another filed in the MSCR (aka
+         * MII_SPEED) register that defines the MDIO output hold time. Earlier
+         * versions are RAZ there, so just ignore the difference and write the
+         * register always.
+         * The minimal hold time according to IEE802.3 (clause 22) is 10 ns.
+         * HOLDTIME + 1 is the number of clk cycles the fec is holding the
+         * output.
+         * The HOLDTIME bitfield takes values between 0 and 7 (inclusive).
+         * Given that ceil(clkrate / 5000000) <= 64, the calculation for
+         * holdtime cannot result in a value greater than 3.
+         */
+        holdtime = DIV_ROUND_UP(clk_get_rate(fep->clk_ipg), 100000000) - 1;
+        fep->phy_speed = mii_speed << 1 | holdtime << 8;
        writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED);
        fep->mii_bus = mdiobus_alloc();
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index 357e8b576905..56b774d3a13d 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -3893,6 +3893,9 @@ static int ucc_geth_probe(struct platform_device* ofdev)
        ugeth->phy_interface = phy_interface;
        ugeth->max_speed = max_speed;
+        /* Carrier starts down, phylib will bring it up */
+        netif_carrier_off(dev);
        err = register_netdev(dev);
        if (err) {
                if (netif_msg_probe(ugeth))
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 96208f17bb53..2db653225a0e 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -2658,16 +2658,11 @@ static int mvneta_stop(struct net_device *dev)
 static int mvneta_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
        struct mvneta_port *pp = netdev_priv(dev);
-        int ret;
        if (!pp->phy_dev)
                return -ENOTSUPP;
-        ret = phy_mii_ioctl(pp->phy_dev, ifr, cmd);
+        return phy_mii_ioctl(pp->phy_dev, ifr, cmd);
-        if (!ret)
-                mvneta_adjust_link(dev);
-        return ret;
 }
 /* Ethtool methods */
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index a681d7c0bb9f..546ca4226916 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -724,7 +724,8 @@ static int mlx4_cmd_wait(struct mlx4_dev *dev, u64 in_param, u64 *out_param,
                 * on the host, we deprecate the error message for this
                 * specific command/input_mod/opcode_mod/fw-status to be debug.
                 */
-                if (op == MLX4_CMD_SET_PORT && in_modifier == 1 &&
+                if (op == MLX4_CMD_SET_PORT &&
+                    (in_modifier == 1 || in_modifier == 2) &&
                    op_modifier == 0 && context->fw_status == CMD_STAT_BAD_SIZE)
                        mlx4_dbg(dev, "command 0x%x failed: fw status = 0x%x\n",
                                 op, context->fw_status);
@@ -1993,7 +1994,6 @@ static void mlx4_master_do_cmd(struct mlx4_dev *dev, int slave, u8 cmd,
                        goto reset_slave;
                slave_state[slave].vhcr_dma = ((u64) param) << 48;
                priv->mfunc.master.slave_state[slave].cookie = 0;
-                mutex_init(&priv->mfunc.master.gen_eqe_mutex[slave]);
                break;
        case MLX4_COMM_CMD_VHCR1:
                if (slave_state[slave].last_cmd != MLX4_COMM_CMD_VHCR0)
@@ -2225,6 +2225,7 @@ int mlx4_multi_func_init(struct mlx4_dev *dev)
                for (i = 0; i < dev->num_slaves; ++i) {
                        s_state = &priv->mfunc.master.slave_state[i];
                        s_state->last_cmd = MLX4_COMM_CMD_RESET;
+                        mutex_init(&priv->mfunc.master.gen_eqe_mutex[i]);
                        for (j = 0; j < MLX4_EVENT_TYPES_NUM; ++j)
                                s_state->event_eq[j].eqn = -1;
                        __raw_writel((__force u32) 0,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index ebce5bb24df9..3485acf03014 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2805,13 +2805,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
        netif_carrier_off(dev);
        mlx4_en_set_default_moderation(priv);
-        err = register_netdev(dev);
-        if (err) {
-                en_err(priv, "Netdev registration failed for port %d\n", port);
-                goto out;
-        }
-        priv->registered = 1;
        en_warn(priv, "Using %d TX rings\n", prof->tx_ring_num);
        en_warn(priv, "Using %d RX rings\n", prof->rx_ring_num);
@@ -2853,6 +2846,14 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
+        err = register_netdev(dev);
+        if (err) {
+                en_err(priv, "Netdev registration failed for port %d\n", port);
+                goto out;
+        }
+        priv->registered = 1;
        return 0;
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 264bc15c1ff2..6e70ffee8e87 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -153,12 +153,10 @@ void mlx4_gen_slave_eqe(struct work_struct *work)
                /* All active slaves need to receive the event */
                if (slave == ALL_SLAVES) {
-                        for (i = 0; i < dev->num_slaves; i++) {
+                        for (i = 0; i <= dev->persist->num_vfs; i++) {
-                                if (i != dev->caps.function &&
+                                if (mlx4_GEN_EQE(dev, i, eqe))
-                                    master->slave_state[i].active)
+                                        mlx4_warn(dev, "Failed to generate event for slave %d\n",
-                                        if (mlx4_GEN_EQE(dev, i, eqe))
+                                                  i);
-                                                mlx4_warn(dev, "Failed to generate event for slave %d\n",
-                                                          i);
                        }
                } else {
                        if (mlx4_GEN_EQE(dev, slave, eqe))
@@ -203,13 +201,11 @@ static void mlx4_slave_event(struct mlx4_dev *dev, int slave,
                             struct mlx4_eqe *eqe)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
-        struct mlx4_slave_state *s_slave =
-                &priv->mfunc.master.slave_state[slave];
-        if (!s_slave->active) {
+        if (slave < 0 || slave > dev->persist->num_vfs ||
-                /*mlx4_warn(dev, "Trying to pass event to inactive slave\n");*/
+            slave == dev->caps.function ||
+            !priv->mfunc.master.slave_state[slave].active)
                return;
-        }
        slave_event(dev, slave, eqe);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index d97ca88c55b5..6e413ac4e940 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -3095,6 +3095,12 @@ int mlx4_GEN_EQE(struct mlx4_dev *dev, int slave, struct mlx4_eqe *eqe)
