[gentoo-commits] proj/linux-patches:4.18 commit in: /

[Mike Pagano]

commit:     f69bd2c4a51cabfc16f5a44334d1cd82613e7157
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 15 10:12:46 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Sep 15 10:12:46 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f69bd2c4

Linux patch 4.18.8

 0000_README             |    4 +
 1007_linux-4.18.8.patch | 6654 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 6658 insertions(+)

diff --git a/0000_README b/0000_README
index f3682ca..597262e 100644
--- a/0000_README
+++ b/0000_README
@@ -71,6 +71,10 @@ Patch:  1006_linux-4.18.7.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.18.7
 
+Patch:  1007_linux-4.18.8.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.18.8
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1007_linux-4.18.8.patch b/1007_linux-4.18.8.patch
new file mode 100644
index 0000000..8a888c7
--- /dev/null
+++ b/1007_linux-4.18.8.patch
@@ -0,0 +1,6654 @@
+diff --git a/Makefile b/Makefile
+index 711b04d00e49..0d73431f66cd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 18
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+ NAME = Merciless Moray
+ 
+diff --git a/arch/arm/mach-rockchip/Kconfig b/arch/arm/mach-rockchip/Kconfig
+index fafd3d7f9f8c..8ca926522026 100644
+--- a/arch/arm/mach-rockchip/Kconfig
++++ b/arch/arm/mach-rockchip/Kconfig
+@@ -17,6 +17,7 @@ config ARCH_ROCKCHIP
+ 	select ARM_GLOBAL_TIMER
+ 	select CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK
+ 	select ZONE_DMA if ARM_LPAE
++	select PM
+ 	help
+ 	  Support for Rockchip's Cortex-A9 Single-to-Quad-Core-SoCs
+ 	  containing the RK2928, RK30xx and RK31xx series.
+diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
+index d5aeac351fc3..21a715ad8222 100644
+--- a/arch/arm64/Kconfig.platforms
++++ b/arch/arm64/Kconfig.platforms
+@@ -151,6 +151,7 @@ config ARCH_ROCKCHIP
+ 	select GPIOLIB
+ 	select PINCTRL
+ 	select PINCTRL_ROCKCHIP
++	select PM
+ 	select ROCKCHIP_TIMER
+ 	help
+ 	  This enables support for the ARMv8 based Rockchip chipsets,
+diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
+index 16b077801a5f..a4a718dbfec6 100644
+--- a/arch/powerpc/include/asm/topology.h
++++ b/arch/powerpc/include/asm/topology.h
+@@ -92,6 +92,7 @@ extern int stop_topology_update(void);
+ extern int prrn_is_enabled(void);
+ extern int find_and_online_cpu_nid(int cpu);
+ extern int timed_topology_update(int nsecs);
++extern void __init shared_proc_topology_init(void);
+ #else
+ static inline int start_topology_update(void)
+ {
+@@ -113,6 +114,10 @@ static inline int timed_topology_update(int nsecs)
+ {
+ 	return 0;
+ }
++
++#ifdef CONFIG_SMP
++static inline void shared_proc_topology_init(void) {}
++#endif
+ #endif /* CONFIG_NUMA && CONFIG_PPC_SPLPAR */
+ 
+ #include <asm-generic/topology.h>
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index 468653ce844c..327f6112fe8e 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -250,10 +250,17 @@ do {								\
+ 	}							\
+ } while (0)
+ 
++/*
++ * This is a type: either unsigned long, if the argument fits into
++ * that type, or otherwise unsigned long long.
++ */
++#define __long_type(x) \
++	__typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
++
+ #define __get_user_nocheck(x, ptr, size)			\
+ ({								\
+ 	long __gu_err;						\
+-	unsigned long __gu_val;					\
++	__long_type(*(ptr)) __gu_val;				\
+ 	const __typeof__(*(ptr)) __user *__gu_addr = (ptr);	\
+ 	__chk_user_ptr(ptr);					\
+ 	if (!is_kernel_addr((unsigned long)__gu_addr))		\
+@@ -267,7 +274,7 @@ do {								\
+ #define __get_user_check(x, ptr, size)					\
+ ({									\
+ 	long __gu_err = -EFAULT;					\
+-	unsigned long  __gu_val = 0;					\
++	__long_type(*(ptr)) __gu_val = 0;				\
+ 	const __typeof__(*(ptr)) __user *__gu_addr = (ptr);		\
+ 	might_fault();							\
+ 	if (access_ok(VERIFY_READ, __gu_addr, (size))) {		\
+@@ -281,7 +288,7 @@ do {								\
+ #define __get_user_nosleep(x, ptr, size)			\
+ ({								\
+ 	long __gu_err;						\
+-	unsigned long __gu_val;					\
++	__long_type(*(ptr)) __gu_val;				\
+ 	const __typeof__(*(ptr)) __user *__gu_addr = (ptr);	\
+ 	__chk_user_ptr(ptr);					\
+ 	barrier_nospec();					\
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 285c6465324a..f817342aab8f 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1526,6 +1526,8 @@ TRAMP_REAL_BEGIN(stf_barrier_fallback)
+ TRAMP_REAL_BEGIN(rfi_flush_fallback)
+ 	SET_SCRATCH0(r13);
+ 	GET_PACA(r13);
++	std	r1,PACA_EXRFI+EX_R12(r13)
++	ld	r1,PACAKSAVE(r13)
+ 	std	r9,PACA_EXRFI+EX_R9(r13)
+ 	std	r10,PACA_EXRFI+EX_R10(r13)
+ 	std	r11,PACA_EXRFI+EX_R11(r13)
+@@ -1560,12 +1562,15 @@ TRAMP_REAL_BEGIN(rfi_flush_fallback)
+ 	ld	r9,PACA_EXRFI+EX_R9(r13)
+ 	ld	r10,PACA_EXRFI+EX_R10(r13)
+ 	ld	r11,PACA_EXRFI+EX_R11(r13)
++	ld	r1,PACA_EXRFI+EX_R12(r13)
+ 	GET_SCRATCH0(r13);
+ 	rfid
+ 
+ TRAMP_REAL_BEGIN(hrfi_flush_fallback)
+ 	SET_SCRATCH0(r13);
+ 	GET_PACA(r13);
++	std	r1,PACA_EXRFI+EX_R12(r13)
++	ld	r1,PACAKSAVE(r13)
+ 	std	r9,PACA_EXRFI+EX_R9(r13)
+ 	std	r10,PACA_EXRFI+EX_R10(r13)
+ 	std	r11,PACA_EXRFI+EX_R11(r13)
+@@ -1600,6 +1605,7 @@ TRAMP_REAL_BEGIN(hrfi_flush_fallback)
+ 	ld	r9,PACA_EXRFI+EX_R9(r13)
+ 	ld	r10,PACA_EXRFI+EX_R10(r13)
+ 	ld	r11,PACA_EXRFI+EX_R11(r13)
++	ld	r1,PACA_EXRFI+EX_R12(r13)
+ 	GET_SCRATCH0(r13);
+ 	hrfid
+ 
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index 4794d6b4f4d2..b3142c7b9c31 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -1156,6 +1156,11 @@ void __init smp_cpus_done(unsigned int max_cpus)
+ 	if (smp_ops && smp_ops->bringup_done)
+ 		smp_ops->bringup_done();
+ 
++	/*
++	 * On a shared LPAR, associativity needs to be requested.
++	 * Hence, get numa topology before dumping cpu topology
++	 */
++	shared_proc_topology_init();
+ 	dump_numa_cpu_topology();
+ 
+ 	/*
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 0c7e05d89244..35ac5422903a 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -1078,7 +1078,6 @@ static int prrn_enabled;
+ static void reset_topology_timer(void);
+ static int topology_timer_secs = 1;
+ static int topology_inited;
+-static int topology_update_needed;
+ 
+ /*
+  * Change polling interval for associativity changes.
+@@ -1306,11 +1305,8 @@ int numa_update_cpu_topology(bool cpus_locked)
+ 	struct device *dev;
+ 	int weight, new_nid, i = 0;
+ 
+-	if (!prrn_enabled && !vphn_enabled) {
+-		if (!topology_inited)
+-			topology_update_needed = 1;
++	if (!prrn_enabled && !vphn_enabled && topology_inited)
+ 		return 0;
+-	}
+ 
+ 	weight = cpumask_weight(&cpu_associativity_changes_mask);
+ 	if (!weight)
+@@ -1423,7 +1419,6 @@ int numa_update_cpu_topology(bool cpus_locked)
+ 
+ out:
+ 	kfree(updates);
+-	topology_update_needed = 0;
+ 	return changed;
+ }
+ 
+@@ -1551,6 +1546,15 @@ int prrn_is_enabled(void)
+ 	return prrn_enabled;
+ }
+ 
++void __init shared_proc_topology_init(void)
++{
++	if (lppaca_shared_proc(get_lppaca())) {
++		bitmap_fill(cpumask_bits(&cpu_associativity_changes_mask),
++			    nr_cpumask_bits);
++		numa_update_cpu_topology(false);
++	}
++}
++
+ static int topology_read(struct seq_file *file, void *v)
+ {
+ 	if (vphn_enabled || prrn_enabled)
+@@ -1608,10 +1612,6 @@ static int topology_update_init(void)
+ 		return -ENOMEM;
+ 
+ 	topology_inited = 1;
+-	if (topology_update_needed)
+-		bitmap_fill(cpumask_bits(&cpu_associativity_changes_mask),
+-					nr_cpumask_bits);
+-
+ 	return 0;
+ }
+ device_initcall(topology_update_init);
+diff --git a/arch/powerpc/platforms/85xx/t1042rdb_diu.c b/arch/powerpc/platforms/85xx/t1042rdb_diu.c
+index 58fa3d319f1c..dac36ba82fea 100644
+--- a/arch/powerpc/platforms/85xx/t1042rdb_diu.c
++++ b/arch/powerpc/platforms/85xx/t1042rdb_diu.c
+@@ -9,8 +9,10 @@
+  * option) any later version.
+  */
+ 
++#include <linux/init.h>
+ #include <linux/io.h>
+ #include <linux/kernel.h>
++#include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
+ 
+@@ -150,3 +152,5 @@ static int __init t1042rdb_diu_init(void)
+ }
+ 
+ early_initcall(t1042rdb_diu_init);
++
++MODULE_LICENSE("GPL");
+diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
+index 2edc673be137..99d1152ae224 100644
+--- a/arch/powerpc/platforms/pseries/ras.c
++++ b/arch/powerpc/platforms/pseries/ras.c
+@@ -371,7 +371,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs)
+ 		int len, error_log_length;
+ 
+ 		error_log_length = 8 + rtas_error_extended_log_length(h);
+-		len = max_t(int, error_log_length, RTAS_ERROR_LOG_MAX);
++		len = min_t(int, error_log_length, RTAS_ERROR_LOG_MAX);
+ 		memset(global_mce_data_buf, 0, RTAS_ERROR_LOG_MAX);
+ 		memcpy(global_mce_data_buf, h, len);
+ 		errhdr = (struct rtas_error_log *)global_mce_data_buf;
+diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c
+index eb69a5186243..280e964e1aa8 100644
+--- a/arch/powerpc/sysdev/mpic_msgr.c
++++ b/arch/powerpc/sysdev/mpic_msgr.c
+@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platform_device *dev)
+ 
+ 	/* IO map the message register block. */
+ 	of_address_to_resource(np, 0, &rsrc);
+-	msgr_block_addr = ioremap(rsrc.start, rsrc.end - rsrc.start);
++	msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc));
+ 	if (!msgr_block_addr) {
+ 		dev_err(&dev->dev, "Failed to iomap MPIC message registers");
+ 		return -EFAULT;
+diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
+index f6561b783b61..eed1c137f618 100644
+--- a/arch/riscv/kernel/vdso/Makefile
++++ b/arch/riscv/kernel/vdso/Makefile
+@@ -52,8 +52,8 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
+ # Add -lgcc so rv32 gets static muldi3 and lshrdi3 definitions.
+ # Make sure only to export the intended __vdso_xxx symbol offsets.
+ quiet_cmd_vdsold = VDSOLD  $@
+-      cmd_vdsold = $(CC) $(KCFLAGS) $(call cc-option, -no-pie) -nostdlib $(SYSCFLAGS_$(@F)) \
+-                           -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp -lgcc && \
++      cmd_vdsold = $(CC) $(KBUILD_CFLAGS) $(call cc-option, -no-pie) -nostdlib -nostartfiles $(SYSCFLAGS_$(@F)) \
++                           -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp && \
+                    $(CROSS_COMPILE)objcopy \
+                            $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@
+ 
+diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
+index 9f5ea9d87069..9b0216d571ad 100644
+--- a/arch/s390/kernel/crash_dump.c
++++ b/arch/s390/kernel/crash_dump.c
+@@ -404,11 +404,13 @@ static void *get_vmcoreinfo_old(unsigned long *size)
+ 	if (copy_oldmem_kernel(nt_name, addr + sizeof(note),
+ 			       sizeof(nt_name) - 1))
+ 		return NULL;
+-	if (strcmp(nt_name, "VMCOREINFO") != 0)
++	if (strcmp(nt_name, VMCOREINFO_NOTE_NAME) != 0)
+ 		return NULL;
+ 	vmcoreinfo = kzalloc_panic(note.n_descsz);
+-	if (copy_oldmem_kernel(vmcoreinfo, addr + 24, note.n_descsz))
++	if (copy_oldmem_kernel(vmcoreinfo, addr + 24, note.n_descsz)) {
++		kfree(vmcoreinfo);
+ 		return NULL;
++	}
+ 	*size = note.n_descsz;
+ 	return vmcoreinfo;
+ }
+@@ -418,15 +420,20 @@ static void *get_vmcoreinfo_old(unsigned long *size)
+  */
+ static void *nt_vmcoreinfo(void *ptr)
+ {
++	const char *name = VMCOREINFO_NOTE_NAME;
+ 	unsigned long size;
+ 	void *vmcoreinfo;
+ 
+ 	vmcoreinfo = os_info_old_entry(OS_INFO_VMCOREINFO, &size);
+-	if (!vmcoreinfo)
+-		vmcoreinfo = get_vmcoreinfo_old(&size);
++	if (vmcoreinfo)
++		return nt_init_name(ptr, 0, vmcoreinfo, size, name);
++
++	vmcoreinfo = get_vmcoreinfo_old(&size);
+ 	if (!vmcoreinfo)
+ 		return ptr;
+-	return nt_init_name(ptr, 0, vmcoreinfo, size, "VMCOREINFO");
++	ptr = nt_init_name(ptr, 0, vmcoreinfo, size, name);
++	kfree(vmcoreinfo);
++	return ptr;
+ }
+ 
+ /*
+diff --git a/arch/um/Makefile b/arch/um/Makefile
+index e54dda8a0363..de340e41f3b2 100644
+--- a/arch/um/Makefile
++++ b/arch/um/Makefile
+@@ -122,8 +122,7 @@ archheaders:
+ 	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.asm-generic \
+ 	            kbuild-file=$(HOST_DIR)/include/uapi/asm/Kbuild \
+ 		    obj=$(HOST_DIR)/include/generated/uapi/asm
+-	$(Q)$(MAKE) KBUILD_SRC= ARCH=$(HEADER_ARCH) archheaders
+-
++	$(Q)$(MAKE) -f $(srctree)/Makefile ARCH=$(HEADER_ARCH) archheaders
+ 
+ archprepare: include/generated/user_constants.h
+ 
+diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
+index 8c7b3e5a2d01..3a17107594c8 100644
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -148,6 +148,7 @@ enum mce_notifier_prios {
+ 	MCE_PRIO_LOWEST		= 0,
+ };
+ 
++struct notifier_block;
+ extern void mce_register_decode_chain(struct notifier_block *nb);
+ extern void mce_unregister_decode_chain(struct notifier_block *nb);
+ 
+diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
+index bb035a4cbc8c..9eeb1359ec75 100644
+--- a/arch/x86/include/asm/pgtable-3level.h
++++ b/arch/x86/include/asm/pgtable-3level.h
+@@ -2,6 +2,8 @@
+ #ifndef _ASM_X86_PGTABLE_3LEVEL_H
+ #define _ASM_X86_PGTABLE_3LEVEL_H
+ 
++#include <asm/atomic64_32.h>
++
+ /*
+  * Intel Physical Address Extension (PAE) Mode - three-level page
+  * tables on PPro+ CPUs.
+@@ -147,10 +149,7 @@ static inline pte_t native_ptep_get_and_clear(pte_t *ptep)
+ {
+ 	pte_t res;
+ 
+-	/* xchg acts as a barrier before the setting of the high bits */
+-	res.pte_low = xchg(&ptep->pte_low, 0);
+-	res.pte_high = ptep->pte_high;
+-	ptep->pte_high = 0;
++	res.pte = (pteval_t)arch_atomic64_xchg((atomic64_t *)ptep, 0);
+ 
+ 	return res;
+ }
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
+index 74392d9d51e0..a10481656d82 100644
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -1343,7 +1343,7 @@ device_initcall(init_tsc_clocksource);
+ 
+ void __init tsc_early_delay_calibrate(void)
+ {
+-	unsigned long lpj;
++	u64 lpj;
+ 
+ 	if (!boot_cpu_has(X86_FEATURE_TSC))
+ 		return;
+@@ -1355,7 +1355,7 @@ void __init tsc_early_delay_calibrate(void)
+ 	if (!tsc_khz)
+ 		return;
+ 
+-	lpj = tsc_khz * 1000;
++	lpj = (u64)tsc_khz * 1000;
+ 	do_div(lpj, HZ);
+ 	loops_per_jiffy = lpj;
+ }
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index a44e568363a4..42f1ba92622a 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -221,6 +221,17 @@ static const u64 shadow_acc_track_saved_bits_mask = PT64_EPT_READABLE_MASK |
+ 						    PT64_EPT_EXECUTABLE_MASK;
+ static const u64 shadow_acc_track_saved_bits_shift = PT64_SECOND_AVAIL_BITS_SHIFT;
+ 
++/*
++ * This mask must be set on all non-zero Non-Present or Reserved SPTEs in order
++ * to guard against L1TF attacks.
++ */
++static u64 __read_mostly shadow_nonpresent_or_rsvd_mask;
++
++/*
++ * The number of high-order 1 bits to use in the mask above.
++ */
++static const u64 shadow_nonpresent_or_rsvd_mask_len = 5;
++
+ static void mmu_spte_set(u64 *sptep, u64 spte);
+ 
+ void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask, u64 mmio_value)
+@@ -308,9 +319,13 @@ static void mark_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, u64 gfn,
+ {
+ 	unsigned int gen = kvm_current_mmio_generation(vcpu);
+ 	u64 mask = generation_mmio_spte_mask(gen);
++	u64 gpa = gfn << PAGE_SHIFT;
+ 
+ 	access &= ACC_WRITE_MASK | ACC_USER_MASK;
+-	mask |= shadow_mmio_value | access | gfn << PAGE_SHIFT;
++	mask |= shadow_mmio_value | access;
++	mask |= gpa | shadow_nonpresent_or_rsvd_mask;
++	mask |= (gpa & shadow_nonpresent_or_rsvd_mask)
++		<< shadow_nonpresent_or_rsvd_mask_len;
+ 
+ 	trace_mark_mmio_spte(sptep, gfn, access, gen);
+ 	mmu_spte_set(sptep, mask);
+@@ -323,8 +338,14 @@ static bool is_mmio_spte(u64 spte)
+ 
+ static gfn_t get_mmio_spte_gfn(u64 spte)
+ {
+-	u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask;
+-	return (spte & ~mask) >> PAGE_SHIFT;
++	u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask |
++		   shadow_nonpresent_or_rsvd_mask;
++	u64 gpa = spte & ~mask;
++
++	gpa |= (spte >> shadow_nonpresent_or_rsvd_mask_len)
++	       & shadow_nonpresent_or_rsvd_mask;
++
++	return gpa >> PAGE_SHIFT;
+ }
+ 
+ static unsigned get_mmio_spte_access(u64 spte)
+@@ -381,7 +402,7 @@ void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask,
+ }
+ EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes);
+ 
+-static void kvm_mmu_clear_all_pte_masks(void)
++static void kvm_mmu_reset_all_pte_masks(void)
+ {
+ 	shadow_user_mask = 0;
+ 	shadow_accessed_mask = 0;
+@@ -391,6 +412,18 @@ static void kvm_mmu_clear_all_pte_masks(void)
+ 	shadow_mmio_mask = 0;
+ 	shadow_present_mask = 0;
+ 	shadow_acc_track_mask = 0;
++
++	/*
++	 * If the CPU has 46 or less physical address bits, then set an
++	 * appropriate mask to guard against L1TF attacks. Otherwise, it is
++	 * assumed that the CPU is not vulnerable to L1TF.
++	 */
++	if (boot_cpu_data.x86_phys_bits <
++	    52 - shadow_nonpresent_or_rsvd_mask_len)
++		shadow_nonpresent_or_rsvd_mask =
++			rsvd_bits(boot_cpu_data.x86_phys_bits -
++				  shadow_nonpresent_or_rsvd_mask_len,
++				  boot_cpu_data.x86_phys_bits - 1);
+ }
+ 
+ static int is_cpuid_PSE36(void)
+@@ -5500,7 +5533,7 @@ int kvm_mmu_module_init(void)
+ {
+ 	int ret = -ENOMEM;
+ 
+-	kvm_mmu_clear_all_pte_masks();
++	kvm_mmu_reset_all_pte_masks();
+ 
+ 	pte_list_desc_cache = kmem_cache_create("pte_list_desc",
+ 					    sizeof(struct pte_list_desc),
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index bedabcf33a3e..9869bfd0c601 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -939,17 +939,21 @@ struct vcpu_vmx {
+ 	/*
+ 	 * loaded_vmcs points to the VMCS currently used in this vcpu. For a
+ 	 * non-nested (L1) guest, it always points to vmcs01. For a nested
+-	 * guest (L2), it points to a different VMCS.
++	 * guest (L2), it points to a different VMCS.  loaded_cpu_state points
++	 * to the VMCS whose state is loaded into the CPU registers that only
++	 * need to be switched when transitioning to/from the kernel; a NULL
++	 * value indicates that host state is loaded.
+ 	 */
+ 	struct loaded_vmcs    vmcs01;
+ 	struct loaded_vmcs   *loaded_vmcs;
++	struct loaded_vmcs   *loaded_cpu_state;
+ 	bool                  __launched; /* temporary, used in vmx_vcpu_run */
+ 	struct msr_autoload {
+ 		struct vmx_msrs guest;
+ 		struct vmx_msrs host;
+ 	} msr_autoload;
++
+ 	struct {
+-		int           loaded;
+ 		u16           fs_sel, gs_sel, ldt_sel;
+ #ifdef CONFIG_X86_64
+ 		u16           ds_sel, es_sel;
+@@ -2750,10 +2754,11 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
+ #endif
+ 	int i;
+ 
+-	if (vmx->host_state.loaded)
++	if (vmx->loaded_cpu_state)
+ 		return;
+ 
+-	vmx->host_state.loaded = 1;
++	vmx->loaded_cpu_state = vmx->loaded_vmcs;
++
+ 	/*
+ 	 * Set host fs and gs selectors.  Unfortunately, 22.2.3 does not
+ 	 * allow segment selectors with cpl > 0 or ti == 1.
+@@ -2815,11 +2820,14 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
+ 
+ static void __vmx_load_host_state(struct vcpu_vmx *vmx)
+ {
+-	if (!vmx->host_state.loaded)
++	if (!vmx->loaded_cpu_state)
+ 		return;
+ 
++	WARN_ON_ONCE(vmx->loaded_cpu_state != vmx->loaded_vmcs);
++
+ 	++vmx->vcpu.stat.host_state_reload;
+-	vmx->host_state.loaded = 0;
++	vmx->loaded_cpu_state = NULL;
++
+ #ifdef CONFIG_X86_64
+ 	if (is_long_mode(&vmx->vcpu))
+ 		rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+@@ -8115,7 +8123,7 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
+ 
+ 	/* CPL=0 must be checked manually. */
+ 	if (vmx_get_cpl(vcpu)) {
+-		kvm_queue_exception(vcpu, UD_VECTOR);
++		kvm_inject_gp(vcpu, 0);
+ 		return 1;
+ 	}
+ 
+@@ -8179,7 +8187,7 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
+ static int nested_vmx_check_permission(struct kvm_vcpu *vcpu)
+ {
+ 	if (vmx_get_cpl(vcpu)) {
+-		kvm_queue_exception(vcpu, UD_VECTOR);
++		kvm_inject_gp(vcpu, 0);
+ 		return 0;
+ 	}
+ 
+@@ -10517,8 +10525,8 @@ static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs)
+ 		return;
+ 
+ 	cpu = get_cpu();
+-	vmx->loaded_vmcs = vmcs;
+ 	vmx_vcpu_put(vcpu);
++	vmx->loaded_vmcs = vmcs;
+ 	vmx_vcpu_load(vcpu, cpu);
+ 	put_cpu();
+ }
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 24c84aa87049..94cd63081471 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6506,20 +6506,22 @@ static void kvm_set_mmio_spte_mask(void)
+ 	 * Set the reserved bits and the present bit of an paging-structure
+ 	 * entry to generate page fault with PFER.RSV = 1.
+ 	 */
+-	 /* Mask the reserved physical address bits. */
+-	mask = rsvd_bits(maxphyaddr, 51);
++
++	/*
++	 * Mask the uppermost physical address bit, which would be reserved as
++	 * long as the supported physical address width is less than 52.
++	 */
++	mask = 1ull << 51;
+ 
+ 	/* Set the present bit. */
+ 	mask |= 1ull;
+ 
+-#ifdef CONFIG_X86_64
+ 	/*
+ 	 * If reserved bit is not supported, clear the present bit to disable
+ 	 * mmio page fault.
+ 	 */
+-	if (maxphyaddr == 52)
++	if (IS_ENABLED(CONFIG_X86_64) && maxphyaddr == 52)
+ 		mask &= ~1ull;
+-#endif
+ 
+ 	kvm_mmu_set_mmio_spte_mask(mask, mask);
+ }
+diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
+index 2c30cabfda90..071d82ec9abb 100644
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -434,14 +434,13 @@ static void xen_set_pud(pud_t *ptr, pud_t val)
+ static void xen_set_pte_atomic(pte_t *ptep, pte_t pte)
+ {
+ 	trace_xen_mmu_set_pte_atomic(ptep, pte);
+-	set_64bit((u64 *)ptep, native_pte_val(pte));
++	__xen_set_pte(ptep, pte);
+ }
+ 
+ static void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ 	trace_xen_mmu_pte_clear(mm, addr, ptep);
+-	if (!xen_batched_set_pte(ptep, native_make_pte(0)))
+-		native_pte_clear(mm, addr, ptep);
++	__xen_set_pte(ptep, native_make_pte(0));
+ }
+ 
+ static void xen_pmd_clear(pmd_t *pmdp)
+@@ -1571,7 +1570,7 @@ static void __init xen_set_pte_init(pte_t *ptep, pte_t pte)
+ 		pte = __pte_ma(((pte_val_ma(*ptep) & _PAGE_RW) | ~_PAGE_RW) &
+ 			       pte_val_ma(pte));
+ #endif
+-	native_set_pte(ptep, pte);
++	__xen_set_pte(ptep, pte);
+ }
+ 
+ /* Early in boot, while setting up the initial pagetable, assume
+diff --git a/block/bio.c b/block/bio.c
+index 047c5dca6d90..ff94640bc734 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -156,7 +156,7 @@ out:
+ 
+ unsigned int bvec_nr_vecs(unsigned short idx)
+ {
+-	return bvec_slabs[idx].nr_vecs;
++	return bvec_slabs[--idx].nr_vecs;
+ }
+ 
+ void bvec_free(mempool_t *pool, struct bio_vec *bv, unsigned int idx)
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 1646ea85dade..746a5eac4541 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -2159,7 +2159,9 @@ static inline bool should_fail_request(struct hd_struct *part,
+ 
+ static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part)
+ {
+-	if (part->policy && op_is_write(bio_op(bio))) {
++	const int op = bio_op(bio);
++
++	if (part->policy && (op_is_write(op) && !op_is_flush(op))) {
+ 		char b[BDEVNAME_SIZE];
+ 
+ 		WARN_ONCE(1,
+diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
+index 3de0836163c2..d5f2c21d8531 100644
+--- a/block/blk-mq-tag.c
++++ b/block/blk-mq-tag.c
+@@ -23,6 +23,9 @@ bool blk_mq_has_free_tags(struct blk_mq_tags *tags)
+ 
+ /*
+  * If a previously inactive queue goes active, bump the active user count.
++ * We need to do this before try to allocate driver tag, then even if fail
++ * to get tag when first time, the other shared-tag users could reserve
++ * budget for it.
+  */
+ bool __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx)
+ {
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 654b0dc7e001..2f9e14361673 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -285,7 +285,7 @@ static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data,
+ 		rq->tag = -1;
+ 		rq->internal_tag = tag;
+ 	} else {
+-		if (blk_mq_tag_busy(data->hctx)) {
++		if (data->hctx->flags & BLK_MQ_F_TAG_SHARED) {
+ 			rq_flags = RQF_MQ_INFLIGHT;
+ 			atomic_inc(&data->hctx->nr_active);
+ 		}
+@@ -367,6 +367,8 @@ static struct request *blk_mq_get_request(struct request_queue *q,
+ 		if (!op_is_flush(op) && e->type->ops.mq.limit_depth &&
+ 		    !(data->flags & BLK_MQ_REQ_RESERVED))
+ 			e->type->ops.mq.limit_depth(op, data);
++	} else {
++		blk_mq_tag_busy(data->hctx);
+ 	}
+ 
+ 	tag = blk_mq_get_tag(data);
+@@ -970,6 +972,7 @@ bool blk_mq_get_driver_tag(struct request *rq, struct blk_mq_hw_ctx **hctx,
+ 		.hctx = blk_mq_map_queue(rq->q, rq->mq_ctx->cpu),
+ 		.flags = wait ? 0 : BLK_MQ_REQ_NOWAIT,
+ 	};
++	bool shared;
+ 
+ 	might_sleep_if(wait);
+ 
+@@ -979,9 +982,10 @@ bool blk_mq_get_driver_tag(struct request *rq, struct blk_mq_hw_ctx **hctx,
+ 	if (blk_mq_tag_is_reserved(data.hctx->sched_tags, rq->internal_tag))
+ 		data.flags |= BLK_MQ_REQ_RESERVED;
+ 
++	shared = blk_mq_tag_busy(data.hctx);
+ 	rq->tag = blk_mq_get_tag(&data);
+ 	if (rq->tag >= 0) {
+-		if (blk_mq_tag_busy(data.hctx)) {
++		if (shared) {
+ 			rq->rq_flags |= RQF_MQ_INFLIGHT;
+ 			atomic_inc(&data.hctx->nr_active);
+ 		}
+diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
+index 82b6c27b3245..f6f180f3aa1c 100644
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -4735,12 +4735,13 @@ USEC_SHOW_FUNCTION(cfq_target_latency_us_show, cfqd->cfq_target_latency);
+ static ssize_t __FUNC(struct elevator_queue *e, const char *page, size_t count)	\
+ {									\
+ 	struct cfq_data *cfqd = e->elevator_data;			\
+-	unsigned int __data;						\
++	unsigned int __data, __min = (MIN), __max = (MAX);		\
++									\
+ 	cfq_var_store(&__data, (page));					\
+-	if (__data < (MIN))						\
+-		__data = (MIN);						\
+-	else if (__data > (MAX))					\
+-		__data = (MAX);						\
++	if (__data < __min)						\
++		__data = __min;						\
++	else if (__data > __max)					\
++		__data = __max;						\
+ 	if (__CONV)							\
+ 		*(__PTR) = (u64)__data * NSEC_PER_MSEC;			\
+ 	else								\
+@@ -4769,12 +4770,13 @@ STORE_FUNCTION(cfq_target_latency_store, &cfqd->cfq_target_latency, 1, UINT_MAX,
+ static ssize_t __FUNC(struct elevator_queue *e, const char *page, size_t count)	\
+ {									\
+ 	struct cfq_data *cfqd = e->elevator_data;			\
+-	unsigned int __data;						\
++	unsigned int __data, __min = (MIN), __max = (MAX);		\
++									\
+ 	cfq_var_store(&__data, (page));					\
+-	if (__data < (MIN))						\
+-		__data = (MIN);						\
+-	else if (__data > (MAX))					\
+-		__data = (MAX);						\
++	if (__data < __min)						\
++		__data = __min;						\
++	else if (__data > __max)					\
++		__data = __max;						\
+ 	*(__PTR) = (u64)__data * NSEC_PER_USEC;				\
+ 	return count;							\
+ }
+diff --git a/drivers/acpi/acpica/hwregs.c b/drivers/acpi/acpica/hwregs.c
+index 3de794bcf8fa..69603ba52a3a 100644
+--- a/drivers/acpi/acpica/hwregs.c
++++ b/drivers/acpi/acpica/hwregs.c
+@@ -528,13 +528,18 @@ acpi_status acpi_hw_register_read(u32 register_id, u32 *return_value)
+ 
+ 		status =
+ 		    acpi_hw_read(&value64, &acpi_gbl_FADT.xpm2_control_block);
+-		value = (u32)value64;
++		if (ACPI_SUCCESS(status)) {
++			value = (u32)value64;
++		}
+ 		break;
+ 
+ 	case ACPI_REGISTER_PM_TIMER:	/* 32-bit access */
+ 
+ 		status = acpi_hw_read(&value64, &acpi_gbl_FADT.xpm_timer_block);
+-		value = (u32)value64;
++		if (ACPI_SUCCESS(status)) {
++			value = (u32)value64;
++		}
++
+ 		break;
+ 
+ 	case ACPI_REGISTER_SMI_COMMAND_BLOCK:	/* 8-bit access */
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 970dd87d347c..6799d00dd790 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -1612,7 +1612,8 @@ static int acpi_add_single_object(struct acpi_device **child,
+ 	 * Note this must be done before the get power-/wakeup_dev-flags calls.