        if (!priv->mfunc.master.slave_state)
                return -EINVAL;
+        /* check for slave valid, slave not PF, and slave active */
+        if (slave < 0 || slave > dev->persist->num_vfs ||
+            slave == dev->caps.function ||
+            !priv->mfunc.master.slave_state[slave].active)
+                return 0;
        event_eq = &priv->mfunc.master.slave_state[slave].event_eq[eqe->type];
        /* Create the event only if the slave is registered */
diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c
index 9fb6948e14c6..5cecec282aba 100644
--- a/drivers/net/ethernet/rocker/rocker.c
+++ b/drivers/net/ethernet/rocker/rocker.c
@@ -4468,10 +4468,16 @@ static int rocker_port_master_changed(struct net_device *dev)
        struct net_device *master = netdev_master_upper_dev_get(dev);
        int err = 0;
+        /* There are currently three cases handled here:
+         * 1. Joining a bridge
+         * 2. Leaving a previously joined bridge
+         * 3. Other, e.g. being added to or removed from a bond or openvswitch,
+         *    in which case nothing is done
+         */
        if (master && master->rtnl_link_ops &&
            !strcmp(master->rtnl_link_ops->kind, "bridge"))
                err = rocker_port_bridge_join(rocker_port, master);
-        else
+        else if (rocker_port_is_bridged(rocker_port))
                err = rocker_port_bridge_leave(rocker_port);
        return err;
diff --git a/drivers/net/ipvlan/ipvlan.h b/drivers/net/ipvlan/ipvlan.h
index 924ea98bd531..54549a6223dd 100644
--- a/drivers/net/ipvlan/ipvlan.h
+++ b/drivers/net/ipvlan/ipvlan.h
@@ -114,7 +114,9 @@ unsigned int ipvlan_mac_hash(const unsigned char *addr);
 rx_handler_result_t ipvlan_handle_frame(struct sk_buff **pskb);
 int ipvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev);
 void ipvlan_ht_addr_add(struct ipvl_dev *ipvlan, struct ipvl_addr *addr);
-bool ipvlan_addr_busy(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6);
+struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan,
+                                   const void *iaddr, bool is_v6);
+bool ipvlan_addr_busy(struct ipvl_port *port, void *iaddr, bool is_v6);
 struct ipvl_addr *ipvlan_ht_addr_lookup(const struct ipvl_port *port,
                                        const void *iaddr, bool is_v6);
 void ipvlan_ht_addr_del(struct ipvl_addr *addr, bool sync);
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 2a175006028b..b7877a194cfe 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -81,19 +81,20 @@ void ipvlan_ht_addr_add(struct ipvl_dev *ipvlan, struct ipvl_addr *addr)
        hash = (addr->atype == IPVL_IPV6) ?
               ipvlan_get_v6_hash(&addr->ip6addr) :
               ipvlan_get_v4_hash(&addr->ip4addr);
-        hlist_add_head_rcu(&addr->hlnode, &port->hlhead[hash]);
+        if (hlist_unhashed(&addr->hlnode))
+                hlist_add_head_rcu(&addr->hlnode, &port->hlhead[hash]);
 }
 void ipvlan_ht_addr_del(struct ipvl_addr *addr, bool sync)
 {
-        hlist_del_rcu(&addr->hlnode);
+        hlist_del_init_rcu(&addr->hlnode);
        if (sync)
                synchronize_rcu();
 }
-bool ipvlan_addr_busy(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6)
+struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan,
+                                   const void *iaddr, bool is_v6)
 {
-        struct ipvl_port *port = ipvlan->port;
        struct ipvl_addr *addr;
        list_for_each_entry(addr, &ipvlan->addrs, anode) {
@@ -101,12 +102,21 @@ bool ipvlan_addr_busy(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6)
                    ipv6_addr_equal(&addr->ip6addr, iaddr)) ||
                    (!is_v6 && addr->atype == IPVL_IPV4 &&
                    addr->ip4addr.s_addr == ((struct in_addr *)iaddr)->s_addr))
-                        return true;
+                        return addr;
        }
+        return NULL;
+}
+bool ipvlan_addr_busy(struct ipvl_port *port, void *iaddr, bool is_v6)
+{
+        struct ipvl_dev *ipvlan;
-        if (ipvlan_ht_addr_lookup(port, iaddr, is_v6))
+        ASSERT_RTNL();
-                return true;
+        list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+                if (ipvlan_find_addr(ipvlan, iaddr, is_v6))
+                        return true;
+        }
        return false;
 }
@@ -192,7 +202,8 @@ static void ipvlan_multicast_frame(struct ipvl_port *port, struct sk_buff *skb,
        if (skb->protocol == htons(ETH_P_PAUSE))
                return;
-        list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(ipvlan, &port->ipvlans, pnode) {
                if (local && (ipvlan == in_dev))
                        continue;
@@ -219,6 +230,7 @@ static void ipvlan_multicast_frame(struct ipvl_port *port, struct sk_buff *skb,
 mcast_acct:
                ipvlan_count_rx(ipvlan, len, ret == NET_RX_SUCCESS, true);
        }
+        rcu_read_unlock();
        /* Locally generated? ...Forward a copy to the main-device as
         * well. On the RX side we'll ignore it (wont give it to any
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 4f4099d5603d..4fa14208d799 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -505,7 +505,7 @@ static void ipvlan_link_delete(struct net_device *dev, struct list_head *head)
        if (ipvlan->ipv6cnt > 0 || ipvlan->ipv4cnt > 0) {
                list_for_each_entry_safe(addr, next, &ipvlan->addrs, anode) {
                        ipvlan_ht_addr_del(addr, !dev->dismantle);
-                        list_del_rcu(&addr->anode);
+                        list_del(&addr->anode);
                }
        }
        list_del_rcu(&ipvlan->pnode);
@@ -607,7 +607,7 @@ static int ipvlan_add_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
 {
        struct ipvl_addr *addr;
-        if (ipvlan_addr_busy(ipvlan, ip6_addr, true)) {
+        if (ipvlan_addr_busy(ipvlan->port, ip6_addr, true)) {
                netif_err(ipvlan, ifup, ipvlan->dev,
                          "Failed to add IPv6=%pI6c addr for %s intf\n",
                          ip6_addr, ipvlan->dev->name);
@@ -620,9 +620,13 @@ static int ipvlan_add_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
        addr->master = ipvlan;
        memcpy(&addr->ip6addr, ip6_addr, sizeof(struct in6_addr));
        addr->atype = IPVL_IPV6;
-        list_add_tail_rcu(&addr->anode, &ipvlan->addrs);
+        list_add_tail(&addr->anode, &ipvlan->addrs);
        ipvlan->ipv6cnt++;
-        ipvlan_ht_addr_add(ipvlan, addr);
+        /* If the interface is not up, the address will be added to the hash
+         * list by ipvlan_open.