+ 	 */
+ 	if (type == ACPI_BUS_TYPE_DEVICE)
+-		acpi_bus_get_status(device);
++		if (acpi_bus_get_status(device) < 0)
++			acpi_set_device_status(device, 0);
+ 
+ 	acpi_bus_get_power_flags(device);
+ 	acpi_bus_get_wakeup_device_flags(device);
+@@ -1690,7 +1691,7 @@ static int acpi_bus_type_and_status(acpi_handle handle, int *type,
+ 		 * acpi_add_single_object updates this once we've an acpi_device
+ 		 * so that acpi_bus_get_status' quirk handling can be used.
+ 		 */
+-		*sta = 0;
++		*sta = ACPI_STA_DEFAULT;
+ 		break;
+ 	case ACPI_TYPE_PROCESSOR:
+ 		*type = ACPI_BUS_TYPE_PROCESSOR;
+diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
+index 2a8634a52856..5a628148f3f0 100644
+--- a/drivers/clk/rockchip/clk-rk3399.c
++++ b/drivers/clk/rockchip/clk-rk3399.c
+@@ -1523,6 +1523,7 @@ static const char *const rk3399_pmucru_critical_clocks[] __initconst = {
+ 	"pclk_pmu_src",
+ 	"fclk_cm0s_src_pmu",
+ 	"clk_timer_src_pmu",
++	"pclk_rkpwm_pmu",
+ };
+ 
+ static void __init rk3399_clk_init(struct device_node *np)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index 7dcbac8af9a7..b60aa7d43cb7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -1579,9 +1579,9 @@ struct amdgpu_device {
+ 	DECLARE_HASHTABLE(mn_hash, 7);
+ 
+ 	/* tracking pinned memory */
+-	u64 vram_pin_size;
+-	u64 invisible_pin_size;
+-	u64 gart_pin_size;
++	atomic64_t vram_pin_size;
++	atomic64_t visible_pin_size;
++	atomic64_t gart_pin_size;
+ 
+ 	/* amdkfd interface */
+ 	struct kfd_dev          *kfd;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 9c85a90be293..5a196ec49be8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -257,7 +257,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev,
+ 		return;
+ 	}
+ 
+-	total_vram = adev->gmc.real_vram_size - adev->vram_pin_size;
++	total_vram = adev->gmc.real_vram_size - atomic64_read(&adev->vram_pin_size);
+ 	used_vram = amdgpu_vram_mgr_usage(&adev->mman.bdev.man[TTM_PL_VRAM]);
+ 	free_vram = used_vram >= total_vram ? 0 : total_vram - used_vram;
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 91517b166a3b..063f9aa96946 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -494,13 +494,13 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ 	case AMDGPU_INFO_VRAM_GTT: {
+ 		struct drm_amdgpu_info_vram_gtt vram_gtt;
+ 
+-		vram_gtt.vram_size = adev->gmc.real_vram_size;
+-		vram_gtt.vram_size -= adev->vram_pin_size;
+-		vram_gtt.vram_cpu_accessible_size = adev->gmc.visible_vram_size;
+-		vram_gtt.vram_cpu_accessible_size -= (adev->vram_pin_size - adev->invisible_pin_size);
++		vram_gtt.vram_size = adev->gmc.real_vram_size -
++			atomic64_read(&adev->vram_pin_size);
++		vram_gtt.vram_cpu_accessible_size = adev->gmc.visible_vram_size -
++			atomic64_read(&adev->visible_pin_size);
+ 		vram_gtt.gtt_size = adev->mman.bdev.man[TTM_PL_TT].size;
+ 		vram_gtt.gtt_size *= PAGE_SIZE;
+-		vram_gtt.gtt_size -= adev->gart_pin_size;
++		vram_gtt.gtt_size -= atomic64_read(&adev->gart_pin_size);
+ 		return copy_to_user(out, &vram_gtt,
+ 				    min((size_t)size, sizeof(vram_gtt))) ? -EFAULT : 0;
+ 	}
+@@ -509,17 +509,16 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ 
+ 		memset(&mem, 0, sizeof(mem));
+ 		mem.vram.total_heap_size = adev->gmc.real_vram_size;
+-		mem.vram.usable_heap_size =
+-			adev->gmc.real_vram_size - adev->vram_pin_size;
++		mem.vram.usable_heap_size = adev->gmc.real_vram_size -
++			atomic64_read(&adev->vram_pin_size);
+ 		mem.vram.heap_usage =
+ 			amdgpu_vram_mgr_usage(&adev->mman.bdev.man[TTM_PL_VRAM]);
+ 		mem.vram.max_allocation = mem.vram.usable_heap_size * 3 / 4;
+ 
+ 		mem.cpu_accessible_vram.total_heap_size =
+ 			adev->gmc.visible_vram_size;
+-		mem.cpu_accessible_vram.usable_heap_size =
+-			adev->gmc.visible_vram_size -
+-			(adev->vram_pin_size - adev->invisible_pin_size);
++		mem.cpu_accessible_vram.usable_heap_size = adev->gmc.visible_vram_size -
++			atomic64_read(&adev->visible_pin_size);
+ 		mem.cpu_accessible_vram.heap_usage =
+ 			amdgpu_vram_mgr_vis_usage(&adev->mman.bdev.man[TTM_PL_VRAM]);
+ 		mem.cpu_accessible_vram.max_allocation =
+@@ -527,8 +526,8 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ 
+ 		mem.gtt.total_heap_size = adev->mman.bdev.man[TTM_PL_TT].size;
+ 		mem.gtt.total_heap_size *= PAGE_SIZE;
+-		mem.gtt.usable_heap_size = mem.gtt.total_heap_size
+-			- adev->gart_pin_size;
++		mem.gtt.usable_heap_size = mem.gtt.total_heap_size -
++			atomic64_read(&adev->gart_pin_size);
+ 		mem.gtt.heap_usage =
+ 			amdgpu_gtt_mgr_usage(&adev->mman.bdev.man[TTM_PL_TT]);
+ 		mem.gtt.max_allocation = mem.gtt.usable_heap_size * 3 / 4;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+index 3526efa8960e..3873c3353020 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -50,11 +50,35 @@ static bool amdgpu_need_backup(struct amdgpu_device *adev)
+ 	return true;
+ }
+ 
++/**
++ * amdgpu_bo_subtract_pin_size - Remove BO from pin_size accounting
++ *
++ * @bo: &amdgpu_bo buffer object
++ *
++ * This function is called when a BO stops being pinned, and updates the
++ * &amdgpu_device pin_size values accordingly.
++ */
++static void amdgpu_bo_subtract_pin_size(struct amdgpu_bo *bo)
++{
++	struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev);
++
++	if (bo->tbo.mem.mem_type == TTM_PL_VRAM) {
++		atomic64_sub(amdgpu_bo_size(bo), &adev->vram_pin_size);
++		atomic64_sub(amdgpu_vram_mgr_bo_visible_size(bo),
++			     &adev->visible_pin_size);
++	} else if (bo->tbo.mem.mem_type == TTM_PL_TT) {
++		atomic64_sub(amdgpu_bo_size(bo), &adev->gart_pin_size);
++	}
++}
++
+ static void amdgpu_ttm_bo_destroy(struct ttm_buffer_object *tbo)
+ {
+ 	struct amdgpu_device *adev = amdgpu_ttm_adev(tbo->bdev);
+ 	struct amdgpu_bo *bo = ttm_to_amdgpu_bo(tbo);
+ 
++	if (bo->pin_count > 0)
++		amdgpu_bo_subtract_pin_size(bo);
++
+ 	if (bo->kfd_bo)
+ 		amdgpu_amdkfd_unreserve_system_memory_limit(bo);
+ 
+@@ -761,10 +785,11 @@ int amdgpu_bo_pin_restricted(struct amdgpu_bo *bo, u32 domain,
+ 
+ 	domain = amdgpu_mem_type_to_domain(bo->tbo.mem.mem_type);
+ 	if (domain == AMDGPU_GEM_DOMAIN_VRAM) {
+-		adev->vram_pin_size += amdgpu_bo_size(bo);
+-		adev->invisible_pin_size += amdgpu_vram_mgr_bo_invisible_size(bo);
++		atomic64_add(amdgpu_bo_size(bo), &adev->vram_pin_size);
++		atomic64_add(amdgpu_vram_mgr_bo_visible_size(bo),
++			     &adev->visible_pin_size);
+ 	} else if (domain == AMDGPU_GEM_DOMAIN_GTT) {
+-		adev->gart_pin_size += amdgpu_bo_size(bo);
++		atomic64_add(amdgpu_bo_size(bo), &adev->gart_pin_size);
+ 	}
+ 
+ error:
+@@ -790,12 +815,7 @@ int amdgpu_bo_unpin(struct amdgpu_bo *bo)
+ 	if (bo->pin_count)
+ 		return 0;
+ 
+-	if (bo->tbo.mem.mem_type == TTM_PL_VRAM) {
+-		adev->vram_pin_size -= amdgpu_bo_size(bo);
+-		adev->invisible_pin_size -= amdgpu_vram_mgr_bo_invisible_size(bo);
+-	} else if (bo->tbo.mem.mem_type == TTM_PL_TT) {
+-		adev->gart_pin_size -= amdgpu_bo_size(bo);
+-	}
++	amdgpu_bo_subtract_pin_size(bo);
+ 
+ 	for (i = 0; i < bo->placement.num_placement; i++) {
+ 		bo->placements[i].lpfn = 0;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+index a44c3d58fef4..2ec20348b983 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -1157,7 +1157,7 @@ static ssize_t amdgpu_hwmon_show_vddnb(struct device *dev,
+ 	int r, size = sizeof(vddnb);
+ 
+ 	/* only APUs have vddnb */
+-	if  (adev->flags & AMD_IS_APU)
++	if  (!(adev->flags & AMD_IS_APU))
+ 		return -EINVAL;
+ 
+ 	/* Can't get voltage when the card is off */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 9f1a5bd39ae8..5b39d1399630 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -131,6 +131,11 @@ psp_cmd_submit_buf(struct psp_context *psp,
+ 		msleep(1);
+ 	}
+ 
++	if (ucode) {
++		ucode->tmr_mc_addr_lo = psp->cmd_buf_mem->resp.fw_addr_lo;
++		ucode->tmr_mc_addr_hi = psp->cmd_buf_mem->resp.fw_addr_hi;
++	}
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+index 86a0715d9431..1cafe8d83a4d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+@@ -53,9 +53,8 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,
+ 						  int fd,
+ 						  enum drm_sched_priority priority)
+ {
+-	struct file *filp = fcheck(fd);
++	struct file *filp = fget(fd);
+ 	struct drm_file *file;
+-	struct pid *pid;
+ 	struct amdgpu_fpriv *fpriv;
+ 	struct amdgpu_ctx *ctx;
+ 	uint32_t id;
+@@ -63,20 +62,12 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,
+ 	if (!filp)
+ 		return -EINVAL;
+ 
+-	pid = get_pid(((struct drm_file *)filp->private_data)->pid);
++	file = filp->private_data;
++	fpriv = file->driver_priv;
++	idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id)
++		amdgpu_ctx_priority_override(ctx, priority);
+ 
+-	mutex_lock(&adev->ddev->filelist_mutex);
+-	list_for_each_entry(file, &adev->ddev->filelist, lhead) {
+-		if (file->pid != pid)
+-			continue;
+-
+-		fpriv = file->driver_priv;
+-		idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id)
+-				amdgpu_ctx_priority_override(ctx, priority);
+-	}
+-	mutex_unlock(&adev->ddev->filelist_mutex);
+-
+-	put_pid(pid);
++	fput(filp);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
+index e5da4654b630..8b3cc6687769 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
+@@ -73,7 +73,7 @@ bool amdgpu_gtt_mgr_has_gart_addr(struct ttm_mem_reg *mem);
+ uint64_t amdgpu_gtt_mgr_usage(struct ttm_mem_type_manager *man);
+ int amdgpu_gtt_mgr_recover(struct ttm_mem_type_manager *man);
+ 
+-u64 amdgpu_vram_mgr_bo_invisible_size(struct amdgpu_bo *bo);
++u64 amdgpu_vram_mgr_bo_visible_size(struct amdgpu_bo *bo);
+ uint64_t amdgpu_vram_mgr_usage(struct ttm_mem_type_manager *man);
+ uint64_t amdgpu_vram_mgr_vis_usage(struct ttm_mem_type_manager *man);
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h
+index 08e38579af24..bdc472b6e641 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h
+@@ -194,6 +194,7 @@ enum AMDGPU_UCODE_ID {
+ 	AMDGPU_UCODE_ID_SMC,
+ 	AMDGPU_UCODE_ID_UVD,
+ 	AMDGPU_UCODE_ID_VCE,
++	AMDGPU_UCODE_ID_VCN,
+ 	AMDGPU_UCODE_ID_MAXIMUM,
+ };
+ 
+@@ -226,6 +227,9 @@ struct amdgpu_firmware_info {
+ 	void *kaddr;
+ 	/* ucode_size_bytes */
+ 	uint32_t ucode_size;
++	/* starting tmr mc address */
++	uint32_t tmr_mc_addr_lo;
++	uint32_t tmr_mc_addr_hi;
+ };
+ 
+ void amdgpu_ucode_print_mc_hdr(const struct common_firmware_header *hdr);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+index 1b4ad9b2a755..bee49991c1ff 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+@@ -111,9 +111,10 @@ int amdgpu_vcn_sw_init(struct amdgpu_device *adev)
+ 			version_major, version_minor, family_id);
+ 	}
+ 
+-	bo_size = AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8)
+-		  +  AMDGPU_VCN_STACK_SIZE + AMDGPU_VCN_HEAP_SIZE
++	bo_size = AMDGPU_VCN_STACK_SIZE + AMDGPU_VCN_HEAP_SIZE
+ 		  +  AMDGPU_VCN_SESSION_SIZE * 40;
++	if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP)
++		bo_size += AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8);
+ 	r = amdgpu_bo_create_kernel(adev, bo_size, PAGE_SIZE,
+ 				    AMDGPU_GEM_DOMAIN_VRAM, &adev->vcn.vcpu_bo,
+ 				    &adev->vcn.gpu_addr, &adev->vcn.cpu_addr);
+@@ -187,11 +188,13 @@ int amdgpu_vcn_resume(struct amdgpu_device *adev)
+ 		unsigned offset;
+ 
+ 		hdr = (const struct common_firmware_header *)adev->vcn.fw->data;
+-		offset = le32_to_cpu(hdr->ucode_array_offset_bytes);
+-		memcpy_toio(adev->vcn.cpu_addr, adev->vcn.fw->data + offset,
+-			    le32_to_cpu(hdr->ucode_size_bytes));
+-		size -= le32_to_cpu(hdr->ucode_size_bytes);
+-		ptr += le32_to_cpu(hdr->ucode_size_bytes);
++		if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) {
++			offset = le32_to_cpu(hdr->ucode_array_offset_bytes);
++			memcpy_toio(adev->vcn.cpu_addr, adev->vcn.fw->data + offset,
++				    le32_to_cpu(hdr->ucode_size_bytes));
++			size -= le32_to_cpu(hdr->ucode_size_bytes);
++			ptr += le32_to_cpu(hdr->ucode_size_bytes);
++		}
+ 		memset_io(ptr, 0, size);
+ 	}
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+index b6333f92ba45..ef4784458800 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+@@ -97,33 +97,29 @@ static u64 amdgpu_vram_mgr_vis_size(struct amdgpu_device *adev,
+ }
+ 
+ /**
+- * amdgpu_vram_mgr_bo_invisible_size - CPU invisible BO size
++ * amdgpu_vram_mgr_bo_visible_size - CPU visible BO size
+  *
+  * @bo: &amdgpu_bo buffer object (must be in VRAM)
+  *
+  * Returns:
+- * How much of the given &amdgpu_bo buffer object lies in CPU invisible VRAM.
++ * How much of the given &amdgpu_bo buffer object lies in CPU visible VRAM.
+  */
+-u64 amdgpu_vram_mgr_bo_invisible_size(struct amdgpu_bo *bo)
++u64 amdgpu_vram_mgr_bo_visible_size(struct amdgpu_bo *bo)
+ {
+ 	struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev);
+ 	struct ttm_mem_reg *mem = &bo->tbo.mem;
+ 	struct drm_mm_node *nodes = mem->mm_node;
+ 	unsigned pages = mem->num_pages;
+-	u64 usage = 0;
++	u64 usage;
+ 
+ 	if (adev->gmc.visible_vram_size == adev->gmc.real_vram_size)
+-		return 0;
++		return amdgpu_bo_size(bo);
+ 
+ 	if (mem->start >= adev->gmc.visible_vram_size >> PAGE_SHIFT)
+-		return amdgpu_bo_size(bo);
++		return 0;
+ 
+-	while (nodes && pages) {
+-		usage += nodes->size << PAGE_SHIFT;
+-		usage -= amdgpu_vram_mgr_vis_size(adev, nodes);
+-		pages -= nodes->size;
+-		++nodes;
+-	}
++	for (usage = 0; nodes && pages; pages -= nodes->size, nodes++)
++		usage += amdgpu_vram_mgr_vis_size(adev, nodes);
+ 
+ 	return usage;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index a69153435ea7..8f0ac805ecd2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -3433,7 +3433,7 @@ static void gfx_v9_0_enter_rlc_safe_mode(struct amdgpu_device *adev)
+ 
+ 		/* wait for RLC_SAFE_MODE */
+ 		for (i = 0; i < adev->usec_timeout; i++) {
+-			if (!REG_GET_FIELD(SOC15_REG_OFFSET(GC, 0, mmRLC_SAFE_MODE), RLC_SAFE_MODE, CMD))
++			if (!REG_GET_FIELD(RREG32_SOC15(GC, 0, mmRLC_SAFE_MODE), RLC_SAFE_MODE, CMD))
+ 				break;
+ 			udelay(1);
+ 		}
+diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c
+index 0ff136d02d9b..02be34e72ed9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/psp_v10_0.c
+@@ -88,6 +88,9 @@ psp_v10_0_get_fw_type(struct amdgpu_firmware_info *ucode, enum psp_gfx_fw_type *
+ 	case AMDGPU_UCODE_ID_VCE:
+ 		*type = GFX_FW_TYPE_VCE;
+ 		break;
++	case AMDGPU_UCODE_ID_VCN:
++		*type = GFX_FW_TYPE_VCN;
++		break;
+ 	case AMDGPU_UCODE_ID_MAXIMUM:
+ 	default:
+ 		return -EINVAL;
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+index bfddf97dd13e..a16eebc05d12 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+@@ -1569,7 +1569,6 @@ static const struct amdgpu_ring_funcs uvd_v6_0_ring_phys_funcs = {
+ static const struct amdgpu_ring_funcs uvd_v6_0_ring_vm_funcs = {
+ 	.type = AMDGPU_RING_TYPE_UVD,
+ 	.align_mask = 0xf,
+-	.nop = PACKET0(mmUVD_NO_OP, 0),
+ 	.support_64bit_ptrs = false,
+ 	.get_rptr = uvd_v6_0_ring_get_rptr,
+ 	.get_wptr = uvd_v6_0_ring_get_wptr,
+@@ -1587,7 +1586,7 @@ static const struct amdgpu_ring_funcs uvd_v6_0_ring_vm_funcs = {
+ 	.emit_hdp_flush = uvd_v6_0_ring_emit_hdp_flush,
+ 	.test_ring = uvd_v6_0_ring_test_ring,
+ 	.test_ib = amdgpu_uvd_ring_test_ib,
+-	.insert_nop = amdgpu_ring_insert_nop,
++	.insert_nop = uvd_v6_0_ring_insert_nop,
+ 	.pad_ib = amdgpu_ring_generic_pad_ib,
+ 	.begin_use = amdgpu_uvd_ring_begin_use,
+ 	.end_use = amdgpu_uvd_ring_end_use,
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+index 29684c3ea4ef..700119168067 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+@@ -90,6 +90,16 @@ static int vcn_v1_0_sw_init(void *handle)
+ 	if (r)
+ 		return r;
+ 
++	if (adev->firmware.load_type == AMDGPU_FW_LOAD_PSP) {
++		const struct common_firmware_header *hdr;
++		hdr = (const struct common_firmware_header *)adev->vcn.fw->data;
++		adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].ucode_id = AMDGPU_UCODE_ID_VCN;
++		adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].fw = adev->vcn.fw;
++		adev->firmware.fw_size +=
++			ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
++		DRM_INFO("PSP loading VCN firmware\n");
++	}
++
+ 	r = amdgpu_vcn_resume(adev);
+ 	if (r)
+ 		return r;
+@@ -241,26 +251,38 @@ static int vcn_v1_0_resume(void *handle)
+ static void vcn_v1_0_mc_resume(struct amdgpu_device *adev)
+ {
+ 	uint32_t size = AMDGPU_GPU_PAGE_ALIGN(adev->vcn.fw->size + 4);
+-
+-	WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_LOW,
++	uint32_t offset;
++
++	if (adev->firmware.load_type == AMDGPU_FW_LOAD_PSP) {
++		WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_LOW,
++			     (adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].tmr_mc_addr_lo));
++		WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_HIGH,
++			     (adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].tmr_mc_addr_hi));
++		WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET0, 0);
++		offset = 0;
++	} else {
++		WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_LOW,
+ 			lower_32_bits(adev->vcn.gpu_addr));
+-	WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_HIGH,
++		WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE_64BIT_BAR_HIGH,
+ 			upper_32_bits(adev->vcn.gpu_addr));
+-	WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET0,
+-				AMDGPU_UVD_FIRMWARE_OFFSET >> 3);
++		offset = size;
++		WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET0,
++			     AMDGPU_UVD_FIRMWARE_OFFSET >> 3);
++	}
++
+ 	WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_SIZE0, size);
+ 
+ 	WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE1_64BIT_BAR_LOW,
+-			lower_32_bits(adev->vcn.gpu_addr + size));
++		     lower_32_bits(adev->vcn.gpu_addr + offset));
+ 	WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE1_64BIT_BAR_HIGH,
+-			upper_32_bits(adev->vcn.gpu_addr + size));
++		     upper_32_bits(adev->vcn.gpu_addr + offset));
+ 	WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET1, 0);
+ 	WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_SIZE1, AMDGPU_VCN_HEAP_SIZE);
+ 
+ 	WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE2_64BIT_BAR_LOW,
+-			lower_32_bits(adev->vcn.gpu_addr + size + AMDGPU_VCN_HEAP_SIZE));
++		     lower_32_bits(adev->vcn.gpu_addr + offset + AMDGPU_VCN_HEAP_SIZE));
+ 	WREG32_SOC15(UVD, 0, mmUVD_LMI_VCPU_CACHE2_64BIT_BAR_HIGH,
+-			upper_32_bits(adev->vcn.gpu_addr + size + AMDGPU_VCN_HEAP_SIZE));
++		     upper_32_bits(adev->vcn.gpu_addr + offset + AMDGPU_VCN_HEAP_SIZE));
+ 	WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_OFFSET2, 0);
+ 	WREG32_SOC15(UVD, 0, mmUVD_VCPU_CACHE_SIZE2,
+ 			AMDGPU_VCN_STACK_SIZE + (AMDGPU_VCN_SESSION_SIZE * 40));
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 770c6b24be0b..e484d0a94bdc 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1334,6 +1334,7 @@ amdgpu_dm_register_backlight_device(struct amdgpu_display_manager *dm)
+ 	struct backlight_properties props = { 0 };
+ 
+ 	props.max_brightness = AMDGPU_MAX_BL_LEVEL;
++	props.brightness = AMDGPU_MAX_BL_LEVEL;
+ 	props.type = BACKLIGHT_RAW;
+ 
+ 	snprintf(bl_name, sizeof(bl_name), "amdgpu_bl%d",
+@@ -2123,13 +2124,8 @@ convert_color_depth_from_display_info(const struct drm_connector *connector)
+ static enum dc_aspect_ratio
+ get_aspect_ratio(const struct drm_display_mode *mode_in)
+ {
+-	int32_t width = mode_in->crtc_hdisplay * 9;
+-	int32_t height = mode_in->crtc_vdisplay * 16;
+-
+-	if ((width - height) < 10 && (width - height) > -10)
+-		return ASPECT_RATIO_16_9;
+-	else
+-		return ASPECT_RATIO_4_3;
++	/* 1-1 mapping, since both enums follow the HDMI spec. */
++	return (enum dc_aspect_ratio) mode_in->picture_aspect_ratio;
+ }
+ 
+ static enum dc_color_space
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+index 52f2c01349e3..9bfb040352e9 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+@@ -98,10 +98,16 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crtc, const char *src_name,
+  */
+ void amdgpu_dm_crtc_handle_crc_irq(struct drm_crtc *crtc)
+ {
+-	struct dm_crtc_state *crtc_state = to_dm_crtc_state(crtc->state);
+-	struct dc_stream_state *stream_state = crtc_state->stream;
++	struct dm_crtc_state *crtc_state;
++	struct dc_stream_state *stream_state;
+ 	uint32_t crcs[3];
+ 
++	if (crtc == NULL)
++		return;
++
++	crtc_state = to_dm_crtc_state(crtc->state);
++	stream_state = crtc_state->stream;
++
+ 	/* Early return if CRC capture is not enabled. */
+ 	if (!crtc_state->crc_enabled)
+ 		return;
+diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table.c b/drivers/gpu/drm/amd/display/dc/bios/command_table.c
+index 651e1fd4622f..a558bfaa0c46 100644
+--- a/drivers/gpu/drm/amd/display/dc/bios/command_table.c
++++ b/drivers/gpu/drm/amd/display/dc/bios/command_table.c
+@@ -808,6 +808,24 @@ static enum bp_result transmitter_control_v1_5(
+ 	 * (=1: 8bpp, =1.25: 10bpp, =1.5:12bpp, =2: 16bpp)
+ 	 * LVDS mode: usPixelClock = pixel clock
+ 	 */
++	if  (cntl->signal == SIGNAL_TYPE_HDMI_TYPE_A) {
++		switch (cntl->color_depth) {
++		case COLOR_DEPTH_101010:
++			params.usSymClock =
++				cpu_to_le16((le16_to_cpu(params.usSymClock) * 30) / 24);
++			break;
++		case COLOR_DEPTH_121212:
++			params.usSymClock =
++				cpu_to_le16((le16_to_cpu(params.usSymClock) * 36) / 24);
++			break;
++		case COLOR_DEPTH_161616:
++			params.usSymClock =
++				cpu_to_le16((le16_to_cpu(params.usSymClock) * 48) / 24);
++			break;
++		default:
++			break;
++		}
++	}
+ 
+ 	if (EXEC_BIOS_CMD_TABLE(UNIPHYTransmitterControl, params))
+ 		result = BP_RESULT_OK;
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 2fa521812d23..8a7890b03d97 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -728,6 +728,17 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
+ 			break;
+ 		case EDID_NO_RESPONSE:
+ 			DC_LOG_ERROR("No EDID read.\n");
++
++			/*
++			 * Abort detection for non-DP connectors if we have
++			 * no EDID
++			 *
++			 * DP needs to report as connected if HDP is high
++			 * even if we have no EDID in order to go to
++			 * fail-safe mode
++			 */
++			if (!dc_is_dp_signal(link->connector_signal))
++				return false;
+ 		default:
+ 			break;
+ 		}
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index 751f3ac9d921..754b4c2fc90a 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -268,24 +268,30 @@ bool resource_construct(
+ 
+ 	return true;
+ }
++static int find_matching_clock_source(
++		const struct resource_pool *pool,
++		struct clock_source *clock_source)
++{
+ 
++	int i;
++
++	for (i = 0; i < pool->clk_src_count; i++) {
++		if (pool->clock_sources[i] == clock_source)
++			return i;
++	}
++	return -1;
++}
+ 
+ void resource_unreference_clock_source(
+ 		struct resource_context *res_ctx,
+ 		const struct resource_pool *pool,
+ 		struct clock_source *clock_source)
+ {
+-	int i;
+-
+-	for (i = 0; i < pool->clk_src_count; i++) {
+-		if (pool->clock_sources[i] != clock_source)
+-			continue;
++	int i = find_matching_clock_source(pool, clock_source);
+ 
++	if (i > -1)
+ 		res_ctx->clock_source_ref_count[i]--;
+ 
+-		break;
+-	}
+-
+ 	if (pool->dp_clock_source == clock_source)
+ 		res_ctx->dp_clock_source_ref_count--;
+ }
+@@ -295,19 +301,31 @@ void resource_reference_clock_source(
+ 		const struct resource_pool *pool,
+ 		struct clock_source *clock_source)
+ {
+-	int i;
+-	for (i = 0; i < pool->clk_src_count; i++) {
+-		if (pool->clock_sources[i] != clock_source)
+-			continue;
++	int i = find_matching_clock_source(pool, clock_source);
+ 
++	if (i > -1)
+ 		res_ctx->clock_source_ref_count[i]++;
+-		break;
+-	}
+ 
+ 	if (pool->dp_clock_source == clock_source)
+ 		res_ctx->dp_clock_source_ref_count++;
+ }
+ 
++int resource_get_clock_source_reference(
++		struct resource_context *res_ctx,
++		const struct resource_pool *pool,
++		struct clock_source *clock_source)
++{
++	int i = find_matching_clock_source(pool, clock_source);
++
++	if (i > -1)
++		return res_ctx->clock_source_ref_count[i];
++
++	if (pool->dp_clock_source == clock_source)
++		return res_ctx->dp_clock_source_ref_count;
++
++	return -1;
++}
++
+ bool resource_are_streams_timing_synchronizable(
+ 	struct dc_stream_state *stream1,
+ 	struct dc_stream_state *stream2)
+@@ -330,6 +348,9 @@ bool resource_are_streams_timing_synchronizable(
+ 				!= stream2->timing.pix_clk_khz)
+ 		return false;
+ 
++	if (stream1->clamping.c_depth != stream2->clamping.c_depth)
++		return false;
++
+ 	if (stream1->phy_pix_clk != stream2->phy_pix_clk
+ 			&& (!dc_is_dp_signal(stream1->signal)
+ 			|| !dc_is_dp_signal(stream2->signal)))
+@@ -337,6 +358,20 @@ bool resource_are_streams_timing_synchronizable(
+ 
+ 	return true;
+ }
++static bool is_dp_and_hdmi_sharable(
++		struct dc_stream_state *stream1,
++		struct dc_stream_state *stream2)
++{
++	if (stream1->ctx->dc->caps.disable_dp_clk_share)
++		return false;
++
++	if (stream1->clamping.c_depth != COLOR_DEPTH_888 ||
++	    stream2->clamping.c_depth != COLOR_DEPTH_888)
++	return false;
++
++	return true;
++
++}
+ 
+ static bool is_sharable_clk_src(
+ 	const struct pipe_ctx *pipe_with_clk_src,
+@@ -348,7 +383,10 @@ static bool is_sharable_clk_src(
+ 	if (pipe_with_clk_src->stream->signal == SIGNAL_TYPE_VIRTUAL)
+ 		return false;
+ 
+-	if (dc_is_dp_signal(pipe_with_clk_src->stream->signal))
++	if (dc_is_dp_signal(pipe_with_clk_src->stream->signal) ||
++		(dc_is_dp_signal(pipe->stream->signal) &&
++		!is_dp_and_hdmi_sharable(pipe_with_clk_src->stream,
++				     pipe->stream)))
+ 		return false;
+ 
+ 	if (dc_is_hdmi_signal(pipe_with_clk_src->stream->signal)
+diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
+index 53c71296f3dd..efe155d50668 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc.h
++++ b/drivers/gpu/drm/amd/display/dc/dc.h
+@@ -77,6 +77,7 @@ struct dc_caps {
+ 	bool dual_link_dvi;
+ 	bool post_blend_color_processing;
+ 	bool force_dp_tps4_for_cp2520;
++	bool disable_dp_clk_share;
+ };
+ 
+ struct dc_dcc_surface_param {
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
+index dbe3b26b6d9e..f6ec1d3dfd0c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
+@@ -919,7 +919,7 @@ void dce110_link_encoder_enable_tmds_output(
+ 	enum bp_result result;
+ 
+ 	/* Enable the PHY */
+-
++	cntl.connector_obj_id = enc110->base.connector;
+ 	cntl.action = TRANSMITTER_CONTROL_ENABLE;
+ 	cntl.engine_id = enc->preferred_engine;
+ 	cntl.transmitter = enc110->base.transmitter;
+@@ -961,7 +961,7 @@ void dce110_link_encoder_enable_dp_output(
+ 	 * We need to set number of lanes manually.