+         */
+        if (netif_running(ipvlan->dev))
+                ipvlan_ht_addr_add(ipvlan, addr);
        return 0;
 }
@@ -631,12 +635,12 @@ static void ipvlan_del_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
 {
        struct ipvl_addr *addr;
-        addr = ipvlan_ht_addr_lookup(ipvlan->port, ip6_addr, true);
+        addr = ipvlan_find_addr(ipvlan, ip6_addr, true);
        if (!addr)
                return;
        ipvlan_ht_addr_del(addr, true);
-        list_del_rcu(&addr->anode);
+        list_del(&addr->anode);
        ipvlan->ipv6cnt--;
        WARN_ON(ipvlan->ipv6cnt < 0);
        kfree_rcu(addr, rcu);
@@ -675,7 +679,7 @@ static int ipvlan_add_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
 {
        struct ipvl_addr *addr;
-        if (ipvlan_addr_busy(ipvlan, ip4_addr, false)) {
+        if (ipvlan_addr_busy(ipvlan->port, ip4_addr, false)) {
                netif_err(ipvlan, ifup, ipvlan->dev,
                          "Failed to add IPv4=%pI4 on %s intf.\n",
                          ip4_addr, ipvlan->dev->name);
@@ -688,9 +692,13 @@ static int ipvlan_add_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
        addr->master = ipvlan;
        memcpy(&addr->ip4addr, ip4_addr, sizeof(struct in_addr));
        addr->atype = IPVL_IPV4;
-        list_add_tail_rcu(&addr->anode, &ipvlan->addrs);
+        list_add_tail(&addr->anode, &ipvlan->addrs);
        ipvlan->ipv4cnt++;
-        ipvlan_ht_addr_add(ipvlan, addr);
+        /* If the interface is not up, the address will be added to the hash
+         * list by ipvlan_open.
+         */
+        if (netif_running(ipvlan->dev))
+                ipvlan_ht_addr_add(ipvlan, addr);
        ipvlan_set_broadcast_mac_filter(ipvlan, true);
        return 0;
@@ -700,12 +708,12 @@ static void ipvlan_del_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
 {
        struct ipvl_addr *addr;
-        addr = ipvlan_ht_addr_lookup(ipvlan->port, ip4_addr, false);
+        addr = ipvlan_find_addr(ipvlan, ip4_addr, false);
        if (!addr)
                return;
        ipvlan_ht_addr_del(addr, true);
-        list_del_rcu(&addr->anode);
+        list_del(&addr->anode);
        ipvlan->ipv4cnt--;
        WARN_ON(ipvlan->ipv4cnt < 0);
        if (!ipvlan->ipv4cnt)
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index 5c55f11572ba..75d6f26729a3 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -188,6 +188,8 @@ struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
                skb_put(skb, sizeof(padbytes));
        }
+        usbnet_set_skb_tx_stats(skb, 1, 0);
        return skb;
 }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 9311a08565be..4545e78840b0 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -522,6 +522,7 @@ static const struct driver_info wwan_info = {
 #define DELL_VENDOR_ID          0x413C
 #define REALTEK_VENDOR_ID       0x0bda
 #define SAMSUNG_VENDOR_ID       0x04e8
+#define LENOVO_VENDOR_ID        0x17ef
 static const struct usb_device_id       products[] = {
 /* BLACKLIST !!
@@ -702,6 +703,13 @@ static const struct usb_device_id	products[] = {
        .driver_info = 0,
 },
+/* Lenovo Thinkpad USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x7205, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
 /* WHITELIST!!!
 *
 * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 80a844e0ae03..c3e4da9e79ca 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1172,17 +1172,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
        /* return skb */
        ctx->tx_curr_skb = NULL;
-        dev->net->stats.tx_packets += ctx->tx_curr_frame_num;
        /* keep private stats: framing overhead and number of NTBs */
        ctx->tx_overhead += skb_out->len - ctx->tx_curr_frame_payload;
        ctx->tx_ntbs++;
-        /* usbnet has already counted all the framing overhead.
+        /* usbnet will count all the framing overhead by default.
         * Adjust the stats so that the tx_bytes counter show real
         * payload data instead.
         */
-        dev->net->stats.tx_bytes -= skb_out->len - ctx->tx_curr_frame_payload;
+        usbnet_set_skb_tx_stats(skb_out, n,
+                                ctx->tx_curr_frame_payload - skb_out->len);
        return skb_out;
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index fe48f4c51373..1762ad3910b2 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -46,8 +46,7 @@ enum cx82310_status {
 };
 #define CMD_PACKET_SIZE 64
-/* first command after power on can take around 8 seconds */
+#define CMD_TIMEOUT     100
-#define CMD_TIMEOUT     15000
 #define CMD_REPLY_RETRY 5
 #define CX82310_MTU     1514
@@ -78,8 +77,9 @@ static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
        ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, CMD_EP), buf,
                           CMD_PACKET_SIZE, &actual_len, CMD_TIMEOUT);
        if (ret < 0) {
-                dev_err(&dev->udev->dev, "send command %#x: error %d\n",
+                if (cmd != CMD_GET_LINK_STATUS)
-                        cmd, ret);
+                        dev_err(&dev->udev->dev, "send command %#x: error %d\n",
+                                cmd, ret);
                goto end;
        }
@@ -90,8 +90,10 @@ static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
                                           buf, CMD_PACKET_SIZE, &actual_len,
                                           CMD_TIMEOUT);
                        if (ret < 0) {
-                                dev_err(&dev->udev->dev,
+                                if (cmd != CMD_GET_LINK_STATUS)
-                                        "reply receive error %d\n", ret);
+                                        dev_err(&dev->udev->dev,
+                                                "reply receive error %d\n",
+                                                ret);
                                goto end;
                        }
                        if (actual_len > 0)
@@ -134,6 +136,8 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
        int ret;
        char buf[15];
        struct usb_device *udev = dev->udev;
+        u8 link[3];
+        int timeout = 50;
        /* avoid ADSL modems - continue only if iProduct is "USB NET CARD" */
        if (usb_string(udev, udev->descriptor.iProduct, buf, sizeof(buf)) > 0
@@ -160,6 +164,20 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
        if (!dev->partial_data)
                return -ENOMEM;
+        /* wait for firmware to become ready (indicated by the link being up) */
+        while (--timeout) {
+                ret = cx82310_cmd(dev, CMD_GET_LINK_STATUS, true, NULL, 0,
+                                  link, sizeof(link));
+                /* the command can time out during boot - it's not an error */
+                if (!ret && link[0] == 1 && link[2] == 1)
+                        break;
+                msleep(500);
+        };
+        if (!timeout) {
+                dev_err(&udev->dev, "firmware not ready in time\n");
+                return -ETIMEDOUT;
+        }
        /* enable ethernet mode (?) */
        ret = cx82310_cmd(dev, CMD_ETHERNET_MODE, true, "\x01", 1, NULL, 0);
        if (ret) {
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 438fc6bcaef1..9f7c0ab3b349 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -492,6 +492,7 @@ enum rtl8152_flags {
 /* Define these values to match your device */
 #define VENDOR_ID_REALTEK               0x0bda
 #define VENDOR_ID_SAMSUNG               0x04e8
+#define VENDOR_ID_LENOVO                0x17ef
 #define MCU_TYPE_PLA                    0x0100
 #define MCU_TYPE_USB                    0x0000
@@ -4037,6 +4038,7 @@ static struct usb_device_id rtl8152_table[] = {
        {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8152)},
        {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8153)},
        {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7205)},
        {}
 };
diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
index b94a0fbb8b3b..953de13267df 100644
--- a/drivers/net/usb/sr9800.c
+++ b/drivers/net/usb/sr9800.c
@@ -144,6 +144,7 @@ static struct sk_buff *sr_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                skb_put(skb, sizeof(padbytes));
        }
+        usbnet_set_skb_tx_stats(skb, 1, 0);
        return skb;
 }
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 449835f4331e..777757ae1973 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1188,8 +1188,7 @@ static void tx_complete (struct urb *urb)
        struct usbnet           *dev = entry->dev;
        if (urb->status == 0) {
-                if (!(dev->driver_info->flags & FLAG_MULTI_PACKET))
+                dev->net->stats.tx_packets += entry->packets;
-                        dev->net->stats.tx_packets++;
                dev->net->stats.tx_bytes += entry->length;
        } else {
                dev->net->stats.tx_errors++;
@@ -1347,7 +1346,19 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
                } else
                        urb->transfer_flags |= URB_ZERO_PACKET;
        }
-        entry->length = urb->transfer_buffer_length = length;
+        urb->transfer_buffer_length = length;
+        if (info->flags & FLAG_MULTI_PACKET) {
+                /* Driver has set number of packets and a length delta.
+                 * Calculate the complete length and ensure that it's
+                 * positive.
+                 */
+                entry->length += length;
+                if (WARN_ON_ONCE(entry->length <= 0))
+                        entry->length = length;
+        } else {
+                usbnet_set_skb_tx_stats(skb, 1, length);
+        }
        spin_lock_irqsave(&dev->txq.lock, flags);
        retval = usb_autopm_get_interface_async(dev->intf);
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index cb366adc820b..f50a6bc5d06e 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -219,12 +219,15 @@ void ath9k_beacon_remove_slot(struct ath_softc *sc, struct ieee80211_vif *vif)
        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
        struct ath_vif *avp = (void *)vif->drv_priv;
        struct ath_buf *bf = avp->av_bcbuf;
+        struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
        ath_dbg(common, CONFIG, "Removing interface at beacon slot: %d\n",
                avp->av_bslot);
        tasklet_disable(&sc->bcon_tasklet);
+        cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
        if (bf && bf->bf_mpdu) {
                struct sk_buff *skb = bf->bf_mpdu;
                dma_unmap_single(sc->dev, bf->bf_buf_addr,
@@ -521,8 +524,7 @@ static bool ath9k_allow_beacon_config(struct ath_softc *sc,
        }
        if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
-                if ((vif->type != NL80211_IFTYPE_AP) ||
+                if (vif->type != NL80211_IFTYPE_AP) {
-                    (sc->nbcnvifs > 1)) {
                        ath_dbg(common, CONFIG,
                                "An AP interface is already present !\n");
                        return false;
@@ -616,12 +618,14 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
         * enabling/disabling SWBA.
         */
        if (changed & BSS_CHANGED_BEACON_ENABLED) {
-                if (!bss_conf->enable_beacon &&
+                bool enabled = cur_conf->enable_beacon;
-                    (sc->nbcnvifs <= 1)) {
-                        cur_conf->enable_beacon = false;
+                if (!bss_conf->enable_beacon) {
-                } else if (bss_conf->enable_beacon) {
+                        cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
-                        cur_conf->enable_beacon = true;
+                } else {
-                        ath9k_cache_beacon_config(sc, ctx, bss_conf);
+                        cur_conf->enable_beacon |= BIT(avp->av_bslot);
+                        if (!enabled)
+                                ath9k_cache_beacon_config(sc, ctx, bss_conf);
                }
        }
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 2b79a568e803..d23737342f4f 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -54,7 +54,7 @@ struct ath_beacon_config {
        u16 dtim_period;
        u16 bmiss_timeout;
        u8 dtim_count;
-        bool enable_beacon;
+        u8 enable_beacon;
        bool ibss_creator;
        u32 nexttbtt;
        u32 intval;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 60aa8d71e753..8529014e1a5e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -424,7 +424,7 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
        ah->power_mode = ATH9K_PM_UNDEFINED;
        ah->htc_reset_init = true;
-        ah->tpc_enabled = true;
+        ah->tpc_enabled = false;
        ah->ani_function = ATH9K_ANI_ALL;
        if (!AR_SREV_9300_20_OR_LATER(ah))
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
index defb7a44e0bc..7748a1ccf14f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
@@ -126,7 +126,8 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
        brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_MCHAN, "mchan");
        if (drvr->bus_if->wowl_supported)
                brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
-        brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
+        if (drvr->bus_if->chip != BRCM_CC_43362_CHIP_ID)
+                brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
        /* set chip related quirks */
        switch (drvr->bus_if->chip) {
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index a6f22c32a279..3811878ab9cd 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -708,7 +708,6 @@ struct iwl_priv {
        unsigned long reload_jiffies;
        int reload_count;
        bool ucode_loaded;
-        bool init_ucode_run;            /* Don't run init uCode again */
        u8 plcp_delta_threshold;
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 47e64e8b9517..cceb026e0793 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1114,16 +1114,17 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
        scd_queues &= ~(BIT(IWL_IPAN_CMD_QUEUE_NUM) |
                        BIT(IWL_DEFAULT_CMD_QUEUE_NUM));
-        if (vif)
+        if (drop) {
-                scd_queues &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
+                IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n",
+                                    scd_queues);
-        IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n", scd_queues);
+                if (iwlagn_txfifo_flush(priv, scd_queues)) {
-        if (iwlagn_txfifo_flush(priv, scd_queues)) {
+                        IWL_ERR(priv, "flush request fail\n");
-                IWL_ERR(priv, "flush request fail\n");
+                        goto done;