+ 	 */
+ 	configure_encoder(enc110, link_settings);
+-
++	cntl.connector_obj_id = enc110->base.connector;
+ 	cntl.action = TRANSMITTER_CONTROL_ENABLE;
+ 	cntl.engine_id = enc->preferred_engine;
+ 	cntl.transmitter = enc110->base.transmitter;
+diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+index 344dd2e69e7c..aa2f03eb46fe 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+@@ -884,7 +884,7 @@ static bool construct(
+ 	dc->caps.i2c_speed_in_khz = 40;
+ 	dc->caps.max_cursor_size = 128;
+ 	dc->caps.dual_link_dvi = true;
+-
++	dc->caps.disable_dp_clk_share = true;
+ 	for (i = 0; i < pool->base.pipe_count; i++) {
+ 		pool->base.timing_generators[i] =
+ 			dce100_timing_generator_create(
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_compressor.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_compressor.c
+index e2994d337044..111c4921987f 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_compressor.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_compressor.c
+@@ -143,7 +143,7 @@ static void wait_for_fbc_state_changed(
+ 	struct dce110_compressor *cp110,
+ 	bool enabled)
+ {
+-	uint8_t counter = 0;
++	uint16_t counter = 0;
+ 	uint32_t addr = mmFBC_STATUS;
+ 	uint32_t value;
+ 
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index c29052b6da5a..7c0b1d7aa9b8 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -1939,7 +1939,9 @@ static void dce110_reset_hw_ctx_wrap(
+ 			pipe_ctx_old->plane_res.mi->funcs->free_mem_input(
+ 					pipe_ctx_old->plane_res.mi, dc->current_state->stream_count);
+ 
+-			if (old_clk)
++			if (old_clk && 0 == resource_get_clock_source_reference(&context->res_ctx,
++										dc->res_pool,
++										old_clk))
+ 				old_clk->funcs->cs_power_down(old_clk);
+ 
+ 			dc->hwss.disable_plane(dc, pipe_ctx_old);
+diff --git a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
+index 48a068964722..6f4992bdc9ce 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
+@@ -902,6 +902,7 @@ static bool dce80_construct(
+ 	}
+ 
+ 	dc->caps.max_planes =  pool->base.pipe_count;
++	dc->caps.disable_dp_clk_share = true;
+ 
+ 	if (!resource_construct(num_virtual_links, dc, &pool->base,
+ 			&res_create_funcs))
+@@ -1087,6 +1088,7 @@ static bool dce81_construct(
+ 	}
+ 
+ 	dc->caps.max_planes =  pool->base.pipe_count;
++	dc->caps.disable_dp_clk_share = true;
+ 
+ 	if (!resource_construct(num_virtual_links, dc, &pool->base,
+ 			&res_create_funcs))
+@@ -1268,6 +1270,7 @@ static bool dce83_construct(
+ 	}
+ 
+ 	dc->caps.max_planes =  pool->base.pipe_count;
++	dc->caps.disable_dp_clk_share = true;
+ 
+ 	if (!resource_construct(num_virtual_links, dc, &pool->base,
+ 			&res_create_funcs))
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/resource.h b/drivers/gpu/drm/amd/display/dc/inc/resource.h
+index 640a647f4611..abf42a7d0859 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/resource.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/resource.h
+@@ -102,6 +102,11 @@ void resource_reference_clock_source(
+ 		const struct resource_pool *pool,
+ 		struct clock_source *clock_source);
+ 
++int resource_get_clock_source_reference(
++		struct resource_context *res_ctx,
++		const struct resource_pool *pool,
++		struct clock_source *clock_source);
++
+ bool resource_are_streams_timing_synchronizable(
+ 		struct dc_stream_state *stream1,
+ 		struct dc_stream_state *stream2);
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c
+index c952845833d7..5e19f5977eb1 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_powertune.c
+@@ -403,6 +403,49 @@ static const struct gpu_pt_config_reg DIDTConfig_Polaris12[] = {
+ 	{   ixDIDT_SQ_CTRL1,                   DIDT_SQ_CTRL1__MAX_POWER_MASK,                      DIDT_SQ_CTRL1__MAX_POWER__SHIFT,                    0xffff,     GPU_CONFIGREG_DIDT_IND },
+ 
+ 	{   ixDIDT_SQ_CTRL_OCP,                DIDT_SQ_CTRL_OCP__UNUSED_0_MASK,                    DIDT_SQ_CTRL_OCP__UNUSED_0__SHIFT,                  0x0000,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL_OCP,                DIDT_SQ_CTRL_OCP__OCP_MAX_POWER_MASK,               DIDT_SQ_CTRL_OCP__OCP_MAX_POWER__SHIFT,             0xffff,     GPU_CONFIGREG_DIDT_IND },
++
++	{   ixDIDT_SQ_CTRL2,                   DIDT_SQ_CTRL2__MAX_POWER_DELTA_MASK,                DIDT_SQ_CTRL2__MAX_POWER_DELTA__SHIFT,              0x3853,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL2,                   DIDT_SQ_CTRL2__UNUSED_0_MASK,                       DIDT_SQ_CTRL2__UNUSED_0__SHIFT,                     0x0000,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL2,                   DIDT_SQ_CTRL2__SHORT_TERM_INTERVAL_SIZE_MASK,       DIDT_SQ_CTRL2__SHORT_TERM_INTERVAL_SIZE__SHIFT,     0x005a,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL2,                   DIDT_SQ_CTRL2__UNUSED_1_MASK,                       DIDT_SQ_CTRL2__UNUSED_1__SHIFT,                     0x0000,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL2,                   DIDT_SQ_CTRL2__LONG_TERM_INTERVAL_RATIO_MASK,       DIDT_SQ_CTRL2__LONG_TERM_INTERVAL_RATIO__SHIFT,     0x0000,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL2,                   DIDT_SQ_CTRL2__UNUSED_2_MASK,                       DIDT_SQ_CTRL2__UNUSED_2__SHIFT,                     0x0000,     GPU_CONFIGREG_DIDT_IND },
++
++	{   ixDIDT_SQ_STALL_CTRL,              DIDT_SQ_STALL_CTRL__DIDT_STALL_CTRL_ENABLE_MASK,    DIDT_SQ_STALL_CTRL__DIDT_STALL_CTRL_ENABLE__SHIFT,  0x0001,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_STALL_CTRL,              DIDT_SQ_STALL_CTRL__DIDT_STALL_DELAY_HI_MASK,       DIDT_SQ_STALL_CTRL__DIDT_STALL_DELAY_HI__SHIFT,     0x0001,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_STALL_CTRL,              DIDT_SQ_STALL_CTRL__DIDT_STALL_DELAY_LO_MASK,       DIDT_SQ_STALL_CTRL__DIDT_STALL_DELAY_LO__SHIFT,     0x0001,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_STALL_CTRL,              DIDT_SQ_STALL_CTRL__DIDT_HI_POWER_THRESHOLD_MASK,   DIDT_SQ_STALL_CTRL__DIDT_HI_POWER_THRESHOLD__SHIFT, 0x0ebb,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_STALL_CTRL,              DIDT_SQ_STALL_CTRL__UNUSED_0_MASK,                  DIDT_SQ_STALL_CTRL__UNUSED_0__SHIFT,                0x0000,     GPU_CONFIGREG_DIDT_IND },
++
++	{   ixDIDT_SQ_TUNING_CTRL,             DIDT_SQ_TUNING_CTRL__DIDT_TUNING_ENABLE_MASK,       DIDT_SQ_TUNING_CTRL__DIDT_TUNING_ENABLE__SHIFT,     0x0001,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_TUNING_CTRL,             DIDT_SQ_TUNING_CTRL__MAX_POWER_DELTA_HI_MASK,       DIDT_SQ_TUNING_CTRL__MAX_POWER_DELTA_HI__SHIFT,     0x3853,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_TUNING_CTRL,             DIDT_SQ_TUNING_CTRL__MAX_POWER_DELTA_LO_MASK,       DIDT_SQ_TUNING_CTRL__MAX_POWER_DELTA_LO__SHIFT,     0x3153,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_TUNING_CTRL,             DIDT_SQ_TUNING_CTRL__UNUSED_0_MASK,                 DIDT_SQ_TUNING_CTRL__UNUSED_0__SHIFT,               0x0000,     GPU_CONFIGREG_DIDT_IND },
++
++	{   ixDIDT_SQ_CTRL0,                   DIDT_SQ_CTRL0__DIDT_CTRL_EN_MASK,                   DIDT_SQ_CTRL0__DIDT_CTRL_EN__SHIFT,                 0x0001,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL0,                   DIDT_SQ_CTRL0__USE_REF_CLOCK_MASK,                  DIDT_SQ_CTRL0__USE_REF_CLOCK__SHIFT,                0x0000,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL0,                   DIDT_SQ_CTRL0__PHASE_OFFSET_MASK,                   DIDT_SQ_CTRL0__PHASE_OFFSET__SHIFT,                 0x0000,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL0,                   DIDT_SQ_CTRL0__DIDT_CTRL_RST_MASK,                  DIDT_SQ_CTRL0__DIDT_CTRL_RST__SHIFT,                0x0000,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL0,                   DIDT_SQ_CTRL0__DIDT_CLK_EN_OVERRIDE_MASK,           DIDT_SQ_CTRL0__DIDT_CLK_EN_OVERRIDE__SHIFT,         0x0000,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL0,                   DIDT_SQ_CTRL0__DIDT_MAX_STALLS_ALLOWED_HI_MASK,     DIDT_SQ_CTRL0__DIDT_MAX_STALLS_ALLOWED_HI__SHIFT,   0x0010,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL0,                   DIDT_SQ_CTRL0__DIDT_MAX_STALLS_ALLOWED_LO_MASK,     DIDT_SQ_CTRL0__DIDT_MAX_STALLS_ALLOWED_LO__SHIFT,   0x0010,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_SQ_CTRL0,                   DIDT_SQ_CTRL0__UNUSED_0_MASK,                       DIDT_SQ_CTRL0__UNUSED_0__SHIFT,                     0x0000,     GPU_CONFIGREG_DIDT_IND },
++
++	{   ixDIDT_TD_WEIGHT0_3,               DIDT_TD_WEIGHT0_3__WEIGHT0_MASK,                    DIDT_TD_WEIGHT0_3__WEIGHT0__SHIFT,                  0x000a,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_TD_WEIGHT0_3,               DIDT_TD_WEIGHT0_3__WEIGHT1_MASK,                    DIDT_TD_WEIGHT0_3__WEIGHT1__SHIFT,                  0x0010,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_TD_WEIGHT0_3,               DIDT_TD_WEIGHT0_3__WEIGHT2_MASK,                    DIDT_TD_WEIGHT0_3__WEIGHT2__SHIFT,                  0x0017,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_TD_WEIGHT0_3,               DIDT_TD_WEIGHT0_3__WEIGHT3_MASK,                    DIDT_TD_WEIGHT0_3__WEIGHT3__SHIFT,                  0x002f,     GPU_CONFIGREG_DIDT_IND },
++
++	{   ixDIDT_TD_WEIGHT4_7,               DIDT_TD_WEIGHT4_7__WEIGHT4_MASK,                    DIDT_TD_WEIGHT4_7__WEIGHT4__SHIFT,                  0x0046,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_TD_WEIGHT4_7,               DIDT_TD_WEIGHT4_7__WEIGHT5_MASK,                    DIDT_TD_WEIGHT4_7__WEIGHT5__SHIFT,                  0x005d,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_TD_WEIGHT4_7,               DIDT_TD_WEIGHT4_7__WEIGHT6_MASK,                    DIDT_TD_WEIGHT4_7__WEIGHT6__SHIFT,                  0x0000,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_TD_WEIGHT4_7,               DIDT_TD_WEIGHT4_7__WEIGHT7_MASK,                    DIDT_TD_WEIGHT4_7__WEIGHT7__SHIFT,                  0x0000,     GPU_CONFIGREG_DIDT_IND },
++
++	{   ixDIDT_TD_CTRL1,                   DIDT_TD_CTRL1__MIN_POWER_MASK,                      DIDT_TD_CTRL1__MIN_POWER__SHIFT,                    0x0000,     GPU_CONFIGREG_DIDT_IND },
++	{   ixDIDT_TD_CTRL1,                   DIDT_TD_CTRL1__MAX_POWER_MASK,                      DIDT_TD_CTRL1__MAX_POWER__SHIFT,                    0xffff,     GPU_CONFIGREG_DIDT_IND },
++
++	{   ixDIDT_TD_CTRL_OCP,                DIDT_TD_CTRL_OCP__UNUSED_0_MASK,                    DIDT_TD_CTRL_OCP__UNUSED_0__SHIFT,                  0x0000,     GPU_CONFIGREG_DIDT_IND },
+ 	{   ixDIDT_TD_CTRL_OCP,                DIDT_TD_CTRL_OCP__OCP_MAX_POWER_MASK,               DIDT_TD_CTRL_OCP__OCP_MAX_POWER__SHIFT,             0x00ff,     GPU_CONFIGREG_DIDT_IND },
+ 
+ 	{   ixDIDT_TD_CTRL2,                   DIDT_TD_CTRL2__MAX_POWER_DELTA_MASK,                DIDT_TD_CTRL2__MAX_POWER_DELTA__SHIFT,              0x3fff,     GPU_CONFIGREG_DIDT_IND },
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+index 50690c72b2ea..617557bd8c24 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+@@ -244,6 +244,7 @@ static int smu8_initialize_dpm_defaults(struct pp_hwmgr *hwmgr)
+ 	return 0;
+ }
+ 
++/* convert form 8bit vid to real voltage in mV*4 */
+ static uint32_t smu8_convert_8Bit_index_to_voltage(
+ 			struct pp_hwmgr *hwmgr, uint16_t voltage)
+ {
+@@ -1702,13 +1703,13 @@ static int smu8_read_sensor(struct pp_hwmgr *hwmgr, int idx,
+ 	case AMDGPU_PP_SENSOR_VDDNB:
+ 		tmp = (cgs_read_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixSMUSVI_NB_CURRENTVID) &
+ 			CURRENT_NB_VID_MASK) >> CURRENT_NB_VID__SHIFT;
+-		vddnb = smu8_convert_8Bit_index_to_voltage(hwmgr, tmp);
++		vddnb = smu8_convert_8Bit_index_to_voltage(hwmgr, tmp) / 4;
+ 		*((uint32_t *)value) = vddnb;
+ 		return 0;
+ 	case AMDGPU_PP_SENSOR_VDDGFX:
+ 		tmp = (cgs_read_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixSMUSVI_GFX_CURRENTVID) &
+ 			CURRENT_GFX_VID_MASK) >> CURRENT_GFX_VID__SHIFT;
+-		vddgfx = smu8_convert_8Bit_index_to_voltage(hwmgr, (u16)tmp);
++		vddgfx = smu8_convert_8Bit_index_to_voltage(hwmgr, (u16)tmp) / 4;
+ 		*((uint32_t *)value) = vddgfx;
+ 		return 0;
+ 	case AMDGPU_PP_SENSOR_UVD_VCLK:
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+index c98e5de777cd..fcd2808874bf 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+@@ -490,7 +490,7 @@ static int vega12_get_number_dpm_level(struct pp_hwmgr *hwmgr,
+ static int vega12_get_dpm_frequency_by_index(struct pp_hwmgr *hwmgr,
+ 		PPCLK_e clkID, uint32_t index, uint32_t *clock)
+ {
+-	int result;
++	int result = 0;
+ 
+ 	/*
+ 	 *SMU expects the Clock ID to be in the top 16 bits.
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index a5808382bdf0..c7b4481c90d7 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -116,6 +116,9 @@ static const struct edid_quirk {
+ 	/* CPT panel of Asus UX303LA reports 8 bpc, but is a 6 bpc panel */
+ 	{ "CPT", 0x17df, EDID_QUIRK_FORCE_6BPC },
+ 
++	/* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */
++	{ "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC },
++
+ 	/* Belinea 10 15 55 */
+ 	{ "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
+ 	{ "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
+@@ -163,8 +166,9 @@ static const struct edid_quirk {
+ 	/* Rotel RSX-1058 forwards sink's EDID but only does HDMI 1.1*/
+ 	{ "ETR", 13896, EDID_QUIRK_FORCE_8BPC },
+ 
+-	/* HTC Vive VR Headset */
++	/* HTC Vive and Vive Pro VR Headsets */
+ 	{ "HVR", 0xaa01, EDID_QUIRK_NON_DESKTOP },
++	{ "HVR", 0xaa02, EDID_QUIRK_NON_DESKTOP },
+ 
+ 	/* Oculus Rift DK1, DK2, and CV1 VR Headsets */
+ 	{ "OVR", 0x0001, EDID_QUIRK_NON_DESKTOP },
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+index 686f6552db48..3ef440b235e5 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+@@ -799,6 +799,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+ 
+ free_buffer:
+ 	etnaviv_cmdbuf_free(&gpu->buffer);
++	gpu->buffer.suballoc = NULL;
+ destroy_iommu:
+ 	etnaviv_iommu_destroy(gpu->mmu);
+ 	gpu->mmu = NULL;
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 9c449b8d8eab..015f9e93419d 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -919,7 +919,6 @@ static int i915_driver_init_early(struct drm_i915_private *dev_priv,
+ 	spin_lock_init(&dev_priv->uncore.lock);
+ 
+ 	mutex_init(&dev_priv->sb_lock);
+-	mutex_init(&dev_priv->modeset_restore_lock);
+ 	mutex_init(&dev_priv->av_mutex);
+ 	mutex_init(&dev_priv->wm.wm_mutex);
+ 	mutex_init(&dev_priv->pps_mutex);
+@@ -1560,11 +1559,6 @@ static int i915_drm_suspend(struct drm_device *dev)
+ 	pci_power_t opregion_target_state;
+ 	int error;
+ 
+-	/* ignore lid events during suspend */
+-	mutex_lock(&dev_priv->modeset_restore_lock);
+-	dev_priv->modeset_restore = MODESET_SUSPENDED;
+-	mutex_unlock(&dev_priv->modeset_restore_lock);
+-
+ 	disable_rpm_wakeref_asserts(dev_priv);
+ 
+ 	/* We do a lot of poking in a lot of registers, make sure they work
+@@ -1764,10 +1758,6 @@ static int i915_drm_resume(struct drm_device *dev)
+ 
+ 	intel_fbdev_set_suspend(dev, FBINFO_STATE_RUNNING, false);
+ 
+-	mutex_lock(&dev_priv->modeset_restore_lock);
+-	dev_priv->modeset_restore = MODESET_DONE;
+-	mutex_unlock(&dev_priv->modeset_restore_lock);
+-
+ 	intel_opregion_notify_adapter(dev_priv, PCI_D0);
+ 
+ 	enable_rpm_wakeref_asserts(dev_priv);
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 71e1aa54f774..7c22fac3aa04 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1003,12 +1003,6 @@ struct i915_gem_mm {
+ #define I915_ENGINE_DEAD_TIMEOUT  (4 * HZ)  /* Seqno, head and subunits dead */
+ #define I915_SEQNO_DEAD_TIMEOUT   (12 * HZ) /* Seqno dead with active head */
+ 
+-enum modeset_restore {
+-	MODESET_ON_LID_OPEN,
+-	MODESET_DONE,
+-	MODESET_SUSPENDED,
+-};
+-
+ #define DP_AUX_A 0x40
+ #define DP_AUX_B 0x10
+ #define DP_AUX_C 0x20
+@@ -1740,8 +1734,6 @@ struct drm_i915_private {
+ 
+ 	unsigned long quirks;
+ 
+-	enum modeset_restore modeset_restore;
+-	struct mutex modeset_restore_lock;
+ 	struct drm_atomic_state *modeset_restore_state;
+ 	struct drm_modeset_acquire_ctx reset_ctx;
+ 
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 7720569f2024..6e048ee88e3f 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -8825,6 +8825,7 @@ enum skl_power_gate {
+ #define  TRANS_MSA_10_BPC		(2<<5)
+ #define  TRANS_MSA_12_BPC		(3<<5)
+ #define  TRANS_MSA_16_BPC		(4<<5)
++#define  TRANS_MSA_CEA_RANGE		(1<<3)
+ 
+ /* LCPLL Control */
+ #define LCPLL_CTL			_MMIO(0x130040)
+diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
+index fed26d6e4e27..e195c287c263 100644
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -1659,6 +1659,10 @@ void intel_ddi_set_pipe_settings(const struct intel_crtc_state *crtc_state)
+ 	WARN_ON(transcoder_is_dsi(cpu_transcoder));
+ 
+ 	temp = TRANS_MSA_SYNC_CLK;
++
++	if (crtc_state->limited_color_range)
++		temp |= TRANS_MSA_CEA_RANGE;
++
+ 	switch (crtc_state->pipe_bpp) {
+ 	case 18:
+ 		temp |= TRANS_MSA_6_BPC;
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 16faea30114a..8e465095fe06 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -4293,18 +4293,6 @@ intel_dp_needs_link_retrain(struct intel_dp *intel_dp)
+ 	return !drm_dp_channel_eq_ok(link_status, intel_dp->lane_count);
+ }
+ 
+-/*
+- * If display is now connected check links status,
+- * there has been known issues of link loss triggering
+- * long pulse.
+- *
+- * Some sinks (eg. ASUS PB287Q) seem to perform some
+- * weird HPD ping pong during modesets. So we can apparently
+- * end up with HPD going low during a modeset, and then
+- * going back up soon after. And once that happens we must
+- * retrain the link to get a picture. That's in case no
+- * userspace component reacted to intermittent HPD dip.
+- */
+ int intel_dp_retrain_link(struct intel_encoder *encoder,
+ 			  struct drm_modeset_acquire_ctx *ctx)
+ {
+@@ -4794,7 +4782,8 @@ intel_dp_unset_edid(struct intel_dp *intel_dp)
+ }
+ 
+ static int
+-intel_dp_long_pulse(struct intel_connector *connector)
++intel_dp_long_pulse(struct intel_connector *connector,
++		    struct drm_modeset_acquire_ctx *ctx)
+ {
+ 	struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
+ 	struct intel_dp *intel_dp = intel_attached_dp(&connector->base);
+@@ -4853,6 +4842,22 @@ intel_dp_long_pulse(struct intel_connector *connector)
+ 		 */
+ 		status = connector_status_disconnected;
+ 		goto out;
++	} else {
++		/*
++		 * If display is now connected check links status,
++		 * there has been known issues of link loss triggering
++		 * long pulse.
++		 *
++		 * Some sinks (eg. ASUS PB287Q) seem to perform some
++		 * weird HPD ping pong during modesets. So we can apparently
++		 * end up with HPD going low during a modeset, and then
++		 * going back up soon after. And once that happens we must
++		 * retrain the link to get a picture. That's in case no
++		 * userspace component reacted to intermittent HPD dip.
++		 */
++		struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
++
++		intel_dp_retrain_link(encoder, ctx);
+ 	}
+ 
+ 	/*
+@@ -4914,7 +4919,7 @@ intel_dp_detect(struct drm_connector *connector,
+ 				return ret;
+ 		}
+ 
+-		status = intel_dp_long_pulse(intel_dp->attached_connector);
++		status = intel_dp_long_pulse(intel_dp->attached_connector, ctx);
+ 	}
+ 
+ 	intel_dp->detect_done = false;
+diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
+index d8cb53ef4351..c8640959a7fc 100644
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -933,8 +933,12 @@ static int intel_hdmi_hdcp_write(struct intel_digital_port *intel_dig_port,
+ 
+ 	ret = i2c_transfer(adapter, &msg, 1);
+ 	if (ret == 1)
+-		return 0;
+-	return ret >= 0 ? -EIO : ret;
++		ret = 0;
++	else if (ret >= 0)
++		ret = -EIO;
++
++	kfree(write_buf);
++	return ret;
+ }
+ 
+ static
+diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
+index b4941101f21a..cdf19553ffac 100644
+--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
++++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
+@@ -127,9 +127,7 @@ lpe_audio_platdev_create(struct drm_i915_private *dev_priv)
+ 		return platdev;
+ 	}
+ 
+-	pm_runtime_forbid(&platdev->dev);
+-	pm_runtime_set_active(&platdev->dev);
+-	pm_runtime_enable(&platdev->dev);
++	pm_runtime_no_callbacks(&platdev->dev);
+ 
+ 	return platdev;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_lspcon.c b/drivers/gpu/drm/i915/intel_lspcon.c
+index 8ae8f42f430a..6b6758419fb3 100644
+--- a/drivers/gpu/drm/i915/intel_lspcon.c
++++ b/drivers/gpu/drm/i915/intel_lspcon.c
+@@ -74,7 +74,7 @@ static enum drm_lspcon_mode lspcon_wait_mode(struct intel_lspcon *lspcon,
+ 	DRM_DEBUG_KMS("Waiting for LSPCON mode %s to settle\n",
+ 		      lspcon_mode_name(mode));
+ 
+-	wait_for((current_mode = lspcon_get_current_mode(lspcon)) == mode, 100);
++	wait_for((current_mode = lspcon_get_current_mode(lspcon)) == mode, 400);
+ 	if (current_mode != mode)
+ 		DRM_ERROR("LSPCON mode hasn't settled\n");
+ 
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 48f618dc9abb..63d7faa99946 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -44,8 +44,6 @@
+ /* Private structure for the integrated LVDS support */
+ struct intel_lvds_connector {
+ 	struct intel_connector base;
+-
+-	struct notifier_block lid_notifier;
+ };
+ 
+ struct intel_lvds_pps {
+@@ -454,26 +452,9 @@ static bool intel_lvds_compute_config(struct intel_encoder *intel_encoder,
+ 	return true;
+ }
+ 
+-/*
+- * Detect the LVDS connection.
+- *
+- * Since LVDS doesn't have hotlug, we use the lid as a proxy.  Open means
+- * connected and closed means disconnected.  We also send hotplug events as
+- * needed, using lid status notification from the input layer.
+- */
+ static enum drm_connector_status
+ intel_lvds_detect(struct drm_connector *connector, bool force)
+ {
+-	struct drm_i915_private *dev_priv = to_i915(connector->dev);
+-	enum drm_connector_status status;
+-
+-	DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
+-		      connector->base.id, connector->name);
+-
+-	status = intel_panel_detect(dev_priv);
+-	if (status != connector_status_unknown)
+-		return status;
+-
+ 	return connector_status_connected;
+ }
+ 
+@@ -498,117 +479,6 @@ static int intel_lvds_get_modes(struct drm_connector *connector)
+ 	return 1;
+ }
+ 
+-static int intel_no_modeset_on_lid_dmi_callback(const struct dmi_system_id *id)
+-{
+-	DRM_INFO("Skipping forced modeset for %s\n", id->ident);
+-	return 1;
+-}
+-
+-/* The GPU hangs up on these systems if modeset is performed on LID open */
+-static const struct dmi_system_id intel_no_modeset_on_lid[] = {
+-	{
+-		.callback = intel_no_modeset_on_lid_dmi_callback,
+-		.ident = "Toshiba Tecra A11",
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+-			DMI_MATCH(DMI_PRODUCT_NAME, "TECRA A11"),
+-		},
+-	},
+-
+-	{ }	/* terminating entry */
+-};
+-
+-/*
+- * Lid events. Note the use of 'modeset':
+- *  - we set it to MODESET_ON_LID_OPEN on lid close,
+- *    and set it to MODESET_DONE on open
+- *  - we use it as a "only once" bit (ie we ignore
+- *    duplicate events where it was already properly set)
+- *  - the suspend/resume paths will set it to
+- *    MODESET_SUSPENDED and ignore the lid open event,
+- *    because they restore the mode ("lid open").
+- */
+-static int intel_lid_notify(struct notifier_block *nb, unsigned long val,
+-			    void *unused)
+-{
+-	struct intel_lvds_connector *lvds_connector =
+-		container_of(nb, struct intel_lvds_connector, lid_notifier);
+-	struct drm_connector *connector = &lvds_connector->base.base;
+-	struct drm_device *dev = connector->dev;
+-	struct drm_i915_private *dev_priv = to_i915(dev);
+-
+-	if (dev->switch_power_state != DRM_SWITCH_POWER_ON)
+-		return NOTIFY_OK;
+-
+-	mutex_lock(&dev_priv->modeset_restore_lock);
+-	if (dev_priv->modeset_restore == MODESET_SUSPENDED)
+-		goto exit;
+-	/*
+-	 * check and update the status of LVDS connector after receiving
+-	 * the LID nofication event.