-                goto done;
+                }
        }
        IWL_DEBUG_TX_QUEUES(priv, "wait transmit/flush all frames\n");
-        iwl_trans_wait_tx_queue_empty(priv->trans, 0xffffffff);
+        iwl_trans_wait_tx_queue_empty(priv->trans, scd_queues);
 done:
        mutex_unlock(&priv->mutex);
        IWL_DEBUG_MAC80211(priv, "leave\n");
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index 4dbef7e58c2e..5244e43bfafb 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -418,9 +418,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
        if (!priv->fw->img[IWL_UCODE_INIT].sec[0].len)
                return 0;
-        if (priv->init_ucode_run)
-                return 0;
        iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
                                   calib_complete, ARRAY_SIZE(calib_complete),
                                   iwlagn_wait_calib, priv);
@@ -440,8 +437,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
         */
        ret = iwl_wait_notification(&priv->notif_wait, &calib_wait,
                                        UCODE_CALIB_TIMEOUT);
-        if (!ret)
-                priv->init_ucode_run = true;
        goto out;
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 996e7f16adf9..c7154ac42c8c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1257,6 +1257,7 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
                                op->name, err);
 #endif
        }
+        kfree(pieces);
        return;
 try_again:
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index efa9688a4cf1..078f24cf4af3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -1278,6 +1278,9 @@ static void rs_mac80211_tx_status(void *mvm_r,
        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        if (!iwl_mvm_sta_from_mac80211(sta)->vif)
+                return;
        if (!ieee80211_is_data(hdr->frame_control) ||
            info->flags & IEEE80211_TX_CTL_NO_ACK)
                return;
@@ -2511,6 +2514,14 @@ static void rs_get_rate(void *mvm_r, struct ieee80211_sta *sta, void *mvm_sta,
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct iwl_lq_sta *lq_sta = mvm_sta;
+        if (sta && !iwl_mvm_sta_from_mac80211(sta)->vif) {
+                /* if vif isn't initialized mvm doesn't know about
+                 * this station, so don't do anything with the it
+                 */
+                sta = NULL;
+                mvm_sta = NULL;
+        }
        /* TODO: handle rate_idx_mask and rate_idx_mcs_mask */
        /* Treat uninitialized rate scaling data same as non-existing. */
@@ -2827,6 +2838,9 @@ static void rs_rate_update(void *mvm_r,
                        (struct iwl_op_mode *)mvm_r;
        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+        if (!iwl_mvm_sta_from_mac80211(sta)->vif)
+                return;
        /* Stop any ongoing aggregations as rs starts off assuming no agg */
        for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
                ieee80211_stop_tx_ba_session(sta, tid);
@@ -3587,9 +3601,15 @@ static ssize_t iwl_dbgfs_ss_force_write(struct iwl_lq_sta *lq_sta, char *buf,
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(ss_force, 32);
-static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
+static void rs_add_debugfs(void *mvm, void *priv_sta, struct dentry *dir)
 {
-        struct iwl_lq_sta *lq_sta = mvm_sta;
+        struct iwl_lq_sta *lq_sta = priv_sta;
+        struct iwl_mvm_sta *mvmsta;
+        mvmsta = container_of(lq_sta, struct iwl_mvm_sta, lq_sta);
+        if (!mvmsta->vif)
+                return;
        debugfs_create_file("rate_scale_table", S_IRUSR | S_IWUSR, dir,
                            lq_sta, &rs_sta_dbgfs_scale_table_ops);
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index f8d6f306dd76..4b81c0bf63b0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -197,6 +197,8 @@ iwl_mvm_te_handle_notify_csa(struct iwl_mvm *mvm,
                             struct iwl_time_event_notif *notif)
 {
        if (!le32_to_cpu(notif->status)) {
+                if (te_data->vif->type == NL80211_IFTYPE_STATION)
+                        ieee80211_connection_loss(te_data->vif);
                IWL_DEBUG_TE(mvm, "CSA time event failed to start\n");
                iwl_mvm_te_clear_data(mvm, te_data);
                return;
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 07304e1fd64a..96a05406babf 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -949,8 +949,10 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
        mvmsta = iwl_mvm_sta_from_mac80211(sta);
        tid_data = &mvmsta->tid_data[tid];
-        if (WARN_ONCE(tid_data->txq_id != scd_flow, "Q %d, tid %d, flow %d",
+        if (tid_data->txq_id != scd_flow) {
-                      tid_data->txq_id, tid, scd_flow)) {
+                IWL_ERR(mvm,
+                        "invalid BA notification: Q %d, tid %d, flow %d\n",
+                        tid_data->txq_id, tid, scd_flow);
                rcu_read_unlock();
                return 0;
        }
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index dbd6bcf52205..686dd301cd53 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -368,10 +368,12 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 /* 3165 Series */
        {IWL_PCI_DEVICE(0x3165, 0x4010, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3165, 0x4012, iwl3165_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x3165, 0x4110, iwl3165_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x3165, 0x4210, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3165, 0x4410, iwl3165_2ac_cfg)},
        {IWL_PCI_DEVICE(0x3165, 0x4510, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3165, 0x4110, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3166, 0x4310, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3166, 0x4210, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3165, 0x8010, iwl3165_2ac_cfg)},
 /* 7265 Series */
        {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index a62170ea0481..8c45cf44ce24 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -1124,12 +1124,22 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
        /*This is for new trx flow*/
        struct rtl_tx_buffer_desc *pbuffer_desc = NULL;
        u8 temp_one = 1;
+        u8 *entry;
        memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
        ring = &rtlpci->tx_ring[BEACON_QUEUE];
        pskb = __skb_dequeue(&ring->queue);
-        if (pskb)
+        if (rtlpriv->use_new_trx_flow)
+                entry = (u8 *)(&ring->buffer_desc[ring->idx]);
+        else
+                entry = (u8 *)(&ring->desc[ring->idx]);
+        if (pskb) {
+                pci_unmap_single(rtlpci->pdev,
+                                 rtlpriv->cfg->ops->get_desc(
+                                 (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
+                                 pskb->len, PCI_DMA_TODEVICE);
                kfree_skb(pskb);
+        }
        /*NB: the beacon data buffer must be 32-bit aligned. */
        pskb = ieee80211_beacon_get(hw, mac->vif);
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index e9b960f0ff32..720aaf6313d2 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1008,8 +1008,7 @@ err:
 static int xennet_change_mtu(struct net_device *dev, int mtu)
 {
-        int max = xennet_can_sg(dev) ?