+-	 */
+-	connector->status = connector->funcs->detect(connector, false);
+-
+-	/* Don't force modeset on machines where it causes a GPU lockup */
+-	if (dmi_check_system(intel_no_modeset_on_lid))
+-		goto exit;
+-	if (!acpi_lid_open()) {
+-		/* do modeset on next lid open event */
+-		dev_priv->modeset_restore = MODESET_ON_LID_OPEN;
+-		goto exit;
+-	}
+-
+-	if (dev_priv->modeset_restore == MODESET_DONE)
+-		goto exit;
+-
+-	/*
+-	 * Some old platform's BIOS love to wreak havoc while the lid is closed.
+-	 * We try to detect this here and undo any damage. The split for PCH
+-	 * platforms is rather conservative and a bit arbitrary expect that on
+-	 * those platforms VGA disabling requires actual legacy VGA I/O access,
+-	 * and as part of the cleanup in the hw state restore we also redisable
+-	 * the vga plane.
+-	 */
+-	if (!HAS_PCH_SPLIT(dev_priv))
+-		intel_display_resume(dev);
+-
+-	dev_priv->modeset_restore = MODESET_DONE;
+-
+-exit:
+-	mutex_unlock(&dev_priv->modeset_restore_lock);
+-	return NOTIFY_OK;
+-}
+-
+-static int
+-intel_lvds_connector_register(struct drm_connector *connector)
+-{
+-	struct intel_lvds_connector *lvds = to_lvds_connector(connector);
+-	int ret;
+-
+-	ret = intel_connector_register(connector);
+-	if (ret)
+-		return ret;
+-
+-	lvds->lid_notifier.notifier_call = intel_lid_notify;
+-	if (acpi_lid_notifier_register(&lvds->lid_notifier)) {
+-		DRM_DEBUG_KMS("lid notifier registration failed\n");
+-		lvds->lid_notifier.notifier_call = NULL;
+-	}
+-
+-	return 0;
+-}
+-
+-static void
+-intel_lvds_connector_unregister(struct drm_connector *connector)
+-{
+-	struct intel_lvds_connector *lvds = to_lvds_connector(connector);
+-
+-	if (lvds->lid_notifier.notifier_call)
+-		acpi_lid_notifier_unregister(&lvds->lid_notifier);
+-
+-	intel_connector_unregister(connector);
+-}
+-
+ /**
+  * intel_lvds_destroy - unregister and free LVDS structures
+  * @connector: connector to free
+@@ -641,8 +511,8 @@ static const struct drm_connector_funcs intel_lvds_connector_funcs = {
+ 	.fill_modes = drm_helper_probe_single_connector_modes,
+ 	.atomic_get_property = intel_digital_connector_atomic_get_property,
+ 	.atomic_set_property = intel_digital_connector_atomic_set_property,
+-	.late_register = intel_lvds_connector_register,
+-	.early_unregister = intel_lvds_connector_unregister,
++	.late_register = intel_connector_register,
++	.early_unregister = intel_connector_unregister,
+ 	.destroy = intel_lvds_destroy,
+ 	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+ 	.atomic_duplicate_state = intel_digital_connector_duplicate_state,
+@@ -1108,8 +978,6 @@ void intel_lvds_init(struct drm_i915_private *dev_priv)
+ 	 * 2) check for VBT data
+ 	 * 3) check to see if LVDS is already on
+ 	 *    if none of the above, no panel
+-	 * 4) make sure lid is open
+-	 *    if closed, act like it's not there for now
+ 	 */
+ 
+ 	/*
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index 2121345a61af..78ce3d232c4d 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -486,6 +486,31 @@ static void vop_line_flag_irq_disable(struct vop *vop)
+ 	spin_unlock_irqrestore(&vop->irq_lock, flags);
+ }
+ 
++static int vop_core_clks_enable(struct vop *vop)
++{
++	int ret;
++
++	ret = clk_enable(vop->hclk);
++	if (ret < 0)
++		return ret;
++
++	ret = clk_enable(vop->aclk);
++	if (ret < 0)
++		goto err_disable_hclk;
++
++	return 0;
++
++err_disable_hclk:
++	clk_disable(vop->hclk);
++	return ret;
++}
++
++static void vop_core_clks_disable(struct vop *vop)
++{
++	clk_disable(vop->aclk);
++	clk_disable(vop->hclk);
++}
++
+ static int vop_enable(struct drm_crtc *crtc)
+ {
+ 	struct vop *vop = to_vop(crtc);
+@@ -497,17 +522,13 @@ static int vop_enable(struct drm_crtc *crtc)
+ 		return ret;
+ 	}
+ 
+-	ret = clk_enable(vop->hclk);
++	ret = vop_core_clks_enable(vop);
+ 	if (WARN_ON(ret < 0))
+ 		goto err_put_pm_runtime;
+ 
+ 	ret = clk_enable(vop->dclk);
+ 	if (WARN_ON(ret < 0))
+-		goto err_disable_hclk;
+-
+-	ret = clk_enable(vop->aclk);
+-	if (WARN_ON(ret < 0))
+-		goto err_disable_dclk;
++		goto err_disable_core;
+ 
+ 	/*
+ 	 * Slave iommu shares power, irq and clock with vop.  It was associated
+@@ -519,7 +540,7 @@ static int vop_enable(struct drm_crtc *crtc)
+ 	if (ret) {
+ 		DRM_DEV_ERROR(vop->dev,
+ 			      "failed to attach dma mapping, %d\n", ret);
+-		goto err_disable_aclk;
++		goto err_disable_dclk;
+ 	}
+ 
+ 	spin_lock(&vop->reg_lock);
+@@ -552,18 +573,14 @@ static int vop_enable(struct drm_crtc *crtc)
+ 
+ 	spin_unlock(&vop->reg_lock);
+ 
+-	enable_irq(vop->irq);
+-
+ 	drm_crtc_vblank_on(crtc);
+ 
+ 	return 0;
+ 
+-err_disable_aclk:
+-	clk_disable(vop->aclk);
+ err_disable_dclk:
+ 	clk_disable(vop->dclk);
+-err_disable_hclk:
+-	clk_disable(vop->hclk);
++err_disable_core:
++	vop_core_clks_disable(vop);
+ err_put_pm_runtime:
+ 	pm_runtime_put_sync(vop->dev);
+ 	return ret;
+@@ -599,8 +616,6 @@ static void vop_crtc_atomic_disable(struct drm_crtc *crtc,
+ 
+ 	vop_dsp_hold_valid_irq_disable(vop);
+ 
+-	disable_irq(vop->irq);
+-
+ 	vop->is_enabled = false;
+ 
+ 	/*
+@@ -609,8 +624,7 @@ static void vop_crtc_atomic_disable(struct drm_crtc *crtc,
+ 	rockchip_drm_dma_detach_device(vop->drm_dev, vop->dev);
+ 
+ 	clk_disable(vop->dclk);
+-	clk_disable(vop->aclk);
+-	clk_disable(vop->hclk);
++	vop_core_clks_disable(vop);
+ 	pm_runtime_put(vop->dev);
+ 	mutex_unlock(&vop->vop_lock);
+ 
+@@ -1177,6 +1191,18 @@ static irqreturn_t vop_isr(int irq, void *data)
+ 	uint32_t active_irqs;
+ 	int ret = IRQ_NONE;
+ 
++	/*
++	 * The irq is shared with the iommu. If the runtime-pm state of the
++	 * vop-device is disabled the irq has to be targeted at the iommu.
++	 */
++	if (!pm_runtime_get_if_in_use(vop->dev))
++		return IRQ_NONE;
++
++	if (vop_core_clks_enable(vop)) {
++		DRM_DEV_ERROR_RATELIMITED(vop->dev, "couldn't enable clocks\n");
++		goto out;
++	}
++
+ 	/*
+ 	 * interrupt register has interrupt status, enable and clear bits, we
+ 	 * must hold irq_lock to avoid a race with enable/disable_vblank().
+@@ -1192,7 +1218,7 @@ static irqreturn_t vop_isr(int irq, void *data)
+ 
+ 	/* This is expected for vop iommu irqs, since the irq is shared */
+ 	if (!active_irqs)
+-		return IRQ_NONE;
++		goto out_disable;
+ 
+ 	if (active_irqs & DSP_HOLD_VALID_INTR) {
+ 		complete(&vop->dsp_hold_completion);
+@@ -1218,6 +1244,10 @@ static irqreturn_t vop_isr(int irq, void *data)
+ 		DRM_DEV_ERROR(vop->dev, "Unknown VOP IRQs: %#02x\n",
+ 			      active_irqs);
+ 
++out_disable:
++	vop_core_clks_disable(vop);
++out:
++	pm_runtime_put(vop->dev);
+ 	return ret;
+ }
+ 
+@@ -1596,9 +1626,6 @@ static int vop_bind(struct device *dev, struct device *master, void *data)
+ 	if (ret)
+ 		goto err_disable_pm_runtime;
+ 
+-	/* IRQ is initially disabled; it gets enabled in power_on */
+-	disable_irq(vop->irq);
+-
+ 	return 0;
+ 
+ err_disable_pm_runtime:
+diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+index e67f4ea28c0e..051b8be3dc0f 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_lvds.c
++++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+@@ -363,8 +363,10 @@ static int rockchip_lvds_bind(struct device *dev, struct device *master,
+ 		of_property_read_u32(endpoint, "reg", &endpoint_id);
+ 		ret = drm_of_find_panel_or_bridge(dev->of_node, 1, endpoint_id,
+ 						  &lvds->panel, &lvds->bridge);
+-		if (!ret)
++		if (!ret) {
++			of_node_put(endpoint);
+ 			break;
++		}
+ 	}
+ 	if (!child_count) {
+ 		DRM_DEV_ERROR(dev, "lvds port does not have any children\n");
+diff --git a/drivers/hid/hid-redragon.c b/drivers/hid/hid-redragon.c
+index daf59578bf93..73c9d4c4fa34 100644
+--- a/drivers/hid/hid-redragon.c
++++ b/drivers/hid/hid-redragon.c
+@@ -44,29 +44,6 @@ static __u8 *redragon_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 	return rdesc;
+ }
+ 
+-static int redragon_probe(struct hid_device *dev,
+-	const struct hid_device_id *id)
+-{
+-	int ret;
+-
+-	ret = hid_parse(dev);
+-	if (ret) {
+-		hid_err(dev, "parse failed\n");
+-		return ret;
+-	}
+-
+-	/* do not register unused input device */
+-	if (dev->maxapplication == 1)
+-		return 0;
+-
+-	ret = hid_hw_start(dev, HID_CONNECT_DEFAULT);
+-	if (ret) {
+-		hid_err(dev, "hw start failed\n");
+-		return ret;
+-	}
+-
+-	return 0;
+-}
+ static const struct hid_device_id redragon_devices[] = {
+ 	{HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_REDRAGON_ASURA)},
+ 	{}
+@@ -77,8 +54,7 @@ MODULE_DEVICE_TABLE(hid, redragon_devices);
+ static struct hid_driver redragon_driver = {
+ 	.name = "redragon",
+ 	.id_table = redragon_devices,
+-	.report_fixup = redragon_report_fixup,
+-	.probe = redragon_probe
++	.report_fixup = redragon_report_fixup
+ };
+ 
+ module_hid_driver(redragon_driver);
+diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
+index b8f303dea305..32affd3fa8bd 100644
+--- a/drivers/i2c/i2c-core-acpi.c
++++ b/drivers/i2c/i2c-core-acpi.c
+@@ -453,8 +453,12 @@ static int acpi_gsb_i2c_read_bytes(struct i2c_client *client,
+ 		else
+ 			dev_err(&client->adapter->dev, "i2c read %d bytes from client@%#x starting at reg %#x failed, error: %d\n",
+ 				data_len, client->addr, cmd, ret);
+-	} else {
++	/* 2 transfers must have completed successfully */
++	} else if (ret == 2) {
+ 		memcpy(data, buffer, data_len);
++		ret = 0;
++	} else {
++		ret = -EIO;
+ 	}
+ 
+ 	kfree(buffer);
+@@ -595,8 +599,6 @@ i2c_acpi_space_handler(u32 function, acpi_physical_address command,
+ 		if (action == ACPI_READ) {
+ 			status = acpi_gsb_i2c_read_bytes(client, command,
+ 					gsb->data, info->access_length);
+-			if (status > 0)
+-				status = 0;
+ 		} else {
+ 			status = acpi_gsb_i2c_write_bytes(client, command,
+ 					gsb->data, info->access_length);
+diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
+index fbe7198a715a..bedd5fba33b0 100644
+--- a/drivers/infiniband/hw/hfi1/affinity.c
++++ b/drivers/infiniband/hw/hfi1/affinity.c
+@@ -198,7 +198,7 @@ int node_affinity_init(void)
+ 		while ((dev = pci_get_device(ids->vendor, ids->device, dev))) {
+ 			node = pcibus_to_node(dev->bus);
+ 			if (node < 0)
+-				node = numa_node_id();
++				goto out;
+ 
+ 			hfi1_per_node_cntr[node]++;
+ 		}
+@@ -206,6 +206,18 @@ int node_affinity_init(void)
+ 	}
+ 
+ 	return 0;
++
++out:
++	/*
++	 * Invalid PCI NUMA node information found, note it, and populate
++	 * our database 1:1.
++	 */
++	pr_err("HFI: Invalid PCI NUMA node. Performance may be affected\n");
++	pr_err("HFI: System BIOS may need to be upgraded\n");
++	for (node = 0; node < node_affinity.num_possible_nodes; node++)
++		hfi1_per_node_cntr[node] = 1;
++
++	return 0;
+ }
+ 
+ static void node_affinity_destroy(struct hfi1_affinity_node *entry)
+@@ -622,8 +634,14 @@ int hfi1_dev_affinity_init(struct hfi1_devdata *dd)
+ 	int curr_cpu, possible, i, ret;
+ 	bool new_entry = false;
+ 
+-	if (node < 0)
+-		node = numa_node_id();
++	/*
++	 * If the BIOS does not have the NUMA node information set, select
++	 * NUMA 0 so we get consistent performance.
++	 */
++	if (node < 0) {
++		dd_dev_err(dd, "Invalid PCI NUMA node. Performance may be affected\n");
++		node = 0;
++	}
+ 	dd->node = node;
+ 
+ 	local_mask = cpumask_of_node(dd->node);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c
+index b9f2c871ff9a..e11c149da04d 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_pd.c
++++ b/drivers/infiniband/hw/hns/hns_roce_pd.c
+@@ -37,7 +37,7 @@
+ 
+ static int hns_roce_pd_alloc(struct hns_roce_dev *hr_dev, unsigned long *pdn)
+ {
+-	return hns_roce_bitmap_alloc(&hr_dev->pd_bitmap, pdn);
++	return hns_roce_bitmap_alloc(&hr_dev->pd_bitmap, pdn) ? -ENOMEM : 0;
+ }
+ 
+ static void hns_roce_pd_free(struct hns_roce_dev *hr_dev, unsigned long pdn)
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index baaf906f7c2e..97664570c5ac 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -115,7 +115,10 @@ static int hns_roce_reserve_range_qp(struct hns_roce_dev *hr_dev, int cnt,
+ {
+ 	struct hns_roce_qp_table *qp_table = &hr_dev->qp_table;
+ 
+-	return hns_roce_bitmap_alloc_range(&qp_table->bitmap, cnt, align, base);
++	return hns_roce_bitmap_alloc_range(&qp_table->bitmap, cnt, align,
++					   base) ?
++		       -ENOMEM :
++		       0;
+ }
+ 
+ enum hns_roce_qp_state to_hns_roce_state(enum ib_qp_state state)
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index 6365c1958264..3304aaaffe87 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -480,11 +480,19 @@ EXPORT_SYMBOL(input_inject_event);
+  */
+ void input_alloc_absinfo(struct input_dev *dev)
+ {
+-	if (!dev->absinfo)
+-		dev->absinfo = kcalloc(ABS_CNT, sizeof(*dev->absinfo),
+-					GFP_KERNEL);
++	if (dev->absinfo)
++		return;
+ 
+-	WARN(!dev->absinfo, "%s(): kcalloc() failed?\n", __func__);
++	dev->absinfo = kcalloc(ABS_CNT, sizeof(*dev->absinfo), GFP_KERNEL);
++	if (!dev->absinfo) {
++		dev_err(dev->dev.parent ?: &dev->dev,
++			"%s: unable to allocate memory\n", __func__);
++		/*
++		 * We will handle this allocation failure in
++		 * input_register_device() when we refuse to register input
++		 * device with ABS bits but without absinfo.
++		 */
++	}
+ }
+ EXPORT_SYMBOL(input_alloc_absinfo);
+ 
+diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
+index af4a8e7fcd27..3b05117118c3 100644
+--- a/drivers/iommu/omap-iommu.c
++++ b/drivers/iommu/omap-iommu.c
+@@ -550,7 +550,7 @@ static u32 *iopte_alloc(struct omap_iommu *obj, u32 *iopgd,
+ 
+ pte_ready:
+ 	iopte = iopte_offset(iopgd, da);
+-	*pt_dma = virt_to_phys(iopte);
++	*pt_dma = iopgd_page_paddr(iopgd);
+ 	dev_vdbg(obj->dev,
+ 		 "%s: da:%08x pgd:%p *pgd:%08x pte:%p *pte:%08x\n",
+ 		 __func__, da, iopgd, *iopgd, iopte, *iopte);
+@@ -738,7 +738,7 @@ static size_t iopgtable_clear_entry_core(struct omap_iommu *obj, u32 da)
+ 		}
+ 		bytes *= nent;
+ 		memset(iopte, 0, nent * sizeof(*iopte));
+-		pt_dma = virt_to_phys(iopte);
++		pt_dma = iopgd_page_paddr(iopgd);
+ 		flush_iopte_range(obj->dev, pt_dma, pt_offset, nent);
+ 
+ 		/*
+diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
+index 054cd2c8e9c8..2b1724e8d307 100644
+--- a/drivers/iommu/rockchip-iommu.c
++++ b/drivers/iommu/rockchip-iommu.c
+@@ -521,10 +521,11 @@ static irqreturn_t rk_iommu_irq(int irq, void *dev_id)
+ 	u32 int_status;
+ 	dma_addr_t iova;
+ 	irqreturn_t ret = IRQ_NONE;
+-	int i;
++	int i, err;
+ 
+-	if (WARN_ON(!pm_runtime_get_if_in_use(iommu->dev)))
+-		return 0;
++	err = pm_runtime_get_if_in_use(iommu->dev);
++	if (WARN_ON_ONCE(err <= 0))
++		return ret;
+ 
+ 	if (WARN_ON(clk_bulk_enable(iommu->num_clocks, iommu->clocks)))
+ 		goto out;
+@@ -620,11 +621,15 @@ static void rk_iommu_zap_iova(struct rk_iommu_domain *rk_domain,
+ 	spin_lock_irqsave(&rk_domain->iommus_lock, flags);
+ 	list_for_each(pos, &rk_domain->iommus) {
+ 		struct rk_iommu *iommu;
++		int ret;
+ 
+ 		iommu = list_entry(pos, struct rk_iommu, node);
+ 
+ 		/* Only zap TLBs of IOMMUs that are powered on. */
+-		if (pm_runtime_get_if_in_use(iommu->dev)) {
++		ret = pm_runtime_get_if_in_use(iommu->dev);
++		if (WARN_ON_ONCE(ret < 0))
++			continue;
++		if (ret) {
+ 			WARN_ON(clk_bulk_enable(iommu->num_clocks,
+ 						iommu->clocks));
+ 			rk_iommu_zap_lines(iommu, iova, size);
+@@ -891,6 +896,7 @@ static void rk_iommu_detach_device(struct iommu_domain *domain,
+ 	struct rk_iommu *iommu;
+ 	struct rk_iommu_domain *rk_domain = to_rk_domain(domain);
+ 	unsigned long flags;
++	int ret;
+ 
+ 	/* Allow 'virtual devices' (eg drm) to detach from domain */
+ 	iommu = rk_iommu_from_dev(dev);
+@@ -909,7 +915,9 @@ static void rk_iommu_detach_device(struct iommu_domain *domain,
+ 	list_del_init(&iommu->node);
+ 	spin_unlock_irqrestore(&rk_domain->iommus_lock, flags);
+ 
+-	if (pm_runtime_get_if_in_use(iommu->dev)) {
++	ret = pm_runtime_get_if_in_use(iommu->dev);
++	WARN_ON_ONCE(ret < 0);
++	if (ret > 0) {
+ 		rk_iommu_disable(iommu);
+ 		pm_runtime_put(iommu->dev);
+ 	}
+@@ -946,7 +954,8 @@ static int rk_iommu_attach_device(struct iommu_domain *domain,
+ 	list_add_tail(&iommu->node, &rk_domain->iommus);
+ 	spin_unlock_irqrestore(&rk_domain->iommus_lock, flags);
+ 
+-	if (!pm_runtime_get_if_in_use(iommu->dev))
++	ret = pm_runtime_get_if_in_use(iommu->dev);
++	if (!ret || WARN_ON_ONCE(ret < 0))
+ 		return 0;
+ 
+ 	ret = rk_iommu_enable(iommu);
+@@ -1152,17 +1161,6 @@ static int rk_iommu_probe(struct platform_device *pdev)
+ 	if (iommu->num_mmu == 0)
+ 		return PTR_ERR(iommu->bases[0]);
+ 
+-	i = 0;
+-	while ((irq = platform_get_irq(pdev, i++)) != -ENXIO) {
+-		if (irq < 0)
+-			return irq;
+-
+-		err = devm_request_irq(iommu->dev, irq, rk_iommu_irq,
+-				       IRQF_SHARED, dev_name(dev), iommu);
+-		if (err)
+-			return err;
+-	}
+-
+ 	iommu->reset_disabled = device_property_read_bool(dev,
+ 					"rockchip,disable-mmu-reset");
+ 
+@@ -1219,6 +1217,19 @@ static int rk_iommu_probe(struct platform_device *pdev)
+ 
+ 	pm_runtime_enable(dev);
+ 
++	i = 0;
++	while ((irq = platform_get_irq(pdev, i++)) != -ENXIO) {
++		if (irq < 0)
++			return irq;
++
++		err = devm_request_irq(iommu->dev, irq, rk_iommu_irq,
++				       IRQF_SHARED, dev_name(dev), iommu);
++		if (err) {
++			pm_runtime_disable(dev);
++			goto err_remove_sysfs;
++		}
++	}
++
+ 	return 0;
+ err_remove_sysfs:
+ 	iommu_device_sysfs_remove(&iommu->iommu);
+diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
+index faf734ff4cf3..0f6e30e9009d 100644
+--- a/drivers/irqchip/irq-bcm7038-l1.c
++++ b/drivers/irqchip/irq-bcm7038-l1.c
+@@ -217,6 +217,7 @@ static int bcm7038_l1_set_affinity(struct irq_data *d,
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_SMP
+ static void bcm7038_l1_cpu_offline(struct irq_data *d)
+ {
+ 	struct cpumask *mask = irq_data_get_affinity_mask(d);
+@@ -241,6 +242,7 @@ static void bcm7038_l1_cpu_offline(struct irq_data *d)
+ 	}
+ 	irq_set_affinity_locked(d, &new_affinity, false);
+ }
++#endif
+ 
+ static int __init bcm7038_l1_init_one(struct device_node *dn,
+ 				      unsigned int idx,
+@@ -293,7 +295,9 @@ static struct irq_chip bcm7038_l1_irq_chip = {
+ 	.irq_mask		= bcm7038_l1_mask,
+ 	.irq_unmask		= bcm7038_l1_unmask,
+ 	.irq_set_affinity	= bcm7038_l1_set_affinity,
++#ifdef CONFIG_SMP
+ 	.irq_cpu_offline	= bcm7038_l1_cpu_offline,
++#endif
+ };
+ 
+ static int bcm7038_l1_map(struct irq_domain *d, unsigned int virq,
+diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
+index 3a7e8905a97e..880e48947576 100644
+--- a/drivers/irqchip/irq-stm32-exti.c
++++ b/drivers/irqchip/irq-stm32-exti.c
+@@ -602,17 +602,24 @@ stm32_exti_host_data *stm32_exti_host_init(const struct stm32_exti_drv_data *dd,
+ 					sizeof(struct stm32_exti_chip_data),
+ 					GFP_KERNEL);
+ 	if (!host_data->chips_data)
+-		return NULL;
++		goto free_host_data;
+ 
+ 	host_data->base = of_iomap(node, 0);
+ 	if (!host_data->base) {
+ 		pr_err("%pOF: Unable to map registers\n", node);
+-		return NULL;
++		goto free_chips_data;
+ 	}
+ 
+ 	stm32_host_data = host_data;
+ 
+ 	return host_data;
++
++free_chips_data:
++	kfree(host_data->chips_data);
++free_host_data:
++	kfree(host_data);
++
++	return NULL;
+ }
+ 
+ static struct
+@@ -664,10 +671,8 @@ static int __init stm32_exti_init(const struct stm32_exti_drv_data *drv_data,
+ 	struct irq_domain *domain;
+ 
+ 	host_data = stm32_exti_host_init(drv_data, node);
+-	if (!host_data) {
+-		ret = -ENOMEM;
+-		goto out_free_mem;
+-	}
++	if (!host_data)
++		return -ENOMEM;
+ 
+ 	domain = irq_domain_add_linear(node, drv_data->bank_nr * IRQS_PER_BANK,
+ 				       &irq_exti_domain_ops, NULL);
+@@ -724,7 +729,6 @@ out_free_domain:
+ 	irq_domain_remove(domain);
+ out_unmap:
+ 	iounmap(host_data->base);
+-out_free_mem:
+ 	kfree(host_data->chips_data);
+ 	kfree(host_data);
+ 	return ret;
+@@ -751,10 +755,8 @@ __init stm32_exti_hierarchy_init(const struct stm32_exti_drv_data *drv_data,
+ 	}
+ 
+ 	host_data = stm32_exti_host_init(drv_data, node);
+-	if (!host_data) {
+-		ret = -ENOMEM;
+-		goto out_free_mem;
+-	}
++	if (!host_data)
++		return -ENOMEM;
+ 
+ 	for (i = 0; i < drv_data->bank_nr; i++)
+ 		stm32_exti_chip_init(host_data, i, node);
+@@ -776,7 +778,6 @@ __init stm32_exti_hierarchy_init(const struct stm32_exti_drv_data *drv_data,
+ 
+ out_unmap:
+ 	iounmap(host_data->base);
+-out_free_mem:
+ 	kfree(host_data->chips_data);
+ 	kfree(host_data);
+ 	return ret;
+diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
+index 3c7547a3c371..d7b9cdafd1c3 100644
+--- a/drivers/md/dm-kcopyd.c
++++ b/drivers/md/dm-kcopyd.c
+@@ -487,6 +487,8 @@ static int run_complete_job(struct kcopyd_job *job)
+ 	if (atomic_dec_and_test(&kc->nr_jobs))
+ 		wake_up(&kc->destroyq);
+ 
++	cond_resched();
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
+index 2a87b0d2f21f..a530972c5a7e 100644
+--- a/drivers/mfd/sm501.c
++++ b/drivers/mfd/sm501.c
+@@ -715,6 +715,7 @@ sm501_create_subdev(struct sm501_devdata *sm, char *name,
+ 	smdev->pdev.name = name;
+ 	smdev->pdev.id = sm->pdev_id;
+ 	smdev->pdev.dev.parent = sm->dev;
++	smdev->pdev.dev.coherent_dma_mask = 0xffffffff;
+ 
+ 	if (res_count) {
+ 		smdev->pdev.resource = (struct resource *)(smdev+1);
+diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
+index 94d7a865b135..7504f430c011 100644
+--- a/drivers/mtd/ubi/vtbl.c
++++ b/drivers/mtd/ubi/vtbl.c
+@@ -578,6 +578,16 @@ static int init_volumes(struct ubi_device *ubi,
+ 		vol->ubi = ubi;
+ 		reserved_pebs += vol->reserved_pebs;
+ 
++		/*
++		 * We use ubi->peb_count and not vol->reserved_pebs because
++		 * we want to keep the code simple. Otherwise we'd have to
++		 * resize/check the bitmap upon volume resize too.
++		 * Allocating a few bytes more does not hurt.
++		 */
++		err = ubi_fastmap_init_checkmap(vol, ubi->peb_count);
++		if (err)
++			return err;
++
+ 		/*
+ 		 * In case of dynamic volume UBI knows nothing about how many
+ 		 * data is stored there. So assume the whole volume is used.
+@@ -620,16 +630,6 @@ static int init_volumes(struct ubi_device *ubi,
+ 			(long long)(vol->used_ebs - 1) * vol->usable_leb_size;
+ 		vol->used_bytes += av->last_data_size;
+ 		vol->last_eb_bytes = av->last_data_size;
+-
+-		/*
+-		 * We use ubi->peb_count and not vol->reserved_pebs because
+-		 * we want to keep the code simple. Otherwise we'd have to
+-		 * resize/check the bitmap upon volume resize too.
+-		 * Allocating a few bytes more does not hurt.