+        int max = xennet_can_sg(dev) ? XEN_NETIF_MAX_TX_SIZE : ETH_DATA_LEN;
-                XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER : ETH_DATA_LEN;
        if (mtu > max)
                return -EINVAL;
@@ -1279,8 +1278,6 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
        netdev->ethtool_ops = &xennet_ethtool_ops;
        SET_NETDEV_DEV(netdev, &dev->dev);
-        netif_set_gso_max_size(netdev, XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER);
        np->netdev = netdev;
        netif_carrier_off(netdev);
diff --git a/drivers/of/address.c b/drivers/of/address.c
index ad2906919d45..78a7dcbec7d8 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -450,12 +450,17 @@ static struct of_bus *of_match_bus(struct device_node *np)
        return NULL;
 }
-static int of_empty_ranges_quirk(void)
+static int of_empty_ranges_quirk(struct device_node *np)
 {
        if (IS_ENABLED(CONFIG_PPC)) {
-                /* To save cycles, we cache the result */
+                /* To save cycles, we cache the result for global "Mac" setting */
                static int quirk_state = -1;
+                /* PA-SEMI sdc DT bug */
+                if (of_device_is_compatible(np, "1682m-sdc"))
+                        return true;
+                /* Make quirk cached */
                if (quirk_state < 0)
                        quirk_state =
                                of_machine_is_compatible("Power Macintosh") ||
@@ -490,7 +495,7 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
         * This code is only enabled on powerpc. --gcl
         */
        ranges = of_get_property(parent, rprop, &rlen);
-        if (ranges == NULL && !of_empty_ranges_quirk()) {
+        if (ranges == NULL && !of_empty_ranges_quirk(parent)) {
                pr_debug("OF: no ranges; cannot translate\n");
                return 1;
        }
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 9205f433573c..18198316b6cf 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -1572,6 +1572,10 @@ static int palmas_regulators_probe(struct platform_device *pdev)
        if (!pmic)
                return -ENOMEM;
+        if (of_device_is_compatible(node, "ti,tps659038-pmic"))
+                palmas_generic_regs_info[PALMAS_REG_REGEN2].ctrl_addr =
+                                                        TPS659038_REGEN2_CTRL;
        pmic->dev = &pdev->dev;
        pmic->palmas = palmas;
        palmas->pmic = pmic;
diff --git a/drivers/rtc/rtc-mrst.c b/drivers/rtc/rtc-mrst.c
index e2436d140175..3a6fd3a8a2ec 100644
--- a/drivers/rtc/rtc-mrst.c
+++ b/drivers/rtc/rtc-mrst.c
@@ -413,8 +413,8 @@ static void rtc_mrst_do_remove(struct device *dev)
        mrst->dev = NULL;
 }
-#ifdef  CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
-static int mrst_suspend(struct device *dev, pm_message_t mesg)
+static int mrst_suspend(struct device *dev)
 {
        struct mrst_rtc *mrst = dev_get_drvdata(dev);
        unsigned char   tmp;
@@ -453,7 +453,7 @@ static int mrst_suspend(struct device *dev, pm_message_t mesg)
 */
 static inline int mrst_poweroff(struct device *dev)
 {
-        return mrst_suspend(dev, PMSG_HIBERNATE);
+        return mrst_suspend(dev);
 }
 static int mrst_resume(struct device *dev)
@@ -490,9 +490,11 @@ static int mrst_resume(struct device *dev)
        return 0;
 }
+static SIMPLE_DEV_PM_OPS(mrst_pm_ops, mrst_suspend, mrst_resume);
+#define MRST_PM_OPS (&mrst_pm_ops)
 #else
-#define mrst_suspend    NULL
+#define MRST_PM_OPS NULL
-#define mrst_resume     NULL
 static inline int mrst_poweroff(struct device *dev)
 {
@@ -529,9 +531,8 @@ static struct platform_driver vrtc_mrst_platform_driver = {
        .remove         = vrtc_mrst_platform_remove,
        .shutdown       = vrtc_mrst_platform_shutdown,
        .driver = {
-                .name           = (char *) driver_name,
+                .name   = driver_name,
-                .suspend        = mrst_suspend,
+                .pm     = MRST_PM_OPS,
-                .resume         = mrst_resume,
        }
 };
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 9219953ee949..d9afc51af7d3 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -6815,7 +6815,8 @@ static struct ata_port_operations ipr_sata_ops = {
 };
 static struct ata_port_info sata_port_info = {
-        .flags          = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA,
+        .flags          = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
+                          ATA_FLAG_SAS_HOST,
        .pio_mask       = ATA_PIO4_ONLY,
        .mwdma_mask     = ATA_MWDMA2,
        .udma_mask      = ATA_UDMA6,
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 932d9cc98d2f..9c706d8c1441 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -547,7 +547,8 @@ static struct ata_port_operations sas_sata_ops = {
 };
 static struct ata_port_info sata_port_info = {
-        .flags = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | ATA_FLAG_NCQ,
+        .flags = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | ATA_FLAG_NCQ |
+                 ATA_FLAG_SAS_HOST,
        .pio_mask = ATA_PIO4,
        .mwdma_mask = ATA_MWDMA2,
        .udma_mask = ATA_UDMA6,
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index 3ce39d10fafb..4f8c798e0633 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -108,7 +108,8 @@ static void dw_spi_dma_tx_done(void *arg)
 {
        struct dw_spi *dws = arg;
-        if (test_and_clear_bit(TX_BUSY, &dws->dma_chan_busy) & BIT(RX_BUSY))
+        clear_bit(TX_BUSY, &dws->dma_chan_busy);
+        if (test_bit(RX_BUSY, &dws->dma_chan_busy))
                return;
        dw_spi_xfer_done(dws);
 }
@@ -156,7 +157,8 @@ static void dw_spi_dma_rx_done(void *arg)
 {
        struct dw_spi *dws = arg;
-        if (test_and_clear_bit(RX_BUSY, &dws->dma_chan_busy) & BIT(TX_BUSY))
+        clear_bit(RX_BUSY, &dws->dma_chan_busy);
+        if (test_bit(TX_BUSY, &dws->dma_chan_busy))
                return;
        dw_spi_xfer_done(dws);
 }
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index ff9cdbdb6672..2b2c359f5a50 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -498,7 +498,7 @@ static int spi_qup_probe(struct platform_device *pdev)
        struct resource *res;
        struct device *dev;
        void __iomem *base;
-        u32 max_freq, iomode;
+        u32 max_freq, iomode, num_cs;
        int ret, irq, size;
        dev = &pdev->dev;
@@ -550,10 +550,11 @@ static int spi_qup_probe(struct platform_device *pdev)
        }
        /* use num-cs unless not present or out of range */
-        if (of_property_read_u16(dev->of_node, "num-cs",
+        if (of_property_read_u32(dev->of_node, "num-cs", &num_cs) ||
-                        &master->num_chipselect) ||
+            num_cs > SPI_NUM_CHIPSELECTS)
-                        (master->num_chipselect > SPI_NUM_CHIPSELECTS))
                master->num_chipselect = SPI_NUM_CHIPSELECTS;
+        else
+                master->num_chipselect = num_cs;
        master->bus_num = pdev->id;
        master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index c64a3e59fce3..57a195041dc7 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1105,13 +1105,14 @@ void spi_finalize_current_message(struct spi_master *master)
                                "failed to unprepare message: %d\n", ret);
                }
        }
+        trace_spi_message_done(mesg);
        master->cur_msg_prepared = false;
        mesg->state = NULL;
        if (mesg->complete)
                mesg->complete(mesg->context);
-        trace_spi_message_done(mesg);
 }
 EXPORT_SYMBOL_GPL(spi_finalize_current_message);
diff --git a/drivers/staging/iio/Kconfig b/drivers/staging/iio/Kconfig
index 24183028bd71..6d5b38d69578 100644
--- a/drivers/staging/iio/Kconfig
+++ b/drivers/staging/iio/Kconfig
@@ -38,6 +38,7 @@ config IIO_SIMPLE_DUMMY_EVENTS
 config IIO_SIMPLE_DUMMY_BUFFER
        bool "Buffered capture support"
        select IIO_BUFFER
+        select IIO_TRIGGER
        select IIO_KFIFO_BUF
        help
          Add buffered data capture to the simple dummy driver.
diff --git a/drivers/staging/iio/magnetometer/hmc5843_core.c b/drivers/staging/iio/magnetometer/hmc5843_core.c
index fd171d8b38fb..90cc18b703cf 100644
--- a/drivers/staging/iio/magnetometer/hmc5843_core.c
+++ b/drivers/staging/iio/magnetometer/hmc5843_core.c
@@ -592,6 +592,7 @@ int hmc5843_common_probe(struct device *dev, struct regmap *regmap,
        mutex_init(&data->lock);
        indio_dev->dev.parent = dev;
+        indio_dev->name = dev->driver->name;
        indio_dev->info = &hmc5843_info;
        indio_dev->modes = INDIO_DIRECT_MODE;
        indio_dev->channels = data->variant->channels;
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index b1893f3f88f1..3ad1458bfeb0 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -921,6 +921,9 @@ static void lpuart_setup_watermark(struct lpuart_port *sport)
        writeb(val | UARTPFIFO_TXFE | UARTPFIFO_RXFE,
                        sport->port.membase + UARTPFIFO);
+        /* explicitly clear RDRF */
+        readb(sport->port.membase + UARTSR1);
        /* flush Tx and Rx FIFO */
        writeb(UARTCFIFO_TXFLUSH | UARTCFIFO_RXFLUSH,
                        sport->port.membase + UARTCFIFO);
@@ -1076,6 +1079,8 @@ static int lpuart_startup(struct uart_port *port)
        sport->txfifo_size = 0x1 << (((temp >> UARTPFIFO_TXSIZE_OFF) &
                UARTPFIFO_FIFOSIZE_MASK) + 1);
+        sport->port.fifosize = sport->txfifo_size;
        sport->rxfifo_size = 0x1 << (((temp >> UARTPFIFO_RXSIZE_OFF) &
                UARTPFIFO_FIFOSIZE_MASK) + 1);
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index af821a908720..cf08876922f1 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -963,6 +963,7 @@ static void s3c24xx_serial_shutdown(struct uart_port *port)
                        free_irq(ourport->tx_irq, ourport);
                tx_enabled(port) = 0;
                ourport->tx_claimed = 0;
+                ourport->tx_mode = 0;
        }
        if (ourport->rx_claimed) {
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index a7865c4b0498..0827d7c96527 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -387,6 +387,10 @@ static void xhci_clear_port_change_bit(struct xhci_hcd *xhci, u16 wValue,
                status = PORT_PLC;
                port_change_bit = "link state";
                break;
+        case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
+                status = PORT_CEC;
+                port_change_bit = "config error";
+                break;
        default:
                /* Should never happen */
                return;
@@ -588,6 +592,8 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                        status |= USB_PORT_STAT_C_LINK_STATE << 16;
                if ((raw_port_status & PORT_WRC))
                        status |= USB_PORT_STAT_C_BH_RESET << 16;
+                if ((raw_port_status & PORT_CEC))
+                        status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
        }
        if (hcd->speed != HCD_USB3) {
@@ -1005,6 +1011,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                case USB_PORT_FEAT_C_OVER_CURRENT:
                case USB_PORT_FEAT_C_ENABLE:
                case USB_PORT_FEAT_C_PORT_LINK_STATE:
+                case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
                        xhci_clear_port_change_bit(xhci, wValue, wIndex,
                                        port_array[wIndex], temp);
                        break;
@@ -1069,7 +1076,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
         */
        status = bus_state->resuming_ports;
-        mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC;
+        mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
        spin_lock_irqsave(&xhci->lock, flags);
        /* For each port, did anything change?  If so, set that bit in buf. */
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index fd53c9ebd662..2af32e26fafc 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -115,6 +115,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
        if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                xhci->quirks |= XHCI_LPM_SUPPORT;
                xhci->quirks |= XHCI_INTEL_HOST;
+                xhci->quirks |= XHCI_AVOID_BEI;
        }
        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
                        pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
@@ -130,7 +131,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 * PPT chipsets.