+-		 */
+-		err = ubi_fastmap_init_checkmap(vol, ubi->peb_count);
+-		if (err)
+-			return err;
+ 	}
+ 
+ 	/* And add the layout volume */
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 4394c1162be4..4fdf3d33aa59 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -5907,12 +5907,12 @@ unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp)
+ 	return bp->hw_resc.max_cp_rings;
+ }
+ 
+-void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max)
++unsigned int bnxt_get_max_func_cp_rings_for_en(struct bnxt *bp)
+ {
+-	bp->hw_resc.max_cp_rings = max;
++	return bp->hw_resc.max_cp_rings - bnxt_get_ulp_msix_num(bp);
+ }
+ 
+-unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
++static unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
+ {
+ 	struct bnxt_hw_resc *hw_resc = &bp->hw_resc;
+ 
+@@ -8492,7 +8492,8 @@ static void _bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx,
+ 
+ 	*max_tx = hw_resc->max_tx_rings;
+ 	*max_rx = hw_resc->max_rx_rings;
+-	*max_cp = min_t(int, hw_resc->max_irqs, hw_resc->max_cp_rings);
++	*max_cp = min_t(int, bnxt_get_max_func_cp_rings_for_en(bp),
++			hw_resc->max_irqs);
+ 	*max_cp = min_t(int, *max_cp, hw_resc->max_stat_ctxs);
+ 	max_ring_grps = hw_resc->max_hw_ring_grps;
+ 	if (BNXT_CHIP_TYPE_NITRO_A0(bp) && BNXT_PF(bp)) {
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 91575ef97c8c..ea1246a94b38 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1468,8 +1468,7 @@ int bnxt_hwrm_set_coal(struct bnxt *);
+ unsigned int bnxt_get_max_func_stat_ctxs(struct bnxt *bp);
+ void bnxt_set_max_func_stat_ctxs(struct bnxt *bp, unsigned int max);
+ unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp);
+-void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max);
+-unsigned int bnxt_get_max_func_irqs(struct bnxt *bp);
++unsigned int bnxt_get_max_func_cp_rings_for_en(struct bnxt *bp);
+ int bnxt_get_avail_msix(struct bnxt *bp, int num);
+ int bnxt_reserve_rings(struct bnxt *bp);
+ void bnxt_tx_disable(struct bnxt *bp);
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+index a64910892c25..2c77004a022b 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+@@ -451,7 +451,7 @@ static int bnxt_hwrm_func_vf_resc_cfg(struct bnxt *bp, int num_vfs)
+ 
+ 	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_VF_RESOURCE_CFG, -1, -1);
+ 
+-	vf_cp_rings = hw_resc->max_cp_rings - bp->cp_nr_rings;
++	vf_cp_rings = bnxt_get_max_func_cp_rings_for_en(bp) - bp->cp_nr_rings;
+ 	vf_stat_ctx = hw_resc->max_stat_ctxs - bp->num_stat_ctxs;
+ 	if (bp->flags & BNXT_FLAG_AGG_RINGS)
+ 		vf_rx_rings = hw_resc->max_rx_rings - bp->rx_nr_rings * 2;
+@@ -544,7 +544,8 @@ static int bnxt_hwrm_func_cfg(struct bnxt *bp, int num_vfs)
+ 	max_stat_ctxs = hw_resc->max_stat_ctxs;
+ 
+ 	/* Remaining rings are distributed equally amongs VF's for now */
+-	vf_cp_rings = (hw_resc->max_cp_rings - bp->cp_nr_rings) / num_vfs;
++	vf_cp_rings = (bnxt_get_max_func_cp_rings_for_en(bp) -
++		       bp->cp_nr_rings) / num_vfs;
+ 	vf_stat_ctx = (max_stat_ctxs - bp->num_stat_ctxs) / num_vfs;
+ 	if (bp->flags & BNXT_FLAG_AGG_RINGS)
+ 		vf_rx_rings = (hw_resc->max_rx_rings - bp->rx_nr_rings * 2) /
+@@ -638,7 +639,7 @@ static int bnxt_sriov_enable(struct bnxt *bp, int *num_vfs)
+ 	 */
+ 	vfs_supported = *num_vfs;
+ 
+-	avail_cp = hw_resc->max_cp_rings - bp->cp_nr_rings;
++	avail_cp = bnxt_get_max_func_cp_rings_for_en(bp) - bp->cp_nr_rings;
+ 	avail_stat = hw_resc->max_stat_ctxs - bp->num_stat_ctxs;
+ 	avail_cp = min_t(int, avail_cp, avail_stat);
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+index 840f6e505f73..4209cfd73971 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id,
+ 		edev->ulp_tbl[ulp_id].msix_requested = avail_msix;
+ 	}
+ 	bnxt_fill_msix_vecs(bp, ent);
+-	bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix);
+ 	edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED;
+ 	return avail_msix;
+ }
+@@ -178,7 +177,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id)
+ {
+ 	struct net_device *dev = edev->net;
+ 	struct bnxt *bp = netdev_priv(dev);
+-	int max_cp_rings, msix_requested;
+ 
+ 	ASSERT_RTNL();
+ 	if (ulp_id != BNXT_ROCE_ULP)
+@@ -187,9 +185,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id)
+ 	if (!(edev->flags & BNXT_EN_FLAG_MSIX_REQUESTED))
+ 		return 0;
+ 
+-	max_cp_rings = bnxt_get_max_func_cp_rings(bp);
+-	msix_requested = edev->ulp_tbl[ulp_id].msix_requested;
+-	bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested);
+ 	edev->ulp_tbl[ulp_id].msix_requested = 0;
+ 	edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED;
+ 	if (netif_running(dev)) {
+@@ -220,21 +215,6 @@ int bnxt_get_ulp_msix_base(struct bnxt *bp)
+ 	return 0;
+ }
+ 
+-void bnxt_subtract_ulp_resources(struct bnxt *bp, int ulp_id)
+-{
+-	ASSERT_RTNL();
+-	if (bnxt_ulp_registered(bp->edev, ulp_id)) {
+-		struct bnxt_en_dev *edev = bp->edev;
+-		unsigned int msix_req, max;
+-
+-		msix_req = edev->ulp_tbl[ulp_id].msix_requested;
+-		max = bnxt_get_max_func_cp_rings(bp);
+-		bnxt_set_max_func_cp_rings(bp, max - msix_req);
+-		max = bnxt_get_max_func_stat_ctxs(bp);
+-		bnxt_set_max_func_stat_ctxs(bp, max - 1);
+-	}
+-}
+-
+ static int bnxt_send_msg(struct bnxt_en_dev *edev, int ulp_id,
+ 			 struct bnxt_fw_msg *fw_msg)
+ {
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
+index df48ac71729f..d9bea37cd211 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
+@@ -90,7 +90,6 @@ static inline bool bnxt_ulp_registered(struct bnxt_en_dev *edev, int ulp_id)
+ 
+ int bnxt_get_ulp_msix_num(struct bnxt *bp);
+ int bnxt_get_ulp_msix_base(struct bnxt *bp);
+-void bnxt_subtract_ulp_resources(struct bnxt *bp, int ulp_id);
+ void bnxt_ulp_stop(struct bnxt *bp);
+ void bnxt_ulp_start(struct bnxt *bp);
+ void bnxt_ulp_sriov_cfg(struct bnxt *bp, int num_vfs);
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+index b773bc07edf7..14b49612aa86 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+@@ -186,6 +186,9 @@ struct bcmgenet_mib_counters {
+ #define UMAC_MAC1			0x010
+ #define UMAC_MAX_FRAME_LEN		0x014
+ 
++#define UMAC_MODE			0x44
++#define  MODE_LINK_STATUS		(1 << 5)
++
+ #define UMAC_EEE_CTRL			0x064
+ #define  EN_LPI_RX_PAUSE		(1 << 0)
+ #define  EN_LPI_TX_PFC			(1 << 1)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index 5333274a283c..4241ae928d4a 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -115,8 +115,14 @@ void bcmgenet_mii_setup(struct net_device *dev)
+ static int bcmgenet_fixed_phy_link_update(struct net_device *dev,
+ 					  struct fixed_phy_status *status)
+ {
+-	if (dev && dev->phydev && status)
+-		status->link = dev->phydev->link;
++	struct bcmgenet_priv *priv;
++	u32 reg;
++
++	if (dev && dev->phydev && status) {
++		priv = netdev_priv(dev);
++		reg = bcmgenet_umac_readl(priv, UMAC_MODE);
++		status->link = !!(reg & MODE_LINK_STATUS);
++	}
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index a6c911bb5ce2..515d96e32143 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -481,11 +481,6 @@ static int macb_mii_probe(struct net_device *dev)
+ 
+ 	if (np) {
+ 		if (of_phy_is_fixed_link(np)) {
+-			if (of_phy_register_fixed_link(np) < 0) {
+-				dev_err(&bp->pdev->dev,
+-					"broken fixed-link specification\n");
+-				return -ENODEV;
+-			}
+ 			bp->phy_node = of_node_get(np);
+ 		} else {
+ 			bp->phy_node = of_parse_phandle(np, "phy-handle", 0);
+@@ -568,7 +563,7 @@ static int macb_mii_init(struct macb *bp)
+ {
+ 	struct macb_platform_data *pdata;
+ 	struct device_node *np;
+-	int err;
++	int err = -ENXIO;
+ 
+ 	/* Enable management port */
+ 	macb_writel(bp, NCR, MACB_BIT(MPE));
+@@ -591,12 +586,23 @@ static int macb_mii_init(struct macb *bp)
+ 	dev_set_drvdata(&bp->dev->dev, bp->mii_bus);
+ 
+ 	np = bp->pdev->dev.of_node;
+-	if (pdata)
+-		bp->mii_bus->phy_mask = pdata->phy_mask;
++	if (np && of_phy_is_fixed_link(np)) {
++		if (of_phy_register_fixed_link(np) < 0) {
++			dev_err(&bp->pdev->dev,
++				"broken fixed-link specification %pOF\n", np);
++			goto err_out_free_mdiobus;
++		}
++
++		err = mdiobus_register(bp->mii_bus);
++	} else {
++		if (pdata)
++			bp->mii_bus->phy_mask = pdata->phy_mask;
++
++		err = of_mdiobus_register(bp->mii_bus, np);
++	}
+ 
+-	err = of_mdiobus_register(bp->mii_bus, np);
+ 	if (err)
+-		goto err_out_free_mdiobus;
++		goto err_out_free_fixed_link;
+ 
+ 	err = macb_mii_probe(bp->dev);
+ 	if (err)
+@@ -606,6 +612,7 @@ static int macb_mii_init(struct macb *bp)
+ 
+ err_out_unregister_bus:
+ 	mdiobus_unregister(bp->mii_bus);
++err_out_free_fixed_link:
+ 	if (np && of_phy_is_fixed_link(np))
+ 		of_phy_deregister_fixed_link(np);
+ err_out_free_mdiobus:
+@@ -1957,14 +1964,17 @@ static void macb_reset_hw(struct macb *bp)
+ {
+ 	struct macb_queue *queue;
+ 	unsigned int q;
++	u32 ctrl = macb_readl(bp, NCR);
+ 
+ 	/* Disable RX and TX (XXX: Should we halt the transmission
+ 	 * more gracefully?)
+ 	 */
+-	macb_writel(bp, NCR, 0);
++	ctrl &= ~(MACB_BIT(RE) | MACB_BIT(TE));
+ 
+ 	/* Clear the stats registers (XXX: Update stats first?) */
+-	macb_writel(bp, NCR, MACB_BIT(CLRSTAT));
++	ctrl |= MACB_BIT(CLRSTAT);
++
++	macb_writel(bp, NCR, ctrl);
+ 
+ 	/* Clear all status flags */
+ 	macb_writel(bp, TSR, -1);
+@@ -2152,7 +2162,7 @@ static void macb_init_hw(struct macb *bp)
+ 	}
+ 
+ 	/* Enable TX and RX */
+-	macb_writel(bp, NCR, MACB_BIT(RE) | MACB_BIT(TE) | MACB_BIT(MPE));
++	macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(RE) | MACB_BIT(TE));
+ }
+ 
+ /* The hash address register is 64 bits long and takes up two
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index d318d35e598f..6fd7ea8074b0 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -3911,7 +3911,7 @@ static bool hclge_is_all_function_id_zero(struct hclge_desc *desc)
+ #define HCLGE_FUNC_NUMBER_PER_DESC 6
+ 	int i, j;
+ 
+-	for (i = 0; i < HCLGE_DESC_NUMBER; i++)
++	for (i = 1; i < HCLGE_DESC_NUMBER; i++)
+ 		for (j = 0; j < HCLGE_FUNC_NUMBER_PER_DESC; j++)
+ 			if (desc[i].data[j])
+ 				return false;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
+index 9f7932e423b5..6315e8ad8467 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
+@@ -208,6 +208,8 @@ int hclge_mac_start_phy(struct hclge_dev *hdev)
+ 	if (!phydev)
+ 		return 0;
+ 
++	phydev->supported &= ~SUPPORTED_FIBRE;
++
+ 	ret = phy_connect_direct(netdev, phydev,
+ 				 hclge_mac_adjust_link,
+ 				 PHY_INTERFACE_MODE_SGMII);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+index 86478a6b99c5..c8c315eb5128 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+@@ -139,14 +139,15 @@ int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
+ 		      struct mlx5_wq_ctrl *wq_ctrl)
+ {
+ 	u32 sq_strides_offset;
++	u32 rq_pg_remainder;
+ 	int err;
+ 
+ 	mlx5_fill_fbc(MLX5_GET(qpc, qpc, log_rq_stride) + 4,
+ 		      MLX5_GET(qpc, qpc, log_rq_size),
+ 		      &wq->rq.fbc);
+ 
+-	sq_strides_offset =
+-		((wq->rq.fbc.frag_sz_m1 + 1) % PAGE_SIZE) / MLX5_SEND_WQE_BB;
++	rq_pg_remainder   = mlx5_wq_cyc_get_byte_size(&wq->rq) % PAGE_SIZE;
++	sq_strides_offset = rq_pg_remainder / MLX5_SEND_WQE_BB;
+ 
+ 	mlx5_fill_fbc_offset(ilog2(MLX5_SEND_WQE_BB),
+ 			     MLX5_GET(qpc, qpc, log_sq_size),
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+index 4a519d8edec8..3500c79e29cd 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+@@ -433,6 +433,8 @@ mlxsw_sp_netdevice_ipip_ul_event(struct mlxsw_sp *mlxsw_sp,
+ void
+ mlxsw_sp_port_vlan_router_leave(struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan);
+ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif);
++void mlxsw_sp_rif_destroy_by_dev(struct mlxsw_sp *mlxsw_sp,
++				 struct net_device *dev);
+ 
+ /* spectrum_kvdl.c */
+ int mlxsw_sp_kvdl_init(struct mlxsw_sp *mlxsw_sp);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+index 77b2adb29341..cb43d17097fa 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -6228,6 +6228,17 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
+ 	mlxsw_sp_vr_put(mlxsw_sp, vr);
+ }
+ 
++void mlxsw_sp_rif_destroy_by_dev(struct mlxsw_sp *mlxsw_sp,
++				 struct net_device *dev)
++{
++	struct mlxsw_sp_rif *rif;
++
++	rif = mlxsw_sp_rif_find_by_dev(mlxsw_sp, dev);
++	if (!rif)
++		return;
++	mlxsw_sp_rif_destroy(rif);
++}
++
+ static void
+ mlxsw_sp_rif_subport_params_init(struct mlxsw_sp_rif_params *params,
+ 				 struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index eea5666a86b2..6cb43dda8232 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -160,6 +160,24 @@ bool mlxsw_sp_bridge_device_is_offloaded(const struct mlxsw_sp *mlxsw_sp,
+ 	return !!mlxsw_sp_bridge_device_find(mlxsw_sp->bridge, br_dev);
+ }
+ 
++static int mlxsw_sp_bridge_device_upper_rif_destroy(struct net_device *dev,
++						    void *data)
++{
++	struct mlxsw_sp *mlxsw_sp = data;
++
++	mlxsw_sp_rif_destroy_by_dev(mlxsw_sp, dev);
++	return 0;
++}
++
++static void mlxsw_sp_bridge_device_rifs_destroy(struct mlxsw_sp *mlxsw_sp,
++						struct net_device *dev)
++{
++	mlxsw_sp_rif_destroy_by_dev(mlxsw_sp, dev);
++	netdev_walk_all_upper_dev_rcu(dev,
++				      mlxsw_sp_bridge_device_upper_rif_destroy,
++				      mlxsw_sp);
++}
++
+ static struct mlxsw_sp_bridge_device *
+ mlxsw_sp_bridge_device_create(struct mlxsw_sp_bridge *bridge,
+ 			      struct net_device *br_dev)
+@@ -198,6 +216,8 @@ static void
+ mlxsw_sp_bridge_device_destroy(struct mlxsw_sp_bridge *bridge,
+ 			       struct mlxsw_sp_bridge_device *bridge_device)
+ {
++	mlxsw_sp_bridge_device_rifs_destroy(bridge->mlxsw_sp,
++					    bridge_device->dev);
+ 	list_del(&bridge_device->list);
+ 	if (bridge_device->vlan_enabled)
+ 		bridge->vlan_enabled_exists = false;
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+index d4c27f849f9b..c2a9e64bc57b 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -227,29 +227,16 @@ done:
+ 	spin_unlock_bh(&nn->reconfig_lock);
+ }
+ 
+-/**
+- * nfp_net_reconfig() - Reconfigure the firmware
+- * @nn:      NFP Net device to reconfigure
+- * @update:  The value for the update field in the BAR config
+- *
+- * Write the update word to the BAR and ping the reconfig queue.  The
+- * poll until the firmware has acknowledged the update by zeroing the
+- * update word.
+- *
+- * Return: Negative errno on error, 0 on success
+- */
+-int nfp_net_reconfig(struct nfp_net *nn, u32 update)
++static void nfp_net_reconfig_sync_enter(struct nfp_net *nn)
+ {
+ 	bool cancelled_timer = false;
+ 	u32 pre_posted_requests;
+-	int ret;
+ 
+ 	spin_lock_bh(&nn->reconfig_lock);
+ 
+ 	nn->reconfig_sync_present = true;
+ 
+ 	if (nn->reconfig_timer_active) {
+-		del_timer(&nn->reconfig_timer);
+ 		nn->reconfig_timer_active = false;
+ 		cancelled_timer = true;
+ 	}
+@@ -258,14 +245,43 @@ int nfp_net_reconfig(struct nfp_net *nn, u32 update)
+ 
+ 	spin_unlock_bh(&nn->reconfig_lock);
+ 
+-	if (cancelled_timer)
++	if (cancelled_timer) {
++		del_timer_sync(&nn->reconfig_timer);
+ 		nfp_net_reconfig_wait(nn, nn->reconfig_timer.expires);
++	}
+ 
+ 	/* Run the posted reconfigs which were issued before we started */
+ 	if (pre_posted_requests) {
+ 		nfp_net_reconfig_start(nn, pre_posted_requests);
+ 		nfp_net_reconfig_wait(nn, jiffies + HZ * NFP_NET_POLL_TIMEOUT);
+ 	}
++}
++
++static void nfp_net_reconfig_wait_posted(struct nfp_net *nn)
++{
++	nfp_net_reconfig_sync_enter(nn);
++
++	spin_lock_bh(&nn->reconfig_lock);
++	nn->reconfig_sync_present = false;
++	spin_unlock_bh(&nn->reconfig_lock);
++}
++
++/**
++ * nfp_net_reconfig() - Reconfigure the firmware
++ * @nn:      NFP Net device to reconfigure
++ * @update:  The value for the update field in the BAR config
++ *
++ * Write the update word to the BAR and ping the reconfig queue.  The
++ * poll until the firmware has acknowledged the update by zeroing the
++ * update word.
++ *
++ * Return: Negative errno on error, 0 on success
++ */
++int nfp_net_reconfig(struct nfp_net *nn, u32 update)
++{
++	int ret;
++
++	nfp_net_reconfig_sync_enter(nn);
+ 
+ 	nfp_net_reconfig_start(nn, update);
+ 	ret = nfp_net_reconfig_wait(nn, jiffies + HZ * NFP_NET_POLL_TIMEOUT);
+@@ -3609,6 +3625,7 @@ struct nfp_net *nfp_net_alloc(struct pci_dev *pdev, bool needs_netdev,
+  */
+ void nfp_net_free(struct nfp_net *nn)
+ {
++	WARN_ON(timer_pending(&nn->reconfig_timer) || nn->reconfig_posted);
+ 	if (nn->dp.netdev)
+ 		free_netdev(nn->dp.netdev);
+ 	else
+@@ -3893,4 +3910,5 @@ void nfp_net_clean(struct nfp_net *nn)
+ 		return;
+ 
+ 	unregister_netdev(nn->dp.netdev);
++	nfp_net_reconfig_wait_posted(nn);
+ }
+diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+index 353f1c129af1..059ba9429e51 100644
+--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+@@ -2384,26 +2384,20 @@ static int qlge_update_hw_vlan_features(struct net_device *ndev,
+ 	return status;
+ }
+ 
+-static netdev_features_t qlge_fix_features(struct net_device *ndev,
+-	netdev_features_t features)
+-{
+-	int err;
+-
+-	/* Update the behavior of vlan accel in the adapter */
+-	err = qlge_update_hw_vlan_features(ndev, features);
+-	if (err)
+-		return err;
+-
+-	return features;
+-}
+-
+ static int qlge_set_features(struct net_device *ndev,
+ 	netdev_features_t features)
+ {
+ 	netdev_features_t changed = ndev->features ^ features;
++	int err;
++
++	if (changed & NETIF_F_HW_VLAN_CTAG_RX) {
++		/* Update the behavior of vlan accel in the adapter */
++		err = qlge_update_hw_vlan_features(ndev, features);
++		if (err)
++			return err;
+ 
+-	if (changed & NETIF_F_HW_VLAN_CTAG_RX)
+ 		qlge_vlan_mode(ndev, features);
++	}
+ 
+ 	return 0;
+ }
+@@ -4719,7 +4713,6 @@ static const struct net_device_ops qlge_netdev_ops = {
+ 	.ndo_set_mac_address	= qlge_set_mac_address,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ 	.ndo_tx_timeout		= qlge_tx_timeout,
+-	.ndo_fix_features	= qlge_fix_features,
+ 	.ndo_set_features	= qlge_set_features,
+ 	.ndo_vlan_rx_add_vid	= qlge_vlan_rx_add_vid,
+ 	.ndo_vlan_rx_kill_vid	= qlge_vlan_rx_kill_vid,
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 9ceb34bac3a9..e5eb361b973c 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -303,6 +303,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8161), 0, 0, RTL_CFG_1 },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8167), 0, 0, RTL_CFG_0 },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8168), 0, 0, RTL_CFG_1 },
++	{ PCI_DEVICE(PCI_VENDOR_ID_NCUBE,	0x8168), 0, 0, RTL_CFG_1 },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8169), 0, 0, RTL_CFG_0 },
+ 	{ PCI_VENDOR_ID_DLINK,			0x4300,
+ 		PCI_VENDOR_ID_DLINK, 0x4b10,		 0, 0, RTL_CFG_1 },
+@@ -5038,7 +5039,7 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp)
+ 	rtl_hw_reset(tp);
+ }
+ 
+-static void rtl_set_rx_tx_config_registers(struct rtl8169_private *tp)
++static void rtl_set_tx_config_registers(struct rtl8169_private *tp)
+ {
+ 	/* Set DMA burst size and Interframe Gap Time */
+ 	RTL_W32(tp, TxConfig, (TX_DMA_BURST << TxDMAShift) |
+@@ -5149,12 +5150,14 @@ static void rtl_hw_start(struct  rtl8169_private *tp)
+ 
+ 	rtl_set_rx_max_size(tp);
+ 	rtl_set_rx_tx_desc_registers(tp);
+-	rtl_set_rx_tx_config_registers(tp);
++	rtl_set_tx_config_registers(tp);
+ 	RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+ 
+ 	/* Initially a 10 us delay. Turned it into a PCI commit. - FR */
+ 	RTL_R8(tp, IntrMask);
+ 	RTL_W8(tp, ChipCmd, CmdTxEnb | CmdRxEnb);
++	rtl_init_rxcfg(tp);
++
+ 	rtl_set_rx_mode(tp->dev);
+ 	/* no early-rx interrupts */
+ 	RTL_W16(tp, MultiIntr, RTL_R16(tp, MultiIntr) & 0xf000);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+index 76649adf8fb0..c0a855b7ab3b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+@@ -112,7 +112,6 @@ struct stmmac_priv {
+ 	u32 tx_count_frames;
+ 	u32 tx_coal_frames;
+ 	u32 tx_coal_timer;
+-	bool tx_timer_armed;
+ 
+ 	int tx_coalesce;
+ 	int hwts_tx_en;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index ef6a8d39db2f..c579d98b9666 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3126,16 +3126,13 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	 * element in case of no SG.
+ 	 */
+ 	priv->tx_count_frames += nfrags + 1;
+-	if (likely(priv->tx_coal_frames > priv->tx_count_frames) &&
+-	    !priv->tx_timer_armed) {
++	if (likely(priv->tx_coal_frames > priv->tx_count_frames)) {
+ 		mod_timer(&priv->txtimer,
+ 			  STMMAC_COAL_TIMER(priv->tx_coal_timer));
+-		priv->tx_timer_armed = true;
+ 	} else {
+ 		priv->tx_count_frames = 0;
+ 		stmmac_set_tx_ic(priv, desc);
+ 		priv->xstats.tx_set_ic_bit++;
+-		priv->tx_timer_armed = false;
+ 	}
+ 
+ 	skb_tx_timestamp(skb);
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index dd1d6e115145..6d74cde68163 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -29,6 +29,7 @@
+ #include <linux/netdevice.h>
+ #include <linux/inetdevice.h>
+ #include <linux/etherdevice.h>
++#include <linux/pci.h>
+ #include <linux/skbuff.h>
+ #include <linux/if_vlan.h>
+ #include <linux/in.h>
+@@ -1939,12 +1940,16 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
+ {
+ 	struct net_device *ndev;
+ 	struct net_device_context *net_device_ctx;
++	struct device *pdev = vf_netdev->dev.parent;
+ 	struct netvsc_device *netvsc_dev;
+ 	int ret;
+ 
+ 	if (vf_netdev->addr_len != ETH_ALEN)
+ 		return NOTIFY_DONE;
+ 
++	if (!pdev || !dev_is_pci(pdev) || dev_is_pf(pdev))
++		return NOTIFY_DONE;
++
+ 	/*
+ 	 * We will use the MAC address to locate the synthetic interface to
+ 	 * associate with the VF interface. If we don't find a matching
+@@ -2101,6 +2106,16 @@ static int netvsc_probe(struct hv_device *dev,
+ 
+ 	memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
+ 
++	/* We must get rtnl lock before scheduling nvdev->subchan_work,
++	 * otherwise netvsc_subchan_work() can get rtnl lock first and wait
++	 * all subchannels to show up, but that may not happen because
++	 * netvsc_probe() can't get rtnl lock and as a result vmbus_onoffer()
++	 * -> ... -> device_add() -> ... -> __device_attach() can't get
++	 * the device lock, so all the subchannels can't be processed --
++	 * finally netvsc_subchan_work() hangs for ever.
++	 */
++	rtnl_lock();
++
+ 	if (nvdev->num_chn > 1)
+ 		schedule_work(&nvdev->subchan_work);
+ 
+@@ -2119,7 +2134,6 @@ static int netvsc_probe(struct hv_device *dev,
+ 	else
+ 		net->max_mtu = ETH_DATA_LEN;
+ 
+-	rtnl_lock();
+ 	ret = register_netdevice(net);
+ 	if (ret != 0) {
+ 		pr_err("Unable to register netdev.\n");
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 2a58607a6aea..1b07bb5e110d 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5214,8 +5214,8 @@ static int rtl8152_probe(struct usb_interface *intf,
+ 		netdev->hw_features &= ~NETIF_F_RXCSUM;
+ 	}
+ 
+-	if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x3011 &&
+-	    udev->serial && !strcmp(udev->serial, "000001000000")) {
++	if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x3011 && udev->serial &&
++	    (!strcmp(udev->serial, "000001000000") || !strcmp(udev->serial, "000002000000"))) {
+ 		dev_info(&udev->dev, "Dell TB16 Dock, disable RX aggregation");
+ 		set_bit(DELL_TB_RX_AGG_BUG, &tp->flags);
+ 	}
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index b6122aad639e..7569f9af8d47 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6926,15 +6926,15 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
+ 	cfg->d11inf.io_type = (u8)io_type;
+ 	brcmu_d11_attach(&cfg->d11inf);
+ 
+-	err = brcmf_setup_wiphy(wiphy, ifp);
+-	if (err < 0)
+-		goto priv_out;
+-
+ 	/* regulatory notifer below needs access to cfg so
+ 	 * assign it now.
+ 	 */
+ 	drvr->config = cfg;
+ 
++	err = brcmf_setup_wiphy(wiphy, ifp);
++	if (err < 0)
++		goto priv_out;
++
+ 	brcmf_dbg(INFO, "Registering custom regulatory\n");
+ 	wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
+ 	wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
+diff --git a/drivers/pci/controller/pci-mvebu.c b/drivers/pci/controller/pci-mvebu.c
+index 23e270839e6a..f00df2384985 100644
+--- a/drivers/pci/controller/pci-mvebu.c
++++ b/drivers/pci/controller/pci-mvebu.c
+@@ -1219,7 +1219,7 @@ static int mvebu_pcie_probe(struct platform_device *pdev)
+ 		pcie->realio.start = PCIBIOS_MIN_IO;
+ 		pcie->realio.end = min_t(resource_size_t,
+ 					 IO_SPACE_LIMIT,
+-					 resource_size(&pcie->io));
++					 resource_size(&pcie->io) - 1);
+ 	} else
+ 		pcie->realio = pcie->io;
+ 
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index b2857865c0aa..a1a243ee36bb 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1725,7 +1725,7 @@ int pci_setup_device(struct pci_dev *dev)
+ static void pci_configure_mps(struct pci_dev *dev)
+ {
+ 	struct pci_dev *bridge = pci_upstream_bridge(dev);
+-	int mps, p_mps, rc;
++	int mps, mpss, p_mps, rc;
+ 
+ 	if (!pci_is_pcie(dev) || !bridge || !pci_is_pcie(bridge))
+ 		return;
+@@ -1753,6 +1753,14 @@ static void pci_configure_mps(struct pci_dev *dev)
+ 	if (pcie_bus_config != PCIE_BUS_DEFAULT)
+ 		return;
+ 
++	mpss = 128 << dev->pcie_mpss;
++	if (mpss < p_mps && pci_pcie_type(bridge) == PCI_EXP_TYPE_ROOT_PORT) {
++		pcie_set_mps(bridge, mpss);
++		pci_info(dev, "Upstream bridge's Max Payload Size set to %d (was %d, max %d)\n",
++			 mpss, p_mps, 128 << bridge->pcie_mpss);
++		p_mps = pcie_get_mps(bridge);
++	}
++
+ 	rc = pcie_set_mps(dev, p_mps);
+ 	if (rc) {
+ 		pci_warn(dev, "can't set Max Payload Size to %d; if necessary, use \"pci=pcie_bus_safe\" and report a bug\n",
+@@ -1761,7 +1769,7 @@ static void pci_configure_mps(struct pci_dev *dev)
+ 	}
+ 
+ 	pci_info(dev, "Max Payload Size set to %d (was %d, max %d)\n",
+-		 p_mps, mps, 128 << dev->pcie_mpss);
++		 p_mps, mps, mpss);
+ }
+ 
+ static struct hpp_type0 pci_default_type0 = {
+diff --git a/drivers/pinctrl/pinctrl-axp209.c b/drivers/pinctrl/pinctrl-axp209.c
+index a52779f33ad4..afd0b533c40a 100644
+--- a/drivers/pinctrl/pinctrl-axp209.c
++++ b/drivers/pinctrl/pinctrl-axp209.c
+@@ -316,7 +316,7 @@ static const struct pinctrl_ops axp20x_pctrl_ops = {
+ 	.get_group_pins		= axp20x_group_pins,
+ };
+ 
+-static void axp20x_funcs_groups_from_mask(struct device *dev, unsigned int mask,
++static int axp20x_funcs_groups_from_mask(struct device *dev, unsigned int mask,
+ 					  unsigned int mask_len,
+ 					  struct axp20x_pinctrl_function *func,
+ 					  const struct pinctrl_pin_desc *pins)
+@@ -331,18 +331,22 @@ static void axp20x_funcs_groups_from_mask(struct device *dev, unsigned int mask,
+ 		func->groups = devm_kcalloc(dev,
+ 					    ngroups, sizeof(const char *),
+ 					    GFP_KERNEL);
++		if (!func->groups)
++			return -ENOMEM;
+ 		group = func->groups;
+ 		for_each_set_bit(bit, &mask_cpy, mask_len) {
+ 			*group = pins[bit].name;
+ 			group++;
+ 		}
+ 	}
++
++	return 0;
+ }
+ 
+-static void axp20x_build_funcs_groups(struct platform_device *pdev)
++static int axp20x_build_funcs_groups(struct platform_device *pdev)
+ {
+ 	struct axp20x_pctl *pctl = platform_get_drvdata(pdev);
+-	int i, pin, npins = pctl->desc->npins;
++	int i, ret, pin, npins = pctl->desc->npins;
+ 
+ 	pctl->funcs[AXP20X_FUNC_GPIO_OUT].name = "gpio_out";
+ 	pctl->funcs[AXP20X_FUNC_GPIO_OUT].muxval = AXP20X_MUX_GPIO_OUT;
+@@ -366,13 +370,19 @@ static void axp20x_build_funcs_groups(struct platform_device *pdev)
+ 			pctl->funcs[i].groups[pin] = pctl->desc->pins[pin].name;
+ 	}
+ 
+-	axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->ldo_mask,
++	ret = axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->ldo_mask,
+ 				      npins, &pctl->funcs[AXP20X_FUNC_LDO],
+ 				      pctl->desc->pins);
++	if (ret)
++		return ret;
+ 
+-	axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->adc_mask,
++	ret = axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->adc_mask,
+ 				      npins, &pctl->funcs[AXP20X_FUNC_ADC],
+ 				      pctl->desc->pins);
++	if (ret)
++		return ret;
++
++	return 0;
+ }
+ 
+ static const struct of_device_id axp20x_pctl_match[] = {
+@@ -424,7 +434,11 @@ static int axp20x_pctl_probe(struct platform_device *pdev)
+ 
+ 	platform_set_drvdata(pdev, pctl);
+ 
+-	axp20x_build_funcs_groups(pdev);
++	ret = axp20x_build_funcs_groups(pdev);
++	if (ret) {
++		dev_err(&pdev->dev, "failed to build groups\n");
++		return ret;
++	}
+ 
+ 	pctrl_desc = devm_kzalloc(&pdev->dev, sizeof(*pctrl_desc), GFP_KERNEL);
+ 	if (!pctrl_desc)
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 136ff2b4cce5..db2af09067db 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -496,6 +496,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = {
+ 	{ KE_KEY, 0xC4, { KEY_KBDILLUMUP } },
+ 	{ KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } },
+ 	{ KE_IGNORE, 0xC6, },  /* Ambient Light Sensor notification */
++	{ KE_KEY, 0xFA, { KEY_PROG2 } },           /* Lid flip action */
+ 	{ KE_END, 0},
+ };
+ 
+diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c
+index b5b890127479..b7dfe06261f1 100644
+--- a/drivers/platform/x86/intel_punit_ipc.c
++++ b/drivers/platform/x86/intel_punit_ipc.c
+@@ -17,6 +17,7 @@
+ #include <linux/bitops.h>
+ #include <linux/device.h>
+ #include <linux/interrupt.h>
++#include <linux/io.h>
+ #include <linux/platform_device.h>
+ #include <asm/intel_punit_ipc.h>
+ 
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index 822860b4801a..c1ed641b3e26 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -458,7 +458,6 @@ static int meson_pwm_init_channels(struct meson_pwm *meson,
+ 				   struct meson_pwm_channel *channels)
+ {
+ 	struct device *dev = meson->chip.dev;
+-	struct device_node *np = dev->of_node;
+ 	struct clk_init_data init;
+ 	unsigned int i;
+ 	char name[255];
+@@ -467,7 +466,7 @@ static int meson_pwm_init_channels(struct meson_pwm *meson,
+ 	for (i = 0; i < meson->chip.npwm; i++) {
+ 		struct meson_pwm_channel *channel = &channels[i];
+ 
+-		snprintf(name, sizeof(name), "%pOF#mux%u", np, i);
++		snprintf(name, sizeof(name), "%s#mux%u", dev_name(dev), i);
+ 
+ 		init.name = name;
+ 		init.ops = &clk_mux_ops;
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index bbf95b78ef5d..43e3398c9268 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -1780,6 +1780,9 @@ static void dasd_eckd_uncheck_device(struct dasd_device *device)
+ 	struct dasd_eckd_private *private = device->private;
+ 	int i;
+ 
++	if (!private)
++		return;
++
+ 	dasd_alias_disconnect_device_from_lcu(device);
+ 	private->ned = NULL;
+ 	private->sneq = NULL;
+@@ -2035,8 +2038,11 @@ static int dasd_eckd_basic_to_ready(struct dasd_device *device)
+ 
+ static int dasd_eckd_online_to_ready(struct dasd_device *device)
+ {
+-	cancel_work_sync(&device->reload_device);
+-	cancel_work_sync(&device->kick_validate);
++	if (cancel_work_sync(&device->reload_device))
++		dasd_put_device(device);
++	if (cancel_work_sync(&device->kick_validate))
++		dasd_put_device(device);
++
+ 	return 0;
+ };
+ 
+diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
+index 80e5b283fd81..1391e5f35918 100644
+--- a/drivers/scsi/aic94xx/aic94xx_init.c
++++ b/drivers/scsi/aic94xx/aic94xx_init.c
+@@ -1030,8 +1030,10 @@ static int __init aic94xx_init(void)
+ 
+ 	aic94xx_transport_template =
+ 		sas_domain_attach_transport(&aic94xx_transport_functions);
+-	if (!aic94xx_transport_template)
++	if (!aic94xx_transport_template) {
++		err = -ENOMEM;
+ 		goto out_destroy_caches;
++	}
+ 
+ 	err = pci_register_driver(&aic94xx_pci_driver);
+ 	if (err)
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index e40a2c0a9543..d3da39a9f567 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -5446,11 +5446,11 @@ static int ni_E_init(struct comedi_device *dev,
+ 	/* Digital I/O (PFI) subdevice */
+ 	s = &dev->subdevices[NI_PFI_DIO_SUBDEV];
+ 	s->type		= COMEDI_SUBD_DIO;
+-	s->subdev_flags	= SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL;
+ 	s->maxdata	= 1;
+ 	if (devpriv->is_m_series) {
+ 		s->n_chan	= 16;
+ 		s->insn_bits	= ni_pfi_insn_bits;
++		s->subdev_flags	= SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL;
+ 
+ 		ni_writew(dev, s->state, NI_M_PFI_DO_REG);
+ 		for (i = 0; i < NUM_PFI_OUTPUT_SELECT_REGS; ++i) {
+@@ -5459,6 +5459,7 @@ static int ni_E_init(struct comedi_device *dev,
+ 		}
+ 	} else {
+ 		s->n_chan	= 10;
++		s->subdev_flags	= SDF_INTERNAL;
+ 	}
+ 	s->insn_config	= ni_pfi_insn_config;
+ 
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index ed3114556fda..560ed8711706 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -951,7 +951,7 @@ static void vhost_iotlb_notify_vq(struct vhost_dev *d,
+ 	list_for_each_entry_safe(node, n, &d->pending_list, node) {
+ 		struct vhost_iotlb_msg *vq_msg = &node->msg.iotlb;
+ 		if (msg->iova <= vq_msg->iova &&
+-		    msg->iova + msg->size - 1 > vq_msg->iova &&
++		    msg->iova + msg->size - 1 >= vq_msg->iova &&
+ 		    vq_msg->type == VHOST_IOTLB_MISS) {
+ 			vhost_poll_queue(&node->vq->poll);
+ 			list_del(&node->node);
+diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
+index 2780886e8ba3..de062fb201bc 100644
+--- a/drivers/virtio/virtio_pci_legacy.c
++++ b/drivers/virtio/virtio_pci_legacy.c
+@@ -122,6 +122,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+ 	struct virtqueue *vq;
+ 	u16 num;
+ 	int err;
++	u64 q_pfn;
+ 
+ 	/* Select the queue we're interested in */
+ 	iowrite16(index, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_SEL);
+@@ -141,9 +142,17 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+ 	if (!vq)
+ 		return ERR_PTR(-ENOMEM);
+ 
++	q_pfn = virtqueue_get_desc_addr(vq) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT;
++	if (q_pfn >> 32) {
++		dev_err(&vp_dev->pci_dev->dev,
++			"platform bug: legacy virtio-mmio must not be used with RAM above 0x%llxGB\n",
++			0x1ULL << (32 + PAGE_SHIFT - 30));
++		err = -E2BIG;
++		goto out_del_vq;
++	}
++
+ 	/* activate the queue */
+-	iowrite32(virtqueue_get_desc_addr(vq) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT,
+-		  vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN);
++	iowrite32(q_pfn, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN);
+ 
+ 	vq->priv = (void __force *)vp_dev->ioaddr + VIRTIO_PCI_QUEUE_NOTIFY;
+ 
+@@ -160,6 +169,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+ 
+ out_deactivate:
+ 	iowrite32(0, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN);
++out_del_vq:
+ 	vring_del_virtqueue(vq);
+ 	return ERR_PTR(err);
+ }
+diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
+index b437fccd4e62..294f35ce9e46 100644
+--- a/drivers/xen/xen-balloon.c
++++ b/drivers/xen/xen-balloon.c
+@@ -81,7 +81,7 @@ static void watch_target(struct xenbus_watch *watch,
+ 			static_max = new_target;
+ 		else
+ 			static_max >>= PAGE_SHIFT - 10;
+-		target_diff = xen_pv_domain() ? 0
++		target_diff = (xen_pv_domain() || xen_initial_domain()) ? 0
+ 				: static_max - balloon_stats.target_pages;
+ 	}
+ 
+diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
+index a3fdb4fe967d..daf45472bef9 100644
+--- a/fs/btrfs/check-integrity.c
++++ b/fs/btrfs/check-integrity.c
+@@ -1539,7 +1539,12 @@ static int btrfsic_map_block(struct btrfsic_state *state, u64 bytenr, u32 len,
+ 	}
+ 
+ 	device = multi->stripes[0].dev;
+-	block_ctx_out->dev = btrfsic_dev_state_lookup(device->bdev->bd_dev);
++	if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state) ||
++	    !device->bdev || !device->name)
++		block_ctx_out->dev = NULL;
++	else
++		block_ctx_out->dev = btrfsic_dev_state_lookup(
++							device->bdev->bd_dev);
+ 	block_ctx_out->dev_bytenr = multi->stripes[0].physical;
+ 	block_ctx_out->start = bytenr;
+ 	block_ctx_out->len = len;
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index e2ba0419297a..d20b244623f2 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -676,6 +676,12 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
+ 
+ 	btrfs_rm_dev_replace_unblocked(fs_info);
+ 
++	/*
++	 * Increment dev_stats_ccnt so that btrfs_run_dev_stats() will
++	 * update on-disk dev stats value during commit transaction
++	 */
++	atomic_inc(&tgt_device->dev_stats_ccnt);
++
+ 	/*
+ 	 * this is again a consistent state where no dev_replace procedure
+ 	 * is running, the target device is part of the filesystem, the
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 8aab7a6c1e58..53cac20650d8 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10687,7 +10687,7 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info)
+ 		/* Don't want to race with allocators so take the groups_sem */
+ 		down_write(&space_info->groups_sem);
+ 		spin_lock(&block_group->lock);
+-		if (block_group->reserved ||
++		if (block_group->reserved || block_group->pinned ||
+ 		    btrfs_block_group_used(&block_group->item) ||
+ 		    block_group->ro ||
+ 		    list_is_singular(&block_group->list)) {
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 879b76fa881a..be94c65bb4d2 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1321,18 +1321,19 @@ static void __del_reloc_root(struct btrfs_root *root)
+ 	struct mapping_node *node = NULL;
+ 	struct reloc_control *rc = fs_info->reloc_ctl;
+ 
+-	spin_lock(&rc->reloc_root_tree.lock);
+-	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+-			      root->node->start);
+-	if (rb_node) {
+-		node = rb_entry(rb_node, struct mapping_node, rb_node);
+-		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
++	if (rc) {
++		spin_lock(&rc->reloc_root_tree.lock);
++		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
++				      root->node->start);
++		if (rb_node) {
++			node = rb_entry(rb_node, struct mapping_node, rb_node);
++			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
++		}
++		spin_unlock(&rc->reloc_root_tree.lock);
++		if (!node)
++			return;
++		BUG_ON((struct btrfs_root *)node->data != root);
+ 	}
+-	spin_unlock(&rc->reloc_root_tree.lock);
+-
+-	if (!node)
+-		return;
+-	BUG_ON((struct btrfs_root *)node->data != root);
+ 
+ 	spin_lock(&fs_info->trans_lock);
+ 	list_del_init(&root->root_list);
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index bddfc28b27c0..9b25f29d0e73 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -892,6 +892,8 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
+ 	char *device_name, *opts, *orig, *p;
+ 	int error = 0;
+ 
++	lockdep_assert_held(&uuid_mutex);
++
+ 	if (!options)
+ 		return 0;
+ 
+@@ -1526,12 +1528,6 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type,
+ 	if (!(flags & SB_RDONLY))
+ 		mode |= FMODE_WRITE;
+ 
+-	error = btrfs_parse_early_options(data, mode, fs_type,
+-					  &fs_devices);
+-	if (error) {
+-		return ERR_PTR(error);
+-	}
+-
+ 	security_init_mnt_opts(&new_sec_opts);
+ 	if (data) {
+ 		error = parse_security_options(data, &new_sec_opts);
+@@ -1539,10 +1535,6 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type,
+ 			return ERR_PTR(error);
+ 	}
+ 
+-	error = btrfs_scan_one_device(device_name, mode, fs_type, &fs_devices);
+-	if (error)
+-		goto error_sec_opts;
+-
+ 	/*
+ 	 * Setup a dummy root and fs_info for test/set super.  This is because
+ 	 * we don't actually fill this stuff out until open_ctree, but we need
+@@ -1555,8 +1547,6 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type,
+ 		goto error_sec_opts;
+ 	}
+ 
+-	fs_info->fs_devices = fs_devices;
+-
+ 	fs_info->super_copy = kzalloc(BTRFS_SUPER_INFO_SIZE, GFP_KERNEL);
+ 	fs_info->super_for_commit = kzalloc(BTRFS_SUPER_INFO_SIZE, GFP_KERNEL);
+ 	security_init_mnt_opts(&fs_info->security_opts);
+@@ -1565,7 +1555,23 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type,
+ 		goto error_fs_info;
+ 	}
+ 
++	mutex_lock(&uuid_mutex);
++	error = btrfs_parse_early_options(data, mode, fs_type, &fs_devices);
++	if (error) {
++		mutex_unlock(&uuid_mutex);
++		goto error_fs_info;
++	}
++
++	error = btrfs_scan_one_device(device_name, mode, fs_type, &fs_devices);
++	if (error) {
++		mutex_unlock(&uuid_mutex);
++		goto error_fs_info;
++	}
++
++	fs_info->fs_devices = fs_devices;
++
+ 	error = btrfs_open_devices(fs_devices, mode, fs_type);
++	mutex_unlock(&uuid_mutex);
+ 	if (error)
+ 		goto error_fs_info;
+ 
+@@ -2234,15 +2240,21 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
+ 
+ 	switch (cmd) {
+ 	case BTRFS_IOC_SCAN_DEV:
++		mutex_lock(&uuid_mutex);
+ 		ret = btrfs_scan_one_device(vol->name, FMODE_READ,
+ 					    &btrfs_root_fs_type, &fs_devices);
++		mutex_unlock(&uuid_mutex);
+ 		break;
+ 	case BTRFS_IOC_DEVICES_READY:
++		mutex_lock(&uuid_mutex);
+ 		ret = btrfs_scan_one_device(vol->name, FMODE_READ,
+ 					    &btrfs_root_fs_type, &fs_devices);
+-		if (ret)
++		if (ret) {
++			mutex_unlock(&uuid_mutex);
+ 			break;
++		}
+ 		ret = !(fs_devices->num_devices == fs_devices->total_devices);
++		mutex_unlock(&uuid_mutex);
+ 		break;
+ 	case BTRFS_IOC_GET_SUPPORTED_FEATURES:
+ 		ret = btrfs_ioctl_get_supported_features((void __user*)arg);
+@@ -2368,7 +2380,7 @@ static __cold void btrfs_interface_exit(void)
+ 
+ static void __init btrfs_print_mod_info(void)
+ {
+-	pr_info("Btrfs loaded, crc32c=%s"
++	static const char options[] = ""
+ #ifdef CONFIG_BTRFS_DEBUG
+ 			", debug=on"
+ #endif
+@@ -2381,8 +2393,8 @@ static void __init btrfs_print_mod_info(void)
+ #ifdef CONFIG_BTRFS_FS_REF_VERIFY
+ 			", ref-verify=on"
+ #endif
+-			"\n",
+-			crc32c_impl());
++			;
++	pr_info("Btrfs loaded, crc32c=%s%s\n", crc32c_impl(), options);
+ }
+ 
+ static int __init init_btrfs_fs(void)
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index 8d40e7dd8c30..d014af352ce0 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -396,9 +396,22 @@ static int check_leaf(struct btrfs_fs_info *fs_info, struct extent_buffer *leaf,
+ 	 * skip this check for relocation trees.
+ 	 */
+ 	if (nritems == 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)) {
++		u64 owner = btrfs_header_owner(leaf);
+ 		struct btrfs_root *check_root;
+ 
+-		key.objectid = btrfs_header_owner(leaf);
++		/* These trees must never be empty */
++		if (owner == BTRFS_ROOT_TREE_OBJECTID ||
++		    owner == BTRFS_CHUNK_TREE_OBJECTID ||
++		    owner == BTRFS_EXTENT_TREE_OBJECTID ||
++		    owner == BTRFS_DEV_TREE_OBJECTID ||
++		    owner == BTRFS_FS_TREE_OBJECTID ||
++		    owner == BTRFS_DATA_RELOC_TREE_OBJECTID) {
++			generic_err(fs_info, leaf, 0,
++			"invalid root, root %llu must never be empty",
++				    owner);
++			return -EUCLEAN;
++		}
++		key.objectid = owner;
+ 		key.type = BTRFS_ROOT_ITEM_KEY;
+ 		key.offset = (u64)-1;
+ 
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 1da162928d1a..5304b8d6ceb8 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -634,44 +634,48 @@ static void pending_bios_fn(struct btrfs_work *work)
+  *		devices.
+  */
+ static void btrfs_free_stale_devices(const char *path,
+-				     struct btrfs_device *skip_dev)
++				     struct btrfs_device *skip_device)
+ {
+-	struct btrfs_fs_devices *fs_devs, *tmp_fs_devs;
+-	struct btrfs_device *dev, *tmp_dev;
++	struct btrfs_fs_devices *fs_devices, *tmp_fs_devices;
++	struct btrfs_device *device, *tmp_device;
+ 
+-	list_for_each_entry_safe(fs_devs, tmp_fs_devs, &fs_uuids, fs_list) {
+-
+-		if (fs_devs->opened)
++	list_for_each_entry_safe(fs_devices, tmp_fs_devices, &fs_uuids, fs_list) {
++		mutex_lock(&fs_devices->device_list_mutex);
++		if (fs_devices->opened) {
++			mutex_unlock(&fs_devices->device_list_mutex);
+ 			continue;
++		}
+ 
+-		list_for_each_entry_safe(dev, tmp_dev,
+-					 &fs_devs->devices, dev_list) {
++		list_for_each_entry_safe(device, tmp_device,
++					 &fs_devices->devices, dev_list) {
+ 			int not_found = 0;
+ 
+-			if (skip_dev && skip_dev == dev)
++			if (skip_device && skip_device == device)
+ 				continue;
+-			if (path && !dev->name)
++			if (path && !device->name)
+ 				continue;
+ 
+ 			rcu_read_lock();
+ 			if (path)
+-				not_found = strcmp(rcu_str_deref(dev->name),
++				not_found = strcmp(rcu_str_deref(device->name),
+ 						   path);
+ 			rcu_read_unlock();
+ 			if (not_found)
+ 				continue;
+ 
+ 			/* delete the stale device */
+-			if (fs_devs->num_devices == 1) {
+-				btrfs_sysfs_remove_fsid(fs_devs);
+-				list_del(&fs_devs->fs_list);
+-				free_fs_devices(fs_devs);
++			fs_devices->num_devices--;
++			list_del(&device->dev_list);
++			btrfs_free_device(device);
++
++			if (fs_devices->num_devices == 0)
+ 				break;
+-			} else {
+-				fs_devs->num_devices--;
+-				list_del(&dev->dev_list);
+-				btrfs_free_device(dev);
+-			}
++		}
++		mutex_unlock(&fs_devices->device_list_mutex);
++		if (fs_devices->num_devices == 0) {
++			btrfs_sysfs_remove_fsid(fs_devices);
++			list_del(&fs_devices->fs_list);
++			free_fs_devices(fs_devices);
+ 		}
+ 	}
+ }
+@@ -750,7 +754,8 @@ error_brelse:
+  * error pointer when failed
+  */
+ static noinline struct btrfs_device *device_list_add(const char *path,
+-			   struct btrfs_super_block *disk_super)
++			   struct btrfs_super_block *disk_super,
++			   bool *new_device_added)
+ {
+ 	struct btrfs_device *device;
+ 	struct btrfs_fs_devices *fs_devices;
+@@ -764,21 +769,26 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ 		if (IS_ERR(fs_devices))
+ 			return ERR_CAST(fs_devices);
+ 
++		mutex_lock(&fs_devices->device_list_mutex);
+ 		list_add(&fs_devices->fs_list, &fs_uuids);
+ 
+ 		device = NULL;
+ 	} else {
++		mutex_lock(&fs_devices->device_list_mutex);
+ 		device = find_device(fs_devices, devid,
+ 				disk_super->dev_item.uuid);
+ 	}
+ 
+ 	if (!device) {
+-		if (fs_devices->opened)
++		if (fs_devices->opened) {
++			mutex_unlock(&fs_devices->device_list_mutex);
+ 			return ERR_PTR(-EBUSY);
++		}
+ 
+ 		device = btrfs_alloc_device(NULL, &devid,
+ 					    disk_super->dev_item.uuid);
+ 		if (IS_ERR(device)) {
++			mutex_unlock(&fs_devices->device_list_mutex);
+ 			/* we can safely leave the fs_devices entry around */
+ 			return device;
+ 		}
+@@ -786,17 +796,16 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ 		name = rcu_string_strdup(path, GFP_NOFS);
+ 		if (!name) {
+ 			btrfs_free_device(device);
++			mutex_unlock(&fs_devices->device_list_mutex);
+ 			return ERR_PTR(-ENOMEM);
+ 		}
+ 		rcu_assign_pointer(device->name, name);
+ 
+-		mutex_lock(&fs_devices->device_list_mutex);
+ 		list_add_rcu(&device->dev_list, &fs_devices->devices);
+ 		fs_devices->num_devices++;
+-		mutex_unlock(&fs_devices->device_list_mutex);
+ 
+ 		device->fs_devices = fs_devices;
+-		btrfs_free_stale_devices(path, device);
++		*new_device_added = true;
+ 
+ 		if (disk_super->label[0])
+ 			pr_info("BTRFS: device label %s devid %llu transid %llu %s\n",
+@@ -840,12 +849,15 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ 			 * with larger generation number or the last-in if
+ 			 * generation are equal.
+ 			 */
++			mutex_unlock(&fs_devices->device_list_mutex);
+ 			return ERR_PTR(-EEXIST);
+ 		}
+ 
+ 		name = rcu_string_strdup(path, GFP_NOFS);
+-		if (!name)
++		if (!name) {
++			mutex_unlock(&fs_devices->device_list_mutex);
+ 			return ERR_PTR(-ENOMEM);
++		}
+ 		rcu_string_free(device->name);
+ 		rcu_assign_pointer(device->name, name);
+ 		if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) {
+@@ -865,6 +877,7 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ 
+ 	fs_devices->total_devices = btrfs_super_num_devices(disk_super);
+ 
++	mutex_unlock(&fs_devices->device_list_mutex);
+ 	return device;
+ }
+ 
+@@ -1146,7 +1159,8 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
+ {
+ 	int ret;
+ 
+-	mutex_lock(&uuid_mutex);
++	lockdep_assert_held(&uuid_mutex);
++
+ 	mutex_lock(&fs_devices->device_list_mutex);
+ 	if (fs_devices->opened) {
+ 		fs_devices->opened++;
+@@ -1156,7 +1170,6 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
+ 		ret = open_fs_devices(fs_devices, flags, holder);
+ 	}
+ 	mutex_unlock(&fs_devices->device_list_mutex);
+-	mutex_unlock(&uuid_mutex);
+ 
+ 	return ret;
+ }
+@@ -1221,12 +1234,15 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
+ 			  struct btrfs_fs_devices **fs_devices_ret)
+ {
+ 	struct btrfs_super_block *disk_super;
++	bool new_device_added = false;
+ 	struct btrfs_device *device;
+ 	struct block_device *bdev;
+ 	struct page *page;
+ 	int ret = 0;
+ 	u64 bytenr;
+ 
++	lockdep_assert_held(&uuid_mutex);
++
+ 	/*
+ 	 * we would like to check all the supers, but that would make
+ 	 * a btrfs mount succeed after a mkfs from a different FS.
+@@ -1245,13 +1261,14 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
+ 		goto error_bdev_put;
+ 	}
+ 
+-	mutex_lock(&uuid_mutex);
+-	device = device_list_add(path, disk_super);
+-	if (IS_ERR(device))
++	device = device_list_add(path, disk_super, &new_device_added);
++	if (IS_ERR(device)) {
+ 		ret = PTR_ERR(device);
+-	else
++	} else {
+ 		*fs_devices_ret = device->fs_devices;
+-	mutex_unlock(&uuid_mutex);
++		if (new_device_added)
++			btrfs_free_stale_devices(path, device);
++	}
+ 
+ 	btrfs_release_disk_super(page);
+ 
+@@ -2029,6 +2046,9 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path,
+ 
+ 	cur_devices->num_devices--;
+ 	cur_devices->total_devices--;
++	/* Update total_devices of the parent fs_devices if it's seed */
++	if (cur_devices != fs_devices)
++		fs_devices->total_devices--;
+ 
+ 	if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
+ 		cur_devices->missing_devices--;
+@@ -6563,10 +6583,14 @@ static int read_one_chunk(struct btrfs_fs_info *fs_info, struct btrfs_key *key,
+ 	write_lock(&map_tree->map_tree.lock);
+ 	ret = add_extent_mapping(&map_tree->map_tree, em, 0);
+ 	write_unlock(&map_tree->map_tree.lock);
+-	BUG_ON(ret); /* Tree corruption */
++	if (ret < 0) {
++		btrfs_err(fs_info,
++			  "failed to add chunk map, start=%llu len=%llu: %d",
++			  em->start, em->len, ret);
++	}
+ 	free_extent_map(em);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static void fill_device_from_item(struct extent_buffer *leaf,
+diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
+index 991bfb271908..b20297988fe0 100644
+--- a/fs/cifs/cifs_debug.c
++++ b/fs/cifs/cifs_debug.c
+@@ -383,6 +383,10 @@ static ssize_t cifs_stats_proc_write(struct file *file,
+ 		atomic_set(&totBufAllocCount, 0);
+ 		atomic_set(&totSmBufAllocCount, 0);
+ #endif /* CONFIG_CIFS_STATS2 */
++		spin_lock(&GlobalMid_Lock);
++		GlobalMaxActiveXid = 0;
++		GlobalCurrentXid = 0;
++		spin_unlock(&GlobalMid_Lock);
+ 		spin_lock(&cifs_tcp_ses_lock);
+ 		list_for_each(tmp1, &cifs_tcp_ses_list) {
+ 			server = list_entry(tmp1, struct TCP_Server_Info,
+@@ -395,6 +399,10 @@ static ssize_t cifs_stats_proc_write(struct file *file,
+ 							  struct cifs_tcon,
+ 							  tcon_list);
+ 					atomic_set(&tcon->num_smbs_sent, 0);
++					spin_lock(&tcon->stat_lock);
++					tcon->bytes_read = 0;
++					tcon->bytes_written = 0;
++					spin_unlock(&tcon->stat_lock);
+ 					if (server->ops->clear_stats)
+ 						server->ops->clear_stats(tcon);
+ 				}
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 5df2c0698cda..9d02563b2147 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3031,11 +3031,15 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
+ 	}
+ 
+ #ifdef CONFIG_CIFS_SMB311
+-	if ((volume_info->linux_ext) && (ses->server->posix_ext_supported)) {
+-		if (ses->server->vals->protocol_id == SMB311_PROT_ID) {
++	if (volume_info->linux_ext) {
++		if (ses->server->posix_ext_supported) {
+ 			tcon->posix_extensions = true;
+ 			printk_once(KERN_WARNING
+ 				"SMB3.11 POSIX Extensions are experimental\n");
++		} else {
++			cifs_dbg(VFS, "Server does not support mounting with posix SMB3.11 extensions.\n");
++			rc = -EOPNOTSUPP;
++			goto out_fail;
+ 		}
+ 	}
+ #endif /* 311 */
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 3ff7cec2da81..239215dcc00b 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -240,6 +240,13 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *srvr)
+ 		if (clc_len == len + 1)
+ 			return 0;
+ 
++		/*
++		 * Some windows servers (win2016) will pad also the final
++		 * PDU in a compound to 8 bytes.