                 */
                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
-                xhci->quirks |= XHCI_AVOID_BEI;
        }
        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
                pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
diff --git a/drivers/usb/isp1760/isp1760-udc.c b/drivers/usb/isp1760/isp1760-udc.c
index f32c292cc868..3fc4fe770253 100644
--- a/drivers/usb/isp1760/isp1760-udc.c
+++ b/drivers/usb/isp1760/isp1760-udc.c
@@ -1203,7 +1203,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
        if (udc->driver) {
                dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
-                spin_unlock(&udc->lock);
+                spin_unlock_irqrestore(&udc->lock, flags);
                return -EBUSY;
        }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 3086dec0ef53..8eb68a31cab6 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -604,6 +604,7 @@ static const struct usb_device_id id_table_combined[] = {
                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
        { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
        /*
         * ELV devices:
         */
@@ -1883,8 +1884,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
 {
        struct usb_device *udev = serial->dev;
-        if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ||
+        if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems"))
-            (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2")))
+                return ftdi_jtag_probe(serial);
+        if (udev->product &&
+                (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
+                 !strcmp(udev->product, "SNAP Connect E10")))
                return ftdi_jtag_probe(serial);
        return 0;
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 56b1b55c4751..4e4f46f3c89c 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -561,6 +561,12 @@
 */
 #define FTDI_NT_ORIONLXM_PID    0x7c90  /* OrionLXm Substation Automation Platform */
+/*
+ * Synapse Wireless product ids (FTDI_VID)
+ * http://www.synapse-wireless.com
+ */
+#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
 /********************************/
 /** third-party VID/PID combos **/
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index dd97d8b572c3..4f7e072e4e00 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -61,6 +61,7 @@ struct keyspan_pda_private {
 /* For Xircom PGSDB9 and older Entrega version of the same device */
 #define XIRCOM_VENDOR_ID                0x085a
 #define XIRCOM_FAKE_ID                  0x8027
+#define XIRCOM_FAKE_ID_2                0x8025 /* "PGMFHUB" serial */
 #define ENTREGA_VENDOR_ID               0x1645
 #define ENTREGA_FAKE_ID                 0x8093
@@ -70,6 +71,7 @@ static const struct usb_device_id id_table_combined[] = {
 #endif
 #ifdef XIRCOM
        { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID) },
+        { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID_2) },
        { USB_DEVICE(ENTREGA_VENDOR_ID, ENTREGA_FAKE_ID) },
 #endif
        { USB_DEVICE(KEYSPAN_VENDOR_ID, KEYSPAN_PDA_ID) },
@@ -93,6 +95,7 @@ static const struct usb_device_id id_table_fake[] = {
 #ifdef XIRCOM
 static const struct usb_device_id id_table_fake_xircom[] = {
        { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID) },
+        { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID_2) },
        { USB_DEVICE(ENTREGA_VENDOR_ID, ENTREGA_FAKE_ID) },
        { }
 };
diff --git a/drivers/watchdog/imgpdc_wdt.c b/drivers/watchdog/imgpdc_wdt.c
index c8def68d9e4c..0deaa4f971f5 100644
--- a/drivers/watchdog/imgpdc_wdt.c
+++ b/drivers/watchdog/imgpdc_wdt.c
@@ -42,10 +42,10 @@
 #define PDC_WDT_MIN_TIMEOUT             1
 #define PDC_WDT_DEF_TIMEOUT             64
-static int heartbeat;
+static int heartbeat = PDC_WDT_DEF_TIMEOUT;
 module_param(heartbeat, int, 0);
-MODULE_PARM_DESC(heartbeat, "Watchdog heartbeats in seconds. "
+MODULE_PARM_DESC(heartbeat, "Watchdog heartbeats in seconds "
-        "(default = " __MODULE_STRING(PDC_WDT_DEF_TIMEOUT) ")");
+        "(default=" __MODULE_STRING(PDC_WDT_DEF_TIMEOUT) ")");
 static bool nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, bool, 0);
@@ -191,6 +191,7 @@ static int pdc_wdt_probe(struct platform_device *pdev)
        pdc_wdt->wdt_dev.ops = &pdc_wdt_ops;
        pdc_wdt->wdt_dev.max_timeout = 1 << PDC_WDT_CONFIG_DELAY_MASK;
        pdc_wdt->wdt_dev.parent = &pdev->dev;
+        watchdog_set_drvdata(&pdc_wdt->wdt_dev, pdc_wdt);
        ret = watchdog_init_timeout(&pdc_wdt->wdt_dev, heartbeat, &pdev->dev);
        if (ret < 0) {
@@ -232,7 +233,6 @@ static int pdc_wdt_probe(struct platform_device *pdev)
        watchdog_set_nowayout(&pdc_wdt->wdt_dev, nowayout);
        platform_set_drvdata(pdev, pdc_wdt);
-        watchdog_set_drvdata(&pdc_wdt->wdt_dev, pdc_wdt);
        ret = watchdog_register_device(&pdc_wdt->wdt_dev);
        if (ret)
diff --git a/drivers/watchdog/mtk_wdt.c b/drivers/watchdog/mtk_wdt.c
index a87f6df6e85f..938b987de551 100644
--- a/drivers/watchdog/mtk_wdt.c
+++ b/drivers/watchdog/mtk_wdt.c
@@ -133,7 +133,7 @@ static int mtk_wdt_start(struct watchdog_device *wdt_dev)
        u32 reg;
        struct mtk_wdt_dev *mtk_wdt = watchdog_get_drvdata(wdt_dev);
        void __iomem *wdt_base = mtk_wdt->wdt_base;
-        u32 ret;
+        int ret;
        ret = mtk_wdt_set_timeout(wdt_dev, wdt_dev->timeout);
        if (ret < 0)
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index b812462083fc..94d96809e686 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -55,6 +55,23 @@ config XEN_BALLOON_MEMORY_HOTPLUG
          In that case step 3 should be omitted.
+config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
+        int "Hotplugged memory limit (in GiB) for a PV guest"
+        default 512 if X86_64
+        default 4 if X86_32
+        range 0 64 if X86_32
+        depends on XEN_HAVE_PVMMU
+        depends on XEN_BALLOON_MEMORY_HOTPLUG
+        help
+          Maxmium amount of memory (in GiB) that a PV guest can be
+          expanded to when using memory hotplug.
+          A PV guest can have more memory than this limit if is
+          started with a larger maximum.
+          This value is used to allocate enough space in internal
+          tables needed for physical memory administration.
 config XEN_SCRUB_PAGES
        bool "Scrub pages before returning them to system"
        depends on XEN_BALLOON
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 0b52d92cb2e5..fd933695f232 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -229,6 +229,29 @@ static enum bp_state reserve_additional_memory(long credit)
        balloon_hotplug = round_up(balloon_hotplug, PAGES_PER_SECTION);
        nid = memory_add_physaddr_to_nid(hotplug_start_paddr);
+#ifdef CONFIG_XEN_HAVE_PVMMU
+        /*
+         * add_memory() will build page tables for the new memory so
+         * the p2m must contain invalid entries so the correct
+         * non-present PTEs will be written.
+         *
+         * If a failure occurs, the original (identity) p2m entries
+         * are not restored since this region is now known not to
+         * conflict with any devices.
+         */ 
+        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+                unsigned long pfn, i;
+                pfn = PFN_DOWN(hotplug_start_paddr);
+                for (i = 0; i < balloon_hotplug; i++) {
+                        if (!set_phys_to_machine(pfn + i, INVALID_P2M_ENTRY)) {
+                                pr_warn("set_phys_to_machine() failed, no memory added\n");
+                                return BP_ECANCELED;
+                        }
+                }
+        }
+#endif
        rc = add_memory(nid, hotplug_start_paddr, balloon_hotplug << PAGE_SHIFT);
        if (rc) {