++		 */
++		if (((clc_len + 7) & ~7) == len)
++			return 0;
++
+ 		/*
+ 		 * MacOS server pads after SMB2.1 write response with 3 bytes
+ 		 * of junk. Other servers match RFC1001 len to actual
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index ffce77e00a58..44e511a35559 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -360,7 +360,7 @@ smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
+ 		       total_len);
+ 
+ 	if (tcon != NULL) {
+-#ifdef CONFIG_CIFS_STATS2
++#ifdef CONFIG_CIFS_STATS
+ 		uint16_t com_code = le16_to_cpu(smb2_command);
+ 		cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
+ #endif
+@@ -1928,7 +1928,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
+ {
+ 	struct smb_rqst rqst;
+ 	struct smb2_create_req *req;
+-	struct smb2_create_rsp *rsp;
++	struct smb2_create_rsp *rsp = NULL;
+ 	struct TCP_Server_Info *server;
+ 	struct cifs_ses *ses = tcon->ses;
+ 	struct kvec iov[3]; /* make sure at least one for each open context */
+@@ -1943,27 +1943,31 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
+ 	char *pc_buf = NULL;
+ 	int flags = 0;
+ 	unsigned int total_len;
+-	__le16 *path = cifs_convert_path_to_utf16(full_path, cifs_sb);
+-
+-	if (!path)
+-		return -ENOMEM;
++	__le16 *utf16_path = NULL;
+ 
+ 	cifs_dbg(FYI, "mkdir\n");
+ 
++	/* resource #1: path allocation */
++	utf16_path = cifs_convert_path_to_utf16(full_path, cifs_sb);
++	if (!utf16_path)
++		return -ENOMEM;
++
+ 	if (ses && (ses->server))
+ 		server = ses->server;
+-	else
+-		return -EIO;
++	else {
++		rc = -EIO;
++		goto err_free_path;
++	}
+ 
++	/* resource #2: request */
+ 	rc = smb2_plain_req_init(SMB2_CREATE, tcon, (void **) &req, &total_len);
+-
+ 	if (rc)
+-		return rc;
++		goto err_free_path;
++
+ 
+ 	if (smb3_encryption_required(tcon))
+ 		flags |= CIFS_TRANSFORM_REQ;
+ 
+-
+ 	req->ImpersonationLevel = IL_IMPERSONATION;
+ 	req->DesiredAccess = cpu_to_le32(FILE_WRITE_ATTRIBUTES);
+ 	/* File attributes ignored on open (used in create though) */
+@@ -1992,50 +1996,44 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
+ 		req->sync_hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
+ 		rc = alloc_path_with_tree_prefix(&copy_path, &copy_size,
+ 						 &name_len,
+-						 tcon->treeName, path);
+-		if (rc) {
+-			cifs_small_buf_release(req);
+-			return rc;
+-		}
++						 tcon->treeName, utf16_path);
++		if (rc)
++			goto err_free_req;
++
+ 		req->NameLength = cpu_to_le16(name_len * 2);
+ 		uni_path_len = copy_size;
+-		path = copy_path;
++		/* free before overwriting resource */
++		kfree(utf16_path);
++		utf16_path = copy_path;
+ 	} else {
+-		uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
++		uni_path_len = (2 * UniStrnlen((wchar_t *)utf16_path, PATH_MAX)) + 2;
+ 		/* MUST set path len (NameLength) to 0 opening root of share */
+ 		req->NameLength = cpu_to_le16(uni_path_len - 2);
+ 		if (uni_path_len % 8 != 0) {
+ 			copy_size = roundup(uni_path_len, 8);
+ 			copy_path = kzalloc(copy_size, GFP_KERNEL);
+ 			if (!copy_path) {
+-				cifs_small_buf_release(req);
+-				return -ENOMEM;
++				rc = -ENOMEM;
++				goto err_free_req;
+ 			}
+-			memcpy((char *)copy_path, (const char *)path,
++			memcpy((char *)copy_path, (const char *)utf16_path,
+ 			       uni_path_len);
+ 			uni_path_len = copy_size;
+-			path = copy_path;
++			/* free before overwriting resource */
++			kfree(utf16_path);
++			utf16_path = copy_path;
+ 		}
+ 	}
+ 
+ 	iov[1].iov_len = uni_path_len;
+-	iov[1].iov_base = path;
++	iov[1].iov_base = utf16_path;
+ 	req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE;
+ 
+ 	if (tcon->posix_extensions) {
+-		if (n_iov > 2) {
+-			struct create_context *ccontext =
+-			    (struct create_context *)iov[n_iov-1].iov_base;
+-			ccontext->Next =
+-				cpu_to_le32(iov[n_iov-1].iov_len);
+-		}
+-
++		/* resource #3: posix buf */
+ 		rc = add_posix_context(iov, &n_iov, mode);
+-		if (rc) {
+-			cifs_small_buf_release(req);
+-			kfree(copy_path);
+-			return rc;
+-		}
++		if (rc)
++			goto err_free_req;
+ 		pc_buf = iov[n_iov-1].iov_base;
+ 	}
+ 
+@@ -2044,32 +2042,33 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
+ 	rqst.rq_iov = iov;
+ 	rqst.rq_nvec = n_iov;
+ 
+-	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
+-			    &rsp_iov);
+-
+-	cifs_small_buf_release(req);
+-	rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;
+-
+-	if (rc != 0) {
++	/* resource #4: response buffer */
++	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
++	if (rc) {
+ 		cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
+ 		trace_smb3_posix_mkdir_err(xid, tcon->tid, ses->Suid,
+-				    CREATE_NOT_FILE, FILE_WRITE_ATTRIBUTES, rc);
+-		goto smb311_mkdir_exit;
+-	} else
+-		trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid,
+-				     ses->Suid, CREATE_NOT_FILE,
+-				     FILE_WRITE_ATTRIBUTES);
++					   CREATE_NOT_FILE,
++					   FILE_WRITE_ATTRIBUTES, rc);
++		goto err_free_rsp_buf;
++	}
++
++	rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;
++	trace_smb3_posix_mkdir_done(xid, rsp->PersistentFileId, tcon->tid,
++				    ses->Suid, CREATE_NOT_FILE,
++				    FILE_WRITE_ATTRIBUTES);
+ 
+ 	SMB2_close(xid, tcon, rsp->PersistentFileId, rsp->VolatileFileId);
+ 
+ 	/* Eventually save off posix specific response info and timestaps */
+ 
+-smb311_mkdir_exit:
+-	kfree(copy_path);
+-	kfree(pc_buf);
++err_free_rsp_buf:
+ 	free_rsp_buf(resp_buftype, rsp);
++	kfree(pc_buf);
++err_free_req:
++	cifs_small_buf_release(req);
++err_free_path:
++	kfree(utf16_path);
+ 	return rc;
+-
+ }
+ #endif /* SMB311 */
+ 
+diff --git a/fs/dcache.c b/fs/dcache.c
+index ceb7b491d1b9..d19a0dc46c04 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -292,7 +292,8 @@ void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *dentry
+ 		spin_unlock(&dentry->d_lock);
+ 		name->name = p->name;
+ 	} else {
+-		memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN);
++		memcpy(name->inline_name, dentry->d_iname,
++		       dentry->d_name.len + 1);
+ 		spin_unlock(&dentry->d_lock);
+ 		name->name = name->inline_name;
+ 	}
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 8f931d699287..b61954d40c25 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2149,8 +2149,12 @@ static void f2fs_write_failed(struct address_space *mapping, loff_t to)
+ 
+ 	if (to > i_size) {
+ 		down_write(&F2FS_I(inode)->i_mmap_sem);
++		down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
++
+ 		truncate_pagecache(inode, i_size);
+ 		f2fs_truncate_blocks(inode, i_size, true);
++
++		up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ 		up_write(&F2FS_I(inode)->i_mmap_sem);
+ 	}
+ }
+@@ -2490,6 +2494,10 @@ static int f2fs_set_data_page_dirty(struct page *page)
+ 	if (!PageUptodate(page))
+ 		SetPageUptodate(page);
+ 
++	/* don't remain PG_checked flag which was set during GC */
++	if (is_cold_data(page))
++		clear_cold_data(page);
++
+ 	if (f2fs_is_atomic_file(inode) && !f2fs_is_commit_atomic_write(inode)) {
+ 		if (!IS_ATOMIC_WRITTEN_PAGE(page)) {
+ 			f2fs_register_inmem_page(inode, page);
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 6880c6f78d58..3ffa341cf586 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -782,22 +782,26 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr)
+ 	}
+ 
+ 	if (attr->ia_valid & ATTR_SIZE) {
+-		if (attr->ia_size <= i_size_read(inode)) {
+-			down_write(&F2FS_I(inode)->i_mmap_sem);
+-			truncate_setsize(inode, attr->ia_size);
++		bool to_smaller = (attr->ia_size <= i_size_read(inode));
++
++		down_write(&F2FS_I(inode)->i_mmap_sem);
++		down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
++
++		truncate_setsize(inode, attr->ia_size);
++
++		if (to_smaller)
+ 			err = f2fs_truncate(inode);
+-			up_write(&F2FS_I(inode)->i_mmap_sem);
+-			if (err)
+-				return err;
+-		} else {
+-			/*
+-			 * do not trim all blocks after i_size if target size is
+-			 * larger than i_size.
+-			 */
+-			down_write(&F2FS_I(inode)->i_mmap_sem);
+-			truncate_setsize(inode, attr->ia_size);
+-			up_write(&F2FS_I(inode)->i_mmap_sem);
++		/*
++		 * do not trim all blocks after i_size if target size is
++		 * larger than i_size.
++		 */
++		up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
++		up_write(&F2FS_I(inode)->i_mmap_sem);
+ 
++		if (err)
++			return err;
++
++		if (!to_smaller) {
+ 			/* should convert inline inode here */
+ 			if (!f2fs_may_inline_data(inode)) {
+ 				err = f2fs_convert_inline_inode(inode);
+@@ -944,13 +948,18 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len)
+ 
+ 			blk_start = (loff_t)pg_start << PAGE_SHIFT;
+ 			blk_end = (loff_t)pg_end << PAGE_SHIFT;
++
+ 			down_write(&F2FS_I(inode)->i_mmap_sem);
++			down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
++
+ 			truncate_inode_pages_range(mapping, blk_start,
+ 					blk_end - 1);
+ 
+ 			f2fs_lock_op(sbi);
+ 			ret = f2fs_truncate_hole(inode, pg_start, pg_end);
+ 			f2fs_unlock_op(sbi);
++
++			up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ 			up_write(&F2FS_I(inode)->i_mmap_sem);
+ 		}
+ 	}
+@@ -1295,8 +1304,6 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len,
+ 	if (ret)
+ 		goto out_sem;
+ 
+-	truncate_pagecache_range(inode, offset, offset + len - 1);
+-
+ 	pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
+ 	pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
+ 
+@@ -1326,12 +1333,19 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len,
+ 			unsigned int end_offset;
+ 			pgoff_t end;
+ 
++			down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
++
++			truncate_pagecache_range(inode,
++				(loff_t)index << PAGE_SHIFT,
++				((loff_t)pg_end << PAGE_SHIFT) - 1);
++
+ 			f2fs_lock_op(sbi);
+ 
+ 			set_new_dnode(&dn, inode, NULL, NULL, 0);
+ 			ret = f2fs_get_dnode_of_data(&dn, index, ALLOC_NODE);
+ 			if (ret) {
+ 				f2fs_unlock_op(sbi);
++				up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ 				goto out;
+ 			}
+ 
+@@ -1340,7 +1354,9 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len,
+ 
+ 			ret = f2fs_do_zero_range(&dn, index, end);
+ 			f2fs_put_dnode(&dn);
++
+ 			f2fs_unlock_op(sbi);
++			up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ 
+ 			f2fs_balance_fs(sbi, dn.node_changed);
+ 
+diff --git a/fs/fat/cache.c b/fs/fat/cache.c
+index e9bed49df6b7..78d501c1fb65 100644
+--- a/fs/fat/cache.c
++++ b/fs/fat/cache.c
+@@ -225,7 +225,8 @@ static inline void cache_init(struct fat_cache_id *cid, int fclus, int dclus)
+ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
+ {
+ 	struct super_block *sb = inode->i_sb;
+-	const int limit = sb->s_maxbytes >> MSDOS_SB(sb)->cluster_bits;
++	struct msdos_sb_info *sbi = MSDOS_SB(sb);
++	const int limit = sb->s_maxbytes >> sbi->cluster_bits;
+ 	struct fat_entry fatent;
+ 	struct fat_cache_id cid;
+ 	int nr;
+@@ -234,6 +235,12 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
+ 
+ 	*fclus = 0;
+ 	*dclus = MSDOS_I(inode)->i_start;
++	if (!fat_valid_entry(sbi, *dclus)) {
++		fat_fs_error_ratelimit(sb,
++			"%s: invalid start cluster (i_pos %lld, start %08x)",
++			__func__, MSDOS_I(inode)->i_pos, *dclus);
++		return -EIO;
++	}
+ 	if (cluster == 0)
+ 		return 0;
+ 
+@@ -250,9 +257,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
+ 		/* prevent the infinite loop of cluster chain */
+ 		if (*fclus > limit) {
+ 			fat_fs_error_ratelimit(sb,
+-					"%s: detected the cluster chain loop"
+-					" (i_pos %lld)", __func__,
+-					MSDOS_I(inode)->i_pos);
++				"%s: detected the cluster chain loop (i_pos %lld)",
++				__func__, MSDOS_I(inode)->i_pos);
+ 			nr = -EIO;
+ 			goto out;
+ 		}
+@@ -262,9 +268,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
+ 			goto out;
+ 		else if (nr == FAT_ENT_FREE) {
+ 			fat_fs_error_ratelimit(sb,
+-				       "%s: invalid cluster chain (i_pos %lld)",
+-				       __func__,
+-				       MSDOS_I(inode)->i_pos);
++				"%s: invalid cluster chain (i_pos %lld)",
++				__func__, MSDOS_I(inode)->i_pos);
+ 			nr = -EIO;
+ 			goto out;
+ 		} else if (nr == FAT_ENT_EOF) {
+diff --git a/fs/fat/fat.h b/fs/fat/fat.h
+index 8fc1093da47d..a0a00f3734bc 100644
+--- a/fs/fat/fat.h
++++ b/fs/fat/fat.h
+@@ -348,6 +348,11 @@ static inline void fatent_brelse(struct fat_entry *fatent)
+ 	fatent->fat_inode = NULL;
+ }
+ 
++static inline bool fat_valid_entry(struct msdos_sb_info *sbi, int entry)
++{
++	return FAT_START_ENT <= entry && entry < sbi->max_cluster;
++}
++
+ extern void fat_ent_access_init(struct super_block *sb);
+ extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent,
+ 			int entry);
+diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
+index bac10de678cc..3aef8630a4b9 100644
+--- a/fs/fat/fatent.c
++++ b/fs/fat/fatent.c
+@@ -23,7 +23,7 @@ static void fat12_ent_blocknr(struct super_block *sb, int entry,
+ {
+ 	struct msdos_sb_info *sbi = MSDOS_SB(sb);
+ 	int bytes = entry + (entry >> 1);
+-	WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry);
++	WARN_ON(!fat_valid_entry(sbi, entry));
+ 	*offset = bytes & (sb->s_blocksize - 1);
+ 	*blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits);
+ }
+@@ -33,7 +33,7 @@ static void fat_ent_blocknr(struct super_block *sb, int entry,
+ {
+ 	struct msdos_sb_info *sbi = MSDOS_SB(sb);
+ 	int bytes = (entry << sbi->fatent_shift);
+-	WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry);
++	WARN_ON(!fat_valid_entry(sbi, entry));
+ 	*offset = bytes & (sb->s_blocksize - 1);
+ 	*blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits);
+ }
+@@ -353,7 +353,7 @@ int fat_ent_read(struct inode *inode, struct fat_entry *fatent, int entry)
+ 	int err, offset;
+ 	sector_t blocknr;
+ 
+-	if (entry < FAT_START_ENT || sbi->max_cluster <= entry) {
++	if (!fat_valid_entry(sbi, entry)) {
+ 		fatent_brelse(fatent);
+ 		fat_fs_error(sb, "invalid access to FAT (entry 0x%08x)", entry);
+ 		return -EIO;
+diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
+index ad04a5741016..9a8772465a90 100644
+--- a/fs/hfs/brec.c
++++ b/fs/hfs/brec.c
+@@ -75,9 +75,10 @@ int hfs_brec_insert(struct hfs_find_data *fd, void *entry, int entry_len)
+ 	if (!fd->bnode) {
+ 		if (!tree->root)
+ 			hfs_btree_inc_height(tree);
+-		fd->bnode = hfs_bnode_find(tree, tree->leaf_head);
+-		if (IS_ERR(fd->bnode))
+-			return PTR_ERR(fd->bnode);
++		node = hfs_bnode_find(tree, tree->leaf_head);
++		if (IS_ERR(node))
++			return PTR_ERR(node);
++		fd->bnode = node;
+ 		fd->record = -1;
+ 	}
+ 	new_node = NULL;
+diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
+index b5254378f011..cd017d7dbdfa 100644
+--- a/fs/hfsplus/dir.c
++++ b/fs/hfsplus/dir.c
+@@ -78,13 +78,13 @@ again:
+ 				cpu_to_be32(HFSP_HARDLINK_TYPE) &&
+ 				entry.file.user_info.fdCreator ==
+ 				cpu_to_be32(HFSP_HFSPLUS_CREATOR) &&
++				HFSPLUS_SB(sb)->hidden_dir &&
+ 				(entry.file.create_date ==
+ 					HFSPLUS_I(HFSPLUS_SB(sb)->hidden_dir)->
+ 						create_date ||
+ 				entry.file.create_date ==
+ 					HFSPLUS_I(d_inode(sb->s_root))->
+-						create_date) &&
+-				HFSPLUS_SB(sb)->hidden_dir) {
++						create_date)) {
+ 			struct qstr str;
+ 			char name[32];
+ 
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index a6c0f54c48c3..80abba550bfa 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -524,8 +524,10 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
+ 		goto out_put_root;
+ 	if (!hfs_brec_read(&fd, &entry, sizeof(entry))) {
+ 		hfs_find_exit(&fd);
+-		if (entry.type != cpu_to_be16(HFSPLUS_FOLDER))
++		if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) {
++			err = -EINVAL;
+ 			goto out_put_root;
++		}
+ 		inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id));
+ 		if (IS_ERR(inode)) {
+ 			err = PTR_ERR(inode);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 464db0c0f5c8..ff98e2a3f3cc 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7734,7 +7734,7 @@ static int nfs4_sp4_select_mode(struct nfs_client *clp,
+ 	}
+ out:
+ 	clp->cl_sp4_flags = flags;
+-	return 0;
++	return ret;
+ }
+ 
+ struct nfs41_exchange_id_data {
+diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
+index e64ecb9f2720..66c373230e60 100644
+--- a/fs/proc/kcore.c
++++ b/fs/proc/kcore.c
+@@ -384,8 +384,10 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
+ 		phdr->p_flags	= PF_R|PF_W|PF_X;
+ 		phdr->p_offset	= kc_vaddr_to_offset(m->addr) + dataoff;
+ 		phdr->p_vaddr	= (size_t)m->addr;
+-		if (m->type == KCORE_RAM || m->type == KCORE_TEXT)
++		if (m->type == KCORE_RAM)
+ 			phdr->p_paddr	= __pa(m->addr);
++		else if (m->type == KCORE_TEXT)
++			phdr->p_paddr	= __pa_symbol(m->addr);
+ 		else
+ 			phdr->p_paddr	= (elf_addr_t)-1;
+ 		phdr->p_filesz	= phdr->p_memsz	= m->size;
+diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
+index cfb6674331fd..0651646dd04d 100644
+--- a/fs/proc/vmcore.c
++++ b/fs/proc/vmcore.c
+@@ -225,6 +225,7 @@ out_unlock:
+ 	return ret;
+ }
+ 
++#ifdef CONFIG_MMU
+ static int vmcoredd_mmap_dumps(struct vm_area_struct *vma, unsigned long dst,
+ 			       u64 start, size_t size)
+ {
+@@ -259,6 +260,7 @@ out_unlock:
+ 	mutex_unlock(&vmcoredd_mutex);
+ 	return ret;
+ }
++#endif /* CONFIG_MMU */
+ #endif /* CONFIG_PROC_VMCORE_DEVICE_DUMP */
+ 
+ /* Read from the ELF header and then the crash dump. On error, negative value is
+diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h
+index ae4811fecc1f..6d670bd9ab6b 100644
+--- a/fs/reiserfs/reiserfs.h
++++ b/fs/reiserfs/reiserfs.h
+@@ -271,7 +271,7 @@ struct reiserfs_journal_list {
+ 
+ 	struct mutex j_commit_mutex;
+ 	unsigned int j_trans_id;
+-	time_t j_timestamp;
++	time64_t j_timestamp; /* write-only but useful for crash dump analysis */
+ 	struct reiserfs_list_bitmap *j_list_bitmap;
+ 	struct buffer_head *j_commit_bh;	/* commit buffer head */
+ 	struct reiserfs_journal_cnode *j_realblock;
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 29502238e510..bf85e152af05 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -3082,4 +3082,6 @@
+ 
+ #define PCI_VENDOR_ID_OCZ		0x1b85
+ 
++#define PCI_VENDOR_ID_NCUBE		0x10ff
++
+ #endif /* _LINUX_PCI_IDS_H */
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index cd3ecda9386a..106e01c721e6 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -2023,6 +2023,10 @@ int tcp_set_ulp_id(struct sock *sk, const int ulp);
+ void tcp_get_available_ulp(char *buf, size_t len);
+ void tcp_cleanup_ulp(struct sock *sk);
+ 
++#define MODULE_ALIAS_TCP_ULP(name)				\
++	__MODULE_INFO(alias, alias_userspace, name);		\
++	__MODULE_INFO(alias, alias_tcp_ulp, "tcp-ulp-" name)
++
+ /* Call BPF_SOCK_OPS program that returns an int. If the return value
+  * is < 0, then the BPF op failed (for example if the loaded BPF
+  * program does not support the chosen operation or there is no BPF
+diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
+index 7b8c9e19bad1..910cc4334b21 100644
+--- a/include/uapi/linux/keyctl.h
++++ b/include/uapi/linux/keyctl.h
+@@ -65,7 +65,7 @@
+ 
+ /* keyctl structures */
+ struct keyctl_dh_params {
+-	__s32 private;
++	__s32 dh_private;
+ 	__s32 prime;
+ 	__s32 base;
+ };
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index 76efe9a183f5..fc5b103512e7 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -196,19 +196,21 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ {
+ 	struct bpf_map *map = seq_file_to_map(m);
+ 	void *key = map_iter(m)->key;
++	void *prev_key;
+ 
+ 	if (map_iter(m)->done)
+ 		return NULL;
+ 
+ 	if (unlikely(v == SEQ_START_TOKEN))
+-		goto done;
++		prev_key = NULL;
++	else
++		prev_key = key;
+ 
+-	if (map->ops->map_get_next_key(map, key, key)) {
++	if (map->ops->map_get_next_key(map, prev_key, key)) {
+ 		map_iter(m)->done = true;
+ 		return NULL;
+ 	}
+ 
+-done:
+ 	++(*pos);
+ 	return key;
+ }
+diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
+index c4d75c52b4fc..58899601fccf 100644
+--- a/kernel/bpf/sockmap.c
++++ b/kernel/bpf/sockmap.c
+@@ -58,6 +58,7 @@ struct bpf_stab {
+ 	struct bpf_map map;
+ 	struct sock **sock_map;
+ 	struct bpf_sock_progs progs;
++	raw_spinlock_t lock;
+ };
+ 
+ struct bucket {
+@@ -89,9 +90,9 @@ enum smap_psock_state {
+ 
+ struct smap_psock_map_entry {
+ 	struct list_head list;
++	struct bpf_map *map;
+ 	struct sock **entry;
+ 	struct htab_elem __rcu *hash_link;
+-	struct bpf_htab __rcu *htab;
+ };
+ 
+ struct smap_psock {
+@@ -343,13 +344,18 @@ static void bpf_tcp_close(struct sock *sk, long timeout)
+ 	e = psock_map_pop(sk, psock);
+ 	while (e) {
+ 		if (e->entry) {
+-			osk = cmpxchg(e->entry, sk, NULL);
++			struct bpf_stab *stab = container_of(e->map, struct bpf_stab, map);
++
++			raw_spin_lock_bh(&stab->lock);
++			osk = *e->entry;
+ 			if (osk == sk) {
++				*e->entry = NULL;
+ 				smap_release_sock(psock, sk);
+ 			}
++			raw_spin_unlock_bh(&stab->lock);
+ 		} else {
+ 			struct htab_elem *link = rcu_dereference(e->hash_link);
+-			struct bpf_htab *htab = rcu_dereference(e->htab);
++			struct bpf_htab *htab = container_of(e->map, struct bpf_htab, map);
+ 			struct hlist_head *head;
+ 			struct htab_elem *l;
+ 			struct bucket *b;
+@@ -370,6 +376,7 @@ static void bpf_tcp_close(struct sock *sk, long timeout)
+ 			}
+ 			raw_spin_unlock_bh(&b->lock);
+ 		}
++		kfree(e);
+ 		e = psock_map_pop(sk, psock);
+ 	}
+ 	rcu_read_unlock();
+@@ -1644,6 +1651,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
+ 		return ERR_PTR(-ENOMEM);
+ 
+ 	bpf_map_init_from_attr(&stab->map, attr);
++	raw_spin_lock_init(&stab->lock);
+ 
+ 	/* make sure page count doesn't overflow */
+ 	cost = (u64) stab->map.max_entries * sizeof(struct sock *);
+@@ -1678,8 +1686,10 @@ static void smap_list_map_remove(struct smap_psock *psock,
+ 
+ 	spin_lock_bh(&psock->maps_lock);
+ 	list_for_each_entry_safe(e, tmp, &psock->maps, list) {
+-		if (e->entry == entry)
++		if (e->entry == entry) {
+ 			list_del(&e->list);
++			kfree(e);
++		}
+ 	}
+ 	spin_unlock_bh(&psock->maps_lock);
+ }
+@@ -1693,8 +1703,10 @@ static void smap_list_hash_remove(struct smap_psock *psock,
+ 	list_for_each_entry_safe(e, tmp, &psock->maps, list) {
+ 		struct htab_elem *c = rcu_dereference(e->hash_link);
+ 
+-		if (c == hash_link)
++		if (c == hash_link) {
+ 			list_del(&e->list);
++			kfree(e);
++		}
+ 	}
+ 	spin_unlock_bh(&psock->maps_lock);
+ }
+@@ -1714,14 +1726,15 @@ static void sock_map_free(struct bpf_map *map)
+ 	 * and a grace period expire to ensure psock is really safe to remove.
+ 	 */
+ 	rcu_read_lock();
++	raw_spin_lock_bh(&stab->lock);
+ 	for (i = 0; i < stab->map.max_entries; i++) {
+ 		struct smap_psock *psock;
+ 		struct sock *sock;
+ 
+-		sock = xchg(&stab->sock_map[i], NULL);
++		sock = stab->sock_map[i];
+ 		if (!sock)
+ 			continue;
+-
++		stab->sock_map[i] = NULL;
+ 		psock = smap_psock_sk(sock);
+ 		/* This check handles a racing sock event that can get the
+ 		 * sk_callback_lock before this case but after xchg happens
+@@ -1733,6 +1746,7 @@ static void sock_map_free(struct bpf_map *map)
+ 			smap_release_sock(psock, sock);
+ 		}
+ 	}
++	raw_spin_unlock_bh(&stab->lock);
+ 	rcu_read_unlock();
+ 
+ 	sock_map_remove_complete(stab);
+@@ -1776,19 +1790,23 @@ static int sock_map_delete_elem(struct bpf_map *map, void *key)
+ 	if (k >= map->max_entries)
+ 		return -EINVAL;
+ 
+-	sock = xchg(&stab->sock_map[k], NULL);
++	raw_spin_lock_bh(&stab->lock);
++	sock = stab->sock_map[k];
++	stab->sock_map[k] = NULL;
++	raw_spin_unlock_bh(&stab->lock);
+ 	if (!sock)
+ 		return -EINVAL;
+ 
+ 	psock = smap_psock_sk(sock);
+ 	if (!psock)
+-		goto out;
+-
+-	if (psock->bpf_parse)
++		return 0;
++	if (psock->bpf_parse) {
++		write_lock_bh(&sock->sk_callback_lock);
+ 		smap_stop_sock(psock, sock);
++		write_unlock_bh(&sock->sk_callback_lock);
++	}
+ 	smap_list_map_remove(psock, &stab->sock_map[k]);
+ 	smap_release_sock(psock, sock);
+-out:
+ 	return 0;
+ }
+ 
+@@ -1824,11 +1842,9 @@ out:
+ static int __sock_map_ctx_update_elem(struct bpf_map *map,
+ 				      struct bpf_sock_progs *progs,
+ 				      struct sock *sock,
+-				      struct sock **map_link,
+ 				      void *key)
+ {
+ 	struct bpf_prog *verdict, *parse, *tx_msg;
+-	struct smap_psock_map_entry *e = NULL;
+ 	struct smap_psock *psock;
+ 	bool new = false;
+ 	int err = 0;
+@@ -1901,14 +1917,6 @@ static int __sock_map_ctx_update_elem(struct bpf_map *map,
+ 		new = true;
+ 	}
+ 
+-	if (map_link) {
+-		e = kzalloc(sizeof(*e), GFP_ATOMIC | __GFP_NOWARN);
+-		if (!e) {
+-			err = -ENOMEM;
+-			goto out_free;
+-		}
+-	}
+-
+ 	/* 3. At this point we have a reference to a valid psock that is
+ 	 * running. Attach any BPF programs needed.
+ 	 */
+@@ -1930,17 +1938,6 @@ static int __sock_map_ctx_update_elem(struct bpf_map *map,
+ 		write_unlock_bh(&sock->sk_callback_lock);
+ 	}
+ 
+-	/* 4. Place psock in sockmap for use and stop any programs on
+-	 * the old sock assuming its not the same sock we are replacing
+-	 * it with. Because we can only have a single set of programs if
+-	 * old_sock has a strp we can stop it.
+-	 */
+-	if (map_link) {
+-		e->entry = map_link;
+-		spin_lock_bh(&psock->maps_lock);
+-		list_add_tail(&e->list, &psock->maps);
+-		spin_unlock_bh(&psock->maps_lock);
+-	}
+ 	return err;
+ out_free:
+ 	smap_release_sock(psock, sock);
+@@ -1951,7 +1948,6 @@ out_progs:
+ 	}
+ 	if (tx_msg)
+ 		bpf_prog_put(tx_msg);
+-	kfree(e);
+ 	return err;
+ }
+ 
+@@ -1961,36 +1957,57 @@ static int sock_map_ctx_update_elem(struct bpf_sock_ops_kern *skops,
+ {
+ 	struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
+ 	struct bpf_sock_progs *progs = &stab->progs;
+-	struct sock *osock, *sock;
++	struct sock *osock, *sock = skops->sk;
++	struct smap_psock_map_entry *e;
++	struct smap_psock *psock;
+ 	u32 i = *(u32 *)key;
+ 	int err;
+ 
+ 	if (unlikely(flags > BPF_EXIST))
+ 		return -EINVAL;
+-
+ 	if (unlikely(i >= stab->map.max_entries))
+ 		return -E2BIG;
+ 
+-	sock = READ_ONCE(stab->sock_map[i]);
+-	if (flags == BPF_EXIST && !sock)
+-		return -ENOENT;
+-	else if (flags == BPF_NOEXIST && sock)
+-		return -EEXIST;
++	e = kzalloc(sizeof(*e), GFP_ATOMIC | __GFP_NOWARN);
++	if (!e)
++		return -ENOMEM;
+ 
+-	sock = skops->sk;
+-	err = __sock_map_ctx_update_elem(map, progs, sock, &stab->sock_map[i],
+-					 key);
++	err = __sock_map_ctx_update_elem(map, progs, sock, key);
+ 	if (err)
+ 		goto out;
+ 
+-	osock = xchg(&stab->sock_map[i], sock);
+-	if (osock) {
+-		struct smap_psock *opsock = smap_psock_sk(osock);
++	/* psock guaranteed to be present. */
++	psock = smap_psock_sk(sock);
++	raw_spin_lock_bh(&stab->lock);
++	osock = stab->sock_map[i];
++	if (osock && flags == BPF_NOEXIST) {
++		err = -EEXIST;
++		goto out_unlock;
++	}
++	if (!osock && flags == BPF_EXIST) {
++		err = -ENOENT;
++		goto out_unlock;
++	}
+ 
+-		smap_list_map_remove(opsock, &stab->sock_map[i]);
+-		smap_release_sock(opsock, osock);
++	e->entry = &stab->sock_map[i];
++	e->map = map;
++	spin_lock_bh(&psock->maps_lock);
++	list_add_tail(&e->list, &psock->maps);
++	spin_unlock_bh(&psock->maps_lock);
++
++	stab->sock_map[i] = sock;
++	if (osock) {
++		psock = smap_psock_sk(osock);
++		smap_list_map_remove(psock, &stab->sock_map[i]);
++		smap_release_sock(psock, osock);
+ 	}
++	raw_spin_unlock_bh(&stab->lock);
++	return 0;
++out_unlock:
++	smap_release_sock(psock, sock);
++	raw_spin_unlock_bh(&stab->lock);
+ out:
++	kfree(e);
+ 	return err;
+ }
+ 
+@@ -2353,7 +2370,7 @@ static int sock_hash_ctx_update_elem(struct bpf_sock_ops_kern *skops,
+ 	b = __select_bucket(htab, hash);
+ 	head = &b->head;
+ 
+-	err = __sock_map_ctx_update_elem(map, progs, sock, NULL, key);
++	err = __sock_map_ctx_update_elem(map, progs, sock, key);
+ 	if (err)
+ 		goto err;
+ 
+@@ -2379,8 +2396,7 @@ static int sock_hash_ctx_update_elem(struct bpf_sock_ops_kern *skops,
+ 	}
+ 
+ 	rcu_assign_pointer(e->hash_link, l_new);
+-	rcu_assign_pointer(e->htab,
+-			   container_of(map, struct bpf_htab, map));
++	e->map = map;
+ 	spin_lock_bh(&psock->maps_lock);
+ 	list_add_tail(&e->list, &psock->maps);
+ 	spin_unlock_bh(&psock->maps_lock);
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 1b27babc4c78..8ed48ca2cc43 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -549,8 +549,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
+ 			goto out;
+ 	}
+ 	/* a new mm has just been created */
+-	arch_dup_mmap(oldmm, mm);
+-	retval = 0;
++	retval = arch_dup_mmap(oldmm, mm);
+ out:
+ 	up_write(&mm->mmap_sem);
+ 	flush_tlb_mm(oldmm);
+@@ -1417,7 +1416,9 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
+ 		return -ENOMEM;
+ 
+ 	atomic_set(&sig->count, 1);
++	spin_lock_irq(&current->sighand->siglock);
+ 	memcpy(sig->action, current->sighand->action, sizeof(sig->action));
++	spin_unlock_irq(&current->sighand->siglock);
+ 	return 0;
+ }
+ 
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 5f78c6e41796..0280deac392e 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -2652,6 +2652,9 @@ void flush_workqueue(struct workqueue_struct *wq)
+ 	if (WARN_ON(!wq_online))
+ 		return;
+ 
++	lock_map_acquire(&wq->lockdep_map);
++	lock_map_release(&wq->lockdep_map);
++
+ 	mutex_lock(&wq->mutex);
+ 
+ 	/*
+@@ -2843,7 +2846,8 @@ reflush:
+ }
+ EXPORT_SYMBOL_GPL(drain_workqueue);
+ 
+-static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr)
++static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr,
++			     bool from_cancel)
+ {
+ 	struct worker *worker = NULL;
+ 	struct worker_pool *pool;
+@@ -2885,7 +2889,8 @@ static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr)
+ 	 * workqueues the deadlock happens when the rescuer stalls, blocking
+ 	 * forward progress.
+ 	 */
+-	if (pwq->wq->saved_max_active == 1 || pwq->wq->rescuer) {
++	if (!from_cancel &&
++	    (pwq->wq->saved_max_active == 1 || pwq->wq->rescuer)) {
+ 		lock_map_acquire(&pwq->wq->lockdep_map);
+ 		lock_map_release(&pwq->wq->lockdep_map);
+ 	}
+@@ -2896,6 +2901,27 @@ already_gone:
+ 	return false;
+ }
+ 
++static bool __flush_work(struct work_struct *work, bool from_cancel)
++{
++	struct wq_barrier barr;
++
++	if (WARN_ON(!wq_online))
++		return false;
++
++	if (!from_cancel) {
++		lock_map_acquire(&work->lockdep_map);
++		lock_map_release(&work->lockdep_map);
++	}
++
++	if (start_flush_work(work, &barr, from_cancel)) {
++		wait_for_completion(&barr.done);
++		destroy_work_on_stack(&barr.work);
++		return true;
++	} else {
++		return false;
++	}
++}
++
+ /**
+  * flush_work - wait for a work to finish executing the last queueing instance
+  * @work: the work to flush
+@@ -2909,18 +2935,7 @@ already_gone:
+  */
+ bool flush_work(struct work_struct *work)
+ {
+-	struct wq_barrier barr;
+-
+-	if (WARN_ON(!wq_online))
+-		return false;
+-
+-	if (start_flush_work(work, &barr)) {
+-		wait_for_completion(&barr.done);
+-		destroy_work_on_stack(&barr.work);
+-		return true;
+-	} else {
+-		return false;
+-	}
++	return __flush_work(work, false);
+ }
+ EXPORT_SYMBOL_GPL(flush_work);
+ 
+@@ -2986,7 +3001,7 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
+ 	 * isn't executing.
+ 	 */
+ 	if (wq_online)
+-		flush_work(work);
++		__flush_work(work, true);
+ 
+ 	clear_work_data(work);
+ 
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 994be4805cec..24c1df0d7466 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -360,9 +360,12 @@ static void debug_object_is_on_stack(void *addr, int onstack)
+ 
+ 	limit++;
+ 	if (is_on_stack)
+-		pr_warn("object is on stack, but not annotated\n");
++		pr_warn("object %p is on stack %p, but NOT annotated.\n", addr,
++			 task_stack_page(current));
+ 	else
+-		pr_warn("object is not on stack, but annotated\n");
++		pr_warn("object %p is NOT on stack %p, but annotated.\n", addr,
++			 task_stack_page(current));
++
+ 	WARN_ON(1);
+ }
+ 
+diff --git a/mm/Kconfig b/mm/Kconfig
+index ce95491abd6a..94af022b7f3d 100644
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -635,7 +635,7 @@ config DEFERRED_STRUCT_PAGE_INIT
+ 	bool "Defer initialisation of struct pages to kthreads"
+ 	default n
+ 	depends on NO_BOOTMEM
+-	depends on !FLATMEM
++	depends on SPARSEMEM
+ 	depends on !NEED_PER_CPU_KM
+ 	help
+ 	  Ordinarily all struct pages are initialised during early boot in a
+diff --git a/mm/fadvise.c b/mm/fadvise.c
+index afa41491d324..2d8376e3c640 100644
+--- a/mm/fadvise.c
++++ b/mm/fadvise.c
+@@ -72,8 +72,12 @@ int ksys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
+ 		goto out;
+ 	}
+ 
+-	/* Careful about overflows. Len == 0 means "as much as possible" */
+-	endbyte = offset + len;
++	/*
++	 * Careful about overflows. Len == 0 means "as much as possible".  Use
++	 * unsigned math because signed overflows are undefined and UBSan
++	 * complains.
++	 */
++	endbyte = (u64)offset + (u64)len;
+ 	if (!len || endbyte < len)
+ 		endbyte = -1;
+ 	else
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index ef456395645a..7fb60dd4be79 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -199,15 +199,14 @@ static void p9_mux_poll_stop(struct p9_conn *m)
+ static void p9_conn_cancel(struct p9_conn *m, int err)
+ {
+ 	struct p9_req_t *req, *rtmp;
+-	unsigned long flags;
+ 	LIST_HEAD(cancel_list);
+ 
+ 	p9_debug(P9_DEBUG_ERROR, "mux %p err %d\n", m, err);
+ 
+-	spin_lock_irqsave(&m->client->lock, flags);
++	spin_lock(&m->client->lock);
+ 
+ 	if (m->err) {
+-		spin_unlock_irqrestore(&m->client->lock, flags);
++		spin_unlock(&m->client->lock);
+ 		return;
+ 	}
+ 
+@@ -219,7 +218,6 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
+ 	list_for_each_entry_safe(req, rtmp, &m->unsent_req_list, req_list) {
+ 		list_move(&req->req_list, &cancel_list);
+ 	}
+-	spin_unlock_irqrestore(&m->client->lock, flags);
+ 
+ 	list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) {
+ 		p9_debug(P9_DEBUG_ERROR, "call back req %p\n", req);
+@@ -228,6 +226,7 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
+ 			req->t_err = err;
+ 		p9_client_cb(m->client, req, REQ_STATUS_ERROR);
+ 	}
++	spin_unlock(&m->client->lock);
+ }
+ 
+ static __poll_t
+@@ -375,8 +374,9 @@ static void p9_read_work(struct work_struct *work)
+ 		if (m->req->status != REQ_STATUS_ERROR)
+ 			status = REQ_STATUS_RCVD;
+ 		list_del(&m->req->req_list);
+-		spin_unlock(&m->client->lock);
++		/* update req->status while holding client->lock  */
+ 		p9_client_cb(m->client, m->req, status);
++		spin_unlock(&m->client->lock);
+ 		m->rc.sdata = NULL;
+ 		m->rc.offset = 0;
+ 		m->rc.capacity = 0;
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index 4c2da2513c8b..2dc1c293092b 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -571,7 +571,7 @@ static int p9_virtio_probe(struct virtio_device *vdev)
+ 	chan->vq = virtio_find_single_vq(vdev, req_done, "requests");
+ 	if (IS_ERR(chan->vq)) {
+ 		err = PTR_ERR(chan->vq);
+-		goto out_free_vq;
++		goto out_free_chan;
+ 	}
+ 	chan->vq->vdev->priv = chan;
+ 	spin_lock_init(&chan->lock);
+@@ -624,6 +624,7 @@ out_free_tag:
+ 	kfree(tag);
+ out_free_vq:
+ 	vdev->config->del_vqs(vdev);
++out_free_chan:
+ 	kfree(chan);
+ fail:
+ 	return err;
+diff --git a/net/core/xdp.c b/net/core/xdp.c
+index 6771f1855b96..2657056130a4 100644
+--- a/net/core/xdp.c
++++ b/net/core/xdp.c
+@@ -95,23 +95,15 @@ static void __xdp_rxq_info_unreg_mem_model(struct xdp_rxq_info *xdp_rxq)
+ {
+ 	struct xdp_mem_allocator *xa;
+ 	int id = xdp_rxq->mem.id;
+-	int err;
+ 
+ 	if (id == 0)
+ 		return;
+ 
+ 	mutex_lock(&mem_id_lock);
+ 
+-	xa = rhashtable_lookup(mem_id_ht, &id, mem_id_rht_params);
+-	if (!xa) {
+-		mutex_unlock(&mem_id_lock);
+-		return;
+-	}
+-
+-	err = rhashtable_remove_fast(mem_id_ht, &xa->node, mem_id_rht_params);
+-	WARN_ON(err);
+-
+-	call_rcu(&xa->rcu, __xdp_mem_allocator_rcu_free);
++	xa = rhashtable_lookup_fast(mem_id_ht, &id, mem_id_rht_params);
++	if (xa && !rhashtable_remove_fast(mem_id_ht, &xa->node, mem_id_rht_params))
++		call_rcu(&xa->rcu, __xdp_mem_allocator_rcu_free);
+ 
+ 	mutex_unlock(&mem_id_lock);
+ }
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 2d8efeecf619..055f4bbba86b 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1511,11 +1511,14 @@ nla_put_failure:
+ 
+ static void erspan_setup(struct net_device *dev)
+ {
++	struct ip_tunnel *t = netdev_priv(dev);
++
+ 	ether_setup(dev);
+ 	dev->netdev_ops = &erspan_netdev_ops;
+ 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 	dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+ 	ip_tunnel_setup(dev, erspan_net_id);
++	t->erspan_ver = 1;
+ }
+ 
+ static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = {
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 3b2711e33e4c..488b201851d7 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -2516,6 +2516,12 @@ static int __net_init tcp_sk_init(struct net *net)
+ 		if (res)
+ 			goto fail;
+ 		sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
++
++		/* Please enforce IP_DF and IPID==0 for RST and
++		 * ACK sent in SYN-RECV and TIME-WAIT state.
++		 */
++		inet_sk(sk)->pmtudisc = IP_PMTUDISC_DO;
++
+ 		*per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk;
+ 	}
+ 
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 1dda1341a223..b690132f5da2 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -184,8 +184,9 @@ kill:
+ 				inet_twsk_deschedule_put(tw);
+ 				return TCP_TW_SUCCESS;
+ 			}
++		} else {
++			inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
+ 		}
+-		inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
+ 
+ 		if (tmp_opt.saw_tstamp) {
+ 			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
+diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c
+index 622caa4039e0..a5995bb2eaca 100644
+--- a/net/ipv4/tcp_ulp.c
++++ b/net/ipv4/tcp_ulp.c
+@@ -51,7 +51,7 @@ static const struct tcp_ulp_ops *__tcp_ulp_find_autoload(const char *name)
+ #ifdef CONFIG_MODULES
+ 	if (!ulp && capable(CAP_NET_ADMIN)) {
+ 		rcu_read_unlock();
+-		request_module("%s", name);
++		request_module("tcp-ulp-%s", name);
+ 		rcu_read_lock();
+ 		ulp = tcp_ulp_find(name);
+ 	}
+@@ -129,6 +129,8 @@ void tcp_cleanup_ulp(struct sock *sk)
+ 	if (icsk->icsk_ulp_ops->release)
+ 		icsk->icsk_ulp_ops->release(sk);
+ 	module_put(icsk->icsk_ulp_ops->owner);
++
++	icsk->icsk_ulp_ops = NULL;
+ }
+ 
+ /* Change upper layer protocol for socket */
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index d212738e9d10..5516f55e214b 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -198,6 +198,8 @@ void fib6_info_destroy_rcu(struct rcu_head *head)
+ 		}
+ 	}
+ 
++	lwtstate_put(f6i->fib6_nh.nh_lwtstate);
++
+ 	if (f6i->fib6_nh.nh_dev)
+ 		dev_put(f6i->fib6_nh.nh_dev);
+ 
+@@ -987,7 +989,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
+ 					fib6_clean_expires(iter);
+ 				else
+ 					fib6_set_expires(iter, rt->expires);
+-				fib6_metric_set(iter, RTAX_MTU, rt->fib6_pmtu);
++
++				if (rt->fib6_pmtu)
++					fib6_metric_set(iter, RTAX_MTU,
++							rt->fib6_pmtu);
+ 				return -EEXIST;
+ 			}
+ 			/* If we have the same destination and the same metric,
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index cd2cfb04e5d8..7ec997fcbc43 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1776,6 +1776,7 @@ static void ip6gre_netlink_parms(struct nlattr *data[],
+ 	if (data[IFLA_GRE_COLLECT_METADATA])
+ 		parms->collect_md = true;
+ 
++	parms->erspan_ver = 1;
+ 	if (data[IFLA_GRE_ERSPAN_VER])
+ 		parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
+ 
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index c72ae3a4fe09..c31a7c4a9249 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -481,7 +481,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ 	}
+ 
+ 	mtu = dst_mtu(dst);
+-	if (!skb->ignore_df && skb->len > mtu) {
++	if (skb->len > mtu) {
+ 		skb_dst_update_pmtu(skb, mtu);
+ 
+ 		if (skb->protocol == htons(ETH_P_IPV6)) {
+@@ -1102,7 +1102,8 @@ static void __net_exit vti6_destroy_tunnels(struct vti6_net *ip6n,
+ 	}
+ 
+ 	t = rtnl_dereference(ip6n->tnls_wc[0]);
+-	unregister_netdevice_queue(t->dev, list);
++	if (t)
++		unregister_netdevice_queue(t->dev, list);
+ }
+ 
+ static int __net_init vti6_init_net(struct net *net)
+@@ -1114,6 +1115,8 @@ static int __net_init vti6_init_net(struct net *net)
+ 	ip6n->tnls[0] = ip6n->tnls_wc;
+ 	ip6n->tnls[1] = ip6n->tnls_r_l;
+ 
++	if (!net_has_fallback_tunnels(net))
++		return 0;
+ 	err = -ENOMEM;
+ 	ip6n->fb_tnl_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6_vti0",
+ 					NET_NAME_UNKNOWN, vti6_dev_setup);
+diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
+index 0fe61ede77c6..c3c6b09acdc4 100644
+--- a/net/ipv6/netfilter/ip6t_rpfilter.c
++++ b/net/ipv6/netfilter/ip6t_rpfilter.c
+@@ -26,6 +26,12 @@ static bool rpfilter_addr_unicast(const struct in6_addr *addr)
+ 	return addr_type & IPV6_ADDR_UNICAST;
+ }
+ 
++static bool rpfilter_addr_linklocal(const struct in6_addr *addr)
++{
++	int addr_type = ipv6_addr_type(addr);
++	return addr_type & IPV6_ADDR_LINKLOCAL;
++}
++
+ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
+ 				     const struct net_device *dev, u8 flags)
+ {
+@@ -48,7 +54,11 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
+ 	}
+ 
+ 	fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
+-	if ((flags & XT_RPFILTER_LOOSE) == 0)
++
++	if (rpfilter_addr_linklocal(&iph->saddr)) {
++		lookup_flags |= RT6_LOOKUP_F_IFACE;
++		fl6.flowi6_oif = dev->ifindex;
++	} else if ((flags & XT_RPFILTER_LOOSE) == 0)
+ 		fl6.flowi6_oif = dev->ifindex;
+ 
+ 	rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 7208c16302f6..18e00ce1719a 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -956,7 +956,7 @@ static void ip6_rt_init_dst(struct rt6_info *rt, struct fib6_info *ort)
+ 	rt->dst.error = 0;
+ 	rt->dst.output = ip6_output;
+ 
+-	if (ort->fib6_type == RTN_LOCAL) {
++	if (ort->fib6_type == RTN_LOCAL || ort->fib6_type == RTN_ANYCAST) {
+ 		rt->dst.input = ip6_input;
+ 	} else if (ipv6_addr_type(&ort->fib6_dst.addr) & IPV6_ADDR_MULTICAST) {
+ 		rt->dst.input = ip6_mc_input;
+@@ -996,7 +996,6 @@ static void ip6_rt_copy_init(struct rt6_info *rt, struct fib6_info *ort)
+ 	rt->rt6i_src = ort->fib6_src;
+ #endif
+ 	rt->rt6i_prefsrc = ort->fib6_prefsrc;
+-	rt->dst.lwtstate = lwtstate_get(ort->fib6_nh.nh_lwtstate);
+ }
+ 
+ static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index 0679dd101e72..7ca926a03b81 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1972,13 +1972,20 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
+ 	if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
+ 		/* the destination server is not available */
+ 
+-		if (sysctl_expire_nodest_conn(ipvs)) {
++		__u32 flags = cp->flags;
++
++		/* when timer already started, silently drop the packet.*/
++		if (timer_pending(&cp->timer))
++			__ip_vs_conn_put(cp);
++		else
++			ip_vs_conn_put(cp);
++
++		if (sysctl_expire_nodest_conn(ipvs) &&
++		    !(flags & IP_VS_CONN_F_ONE_PACKET)) {
+ 			/* try to expire the connection immediately */
+ 			ip_vs_conn_expire_now(cp);
+ 		}
+-		/* don't restart its timer, and silently
+-		   drop the packet. */
+-		__ip_vs_conn_put(cp);
++
+ 		return NF_DROP;
+ 	}
+ 
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 20a2e37c76d1..e952eedf44b4 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -821,6 +821,21 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[])
+ #endif
+ }
+ 
++static int ctnetlink_start(struct netlink_callback *cb)
++{
++	const struct nlattr * const *cda = cb->data;
++	struct ctnetlink_filter *filter = NULL;
++
++	if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {
++		filter = ctnetlink_alloc_filter(cda);
++		if (IS_ERR(filter))
++			return PTR_ERR(filter);
++	}
++
++	cb->data = filter;
++	return 0;
++}
++
+ static int ctnetlink_filter_match(struct nf_conn *ct, void *data)
+ {
+ 	struct ctnetlink_filter *filter = data;
+@@ -1240,19 +1255,12 @@ static int ctnetlink_get_conntrack(struct net *net, struct sock *ctnl,
+ 
+ 	if (nlh->nlmsg_flags & NLM_F_DUMP) {
+ 		struct netlink_dump_control c = {
++			.start = ctnetlink_start,
+ 			.dump = ctnetlink_dump_table,
+ 			.done = ctnetlink_done,
++			.data = (void *)cda,
+ 		};
+ 
+-		if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {
+-			struct ctnetlink_filter *filter;
+-
+-			filter = ctnetlink_alloc_filter(cda);
+-			if (IS_ERR(filter))
+-				return PTR_ERR(filter);
+-
+-			c.data = filter;
+-		}
+ 		return netlink_dump_start(ctnl, skb, nlh, &c);
+ 	}
+ 
+diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
+index a0e5adf0b3b6..8fa8bf7c48e6 100644
+--- a/net/netfilter/nfnetlink_acct.c
++++ b/net/netfilter/nfnetlink_acct.c
+@@ -238,29 +238,33 @@ static const struct nla_policy filter_policy[NFACCT_FILTER_MAX + 1] = {
+ 	[NFACCT_FILTER_VALUE]	= { .type = NLA_U32 },
+ };
+ 
+-static struct nfacct_filter *
+-nfacct_filter_alloc(const struct nlattr * const attr)
++static int nfnl_acct_start(struct netlink_callback *cb)
+ {
+-	struct nfacct_filter *filter;
++	const struct nlattr *const attr = cb->data;
+ 	struct nlattr *tb[NFACCT_FILTER_MAX + 1];
++	struct nfacct_filter *filter;
+ 	int err;
+ 
++	if (!attr)
++		return 0;
++
+ 	err = nla_parse_nested(tb, NFACCT_FILTER_MAX, attr, filter_policy,
+ 			       NULL);
+ 	if (err < 0)
+-		return ERR_PTR(err);
++		return err;
+ 
+ 	if (!tb[NFACCT_FILTER_MASK] || !tb[NFACCT_FILTER_VALUE])
+-		return ERR_PTR(-EINVAL);
++		return -EINVAL;
+ 
+ 	filter = kzalloc(sizeof(struct nfacct_filter), GFP_KERNEL);
+ 	if (!filter)
+-		return ERR_PTR(-ENOMEM);
++		return -ENOMEM;
+ 
+ 	filter->mask = ntohl(nla_get_be32(tb[NFACCT_FILTER_MASK]));
+ 	filter->value = ntohl(nla_get_be32(tb[NFACCT_FILTER_VALUE]));
++	cb->data = filter;
+ 
+-	return filter;
++	return 0;
+ }
+ 
+ static int nfnl_acct_get(struct net *net, struct sock *nfnl,
+@@ -275,18 +279,11 @@ static int nfnl_acct_get(struct net *net, struct sock *nfnl,
+ 	if (nlh->nlmsg_flags & NLM_F_DUMP) {
+ 		struct netlink_dump_control c = {
+ 			.dump = nfnl_acct_dump,
++			.start = nfnl_acct_start,
+ 			.done = nfnl_acct_done,
++			.data = (void *)tb[NFACCT_FILTER],
+ 		};
+ 
+-		if (tb[NFACCT_FILTER]) {
+-			struct nfacct_filter *filter;
+-
+-			filter = nfacct_filter_alloc(tb[NFACCT_FILTER]);
+-			if (IS_ERR(filter))
+-				return PTR_ERR(filter);
+-
+-			c.data = filter;
+-		}
+ 		return netlink_dump_start(nfnl, skb, nlh, &c);
+ 	}
+ 
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index d0d8397c9588..aecadd471e1d 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -1178,12 +1178,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
+ 	if (sz < sizeof(*info) || sz >= XT_MAX_TABLE_SIZE)
+ 		return NULL;
+ 
+-	/* __GFP_NORETRY is not fully supported by kvmalloc but it should
+-	 * work reasonably well if sz is too large and bail out rather
+-	 * than shoot all processes down before realizing there is nothing
+-	 * more to reclaim.
+-	 */
+-	info = kvmalloc(sz, GFP_KERNEL | __GFP_NORETRY);
++	info = kvmalloc(sz, GFP_KERNEL_ACCOUNT);
+ 	if (!info)
+ 		return NULL;
+ 
+diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
+index d152e48ea371..8596eed6d9a8 100644
+--- a/net/rds/ib_frmr.c
++++ b/net/rds/ib_frmr.c
+@@ -61,6 +61,7 @@ static struct rds_ib_mr *rds_ib_alloc_frmr(struct rds_ib_device *rds_ibdev,
+ 			 pool->fmr_attr.max_pages);
+ 	if (IS_ERR(frmr->mr)) {
+ 		pr_warn("RDS/IB: %s failed to allocate MR", __func__);
++		err = PTR_ERR(frmr->mr);
+ 		goto out_no_cigar;
+ 	}
+ 
+diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
+index 20d7d36b2fc9..005cb21348c9 100644
+--- a/net/sched/act_ife.c
++++ b/net/sched/act_ife.c
+@@ -265,10 +265,8 @@ static const char *ife_meta_id2name(u32 metaid)
+ #endif
+ 
+ /* called when adding new meta information
+- * under ife->tcf_lock for existing action
+ */
+-static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
+-				void *val, int len, bool exists)
++static int load_metaops_and_vet(u32 metaid, void *val, int len)
+ {
+ 	struct tcf_meta_ops *ops = find_ife_oplist(metaid);
+ 	int ret = 0;
+@@ -276,13 +274,9 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
+ 	if (!ops) {
+ 		ret = -ENOENT;
+ #ifdef CONFIG_MODULES
+-		if (exists)
+-			spin_unlock_bh(&ife->tcf_lock);
+ 		rtnl_unlock();
+ 		request_module("ife-meta-%s", ife_meta_id2name(metaid));
+ 		rtnl_lock();
+-		if (exists)
+-			spin_lock_bh(&ife->tcf_lock);
+ 		ops = find_ife_oplist(metaid);
+ #endif
+ 	}
+@@ -299,24 +293,17 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
+ }
+ 
+ /* called when adding new meta information
+- * under ife->tcf_lock for existing action
+ */
+-static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
+-			int len, bool atomic)
++static int __add_metainfo(const struct tcf_meta_ops *ops,
++			  struct tcf_ife_info *ife, u32 metaid, void *metaval,
++			  int len, bool atomic, bool exists)
+ {
+ 	struct tcf_meta_info *mi = NULL;
+-	struct tcf_meta_ops *ops = find_ife_oplist(metaid);
+ 	int ret = 0;
+ 
+-	if (!ops)
+-		return -ENOENT;
+-
+ 	mi = kzalloc(sizeof(*mi), atomic ? GFP_ATOMIC : GFP_KERNEL);
+-	if (!mi) {
+-		/*put back what find_ife_oplist took */
+-		module_put(ops->owner);
++	if (!mi)
+ 		return -ENOMEM;
+-	}
+ 
+ 	mi->metaid = metaid;
+ 	mi->ops = ops;
+@@ -324,17 +311,49 @@ static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
+ 		ret = ops->alloc(mi, metaval, atomic ? GFP_ATOMIC : GFP_KERNEL);
+ 		if (ret != 0) {
+ 			kfree(mi);
+-			module_put(ops->owner);
+ 			return ret;
+ 		}
+ 	}
+ 
++	if (exists)
++		spin_lock_bh(&ife->tcf_lock);
+ 	list_add_tail(&mi->metalist, &ife->metalist);
++	if (exists)
++		spin_unlock_bh(&ife->tcf_lock);
+ 
+ 	return ret;
+ }
+ 
+-static int use_all_metadata(struct tcf_ife_info *ife)
++static int add_metainfo_and_get_ops(const struct tcf_meta_ops *ops,
++				    struct tcf_ife_info *ife, u32 metaid,
++				    bool exists)
++{
++	int ret;
++
++	if (!try_module_get(ops->owner))
++		return -ENOENT;
++	ret = __add_metainfo(ops, ife, metaid, NULL, 0, true, exists);
++	if (ret)
++		module_put(ops->owner);
++	return ret;
++}
++
++static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
++			int len, bool exists)
++{
++	const struct tcf_meta_ops *ops = find_ife_oplist(metaid);
++	int ret;
++
++	if (!ops)
++		return -ENOENT;
++	ret = __add_metainfo(ops, ife, metaid, metaval, len, false, exists);
++	if (ret)
++		/*put back what find_ife_oplist took */
++		module_put(ops->owner);
++	return ret;
++}
++
++static int use_all_metadata(struct tcf_ife_info *ife, bool exists)
+ {
+ 	struct tcf_meta_ops *o;
+ 	int rc = 0;
+@@ -342,7 +361,7 @@ static int use_all_metadata(struct tcf_ife_info *ife)
+ 
+ 	read_lock(&ife_mod_lock);
+ 	list_for_each_entry(o, &ifeoplist, list) {
+-		rc = add_metainfo(ife, o->metaid, NULL, 0, true);
++		rc = add_metainfo_and_get_ops(o, ife, o->metaid, exists);
+ 		if (rc == 0)
+ 			installed += 1;
+ 	}
+@@ -393,7 +412,6 @@ static void _tcf_ife_cleanup(struct tc_action *a)
+ 	struct tcf_meta_info *e, *n;
+ 
+ 	list_for_each_entry_safe(e, n, &ife->metalist, metalist) {
+-		module_put(e->ops->owner);
+ 		list_del(&e->metalist);
+ 		if (e->metaval) {
+ 			if (e->ops->release)
+@@ -401,6 +419,7 @@ static void _tcf_ife_cleanup(struct tc_action *a)
+ 			else
+ 				kfree(e->metaval);
+ 		}
++		module_put(e->ops->owner);
+ 		kfree(e);
+ 	}
+ }
+@@ -419,7 +438,6 @@ static void tcf_ife_cleanup(struct tc_action *a)
+ 		kfree_rcu(p, rcu);
+ }
+ 
+-/* under ife->tcf_lock for existing action */
+ static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb,
+ 			     bool exists)
+ {
+@@ -433,7 +451,7 @@ static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb,
+ 			val = nla_data(tb[i]);
+ 			len = nla_len(tb[i]);
+ 
+-			rc = load_metaops_and_vet(ife, i, val, len, exists);
++			rc = load_metaops_and_vet(i, val, len);
+ 			if (rc != 0)
+ 				return rc;
+ 
+@@ -531,8 +549,6 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
+ 		p->eth_type = ife_type;
+ 	}
+ 
+-	if (exists)
+-		spin_lock_bh(&ife->tcf_lock);
+ 
+ 	if (ret == ACT_P_CREATED)
+ 		INIT_LIST_HEAD(&ife->metalist);
+@@ -544,9 +560,6 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
+ metadata_parse_err:
+ 			if (ret == ACT_P_CREATED)
+ 				tcf_idr_release(*a, bind);
+-
+-			if (exists)
+-				spin_unlock_bh(&ife->tcf_lock);
+ 			kfree(p);
+ 			return err;
+ 		}
+@@ -561,18 +574,17 @@ metadata_parse_err:
+ 		 * as we can. You better have at least one else we are
+ 		 * going to bail out
+ 		 */
+-		err = use_all_metadata(ife);
++		err = use_all_metadata(ife, exists);
+ 		if (err) {
+ 			if (ret == ACT_P_CREATED)
+ 				tcf_idr_release(*a, bind);
+-
+-			if (exists)
+-				spin_unlock_bh(&ife->tcf_lock);
+ 			kfree(p);
+ 			return err;
+ 		}
+ 	}
+ 
++	if (exists)
++		spin_lock_bh(&ife->tcf_lock);
+ 	ife->tcf_action = parm->action;
+ 	if (exists)
+ 		spin_unlock_bh(&ife->tcf_lock);
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index 8a925c72db5f..bad475c87688 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -109,16 +109,18 @@ static int tcf_pedit_key_ex_dump(struct sk_buff *skb,
+ {
+ 	struct nlattr *keys_start = nla_nest_start(skb, TCA_PEDIT_KEYS_EX);
+ 
++	if (!keys_start)
++		goto nla_failure;
+ 	for (; n > 0; n--) {
+ 		struct nlattr *key_start;
+ 
+ 		key_start = nla_nest_start(skb, TCA_PEDIT_KEY_EX);
++		if (!key_start)
++			goto nla_failure;
+ 
+ 		if (nla_put_u16(skb, TCA_PEDIT_KEY_EX_HTYPE, keys_ex->htype) ||
+-		    nla_put_u16(skb, TCA_PEDIT_KEY_EX_CMD, keys_ex->cmd)) {
+-			nlmsg_trim(skb, keys_start);
+-			return -EINVAL;
+-		}
++		    nla_put_u16(skb, TCA_PEDIT_KEY_EX_CMD, keys_ex->cmd))
++			goto nla_failure;
+ 
+ 		nla_nest_end(skb, key_start);
+ 
+@@ -128,6 +130,9 @@ static int tcf_pedit_key_ex_dump(struct sk_buff *skb,
+ 	nla_nest_end(skb, keys_start);
+ 
+ 	return 0;
++nla_failure:
++	nla_nest_cancel(skb, keys_start);
++	return -EINVAL;
+ }
+ 
+ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
+@@ -395,7 +400,10 @@ static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,
+ 	opt->bindcnt = p->tcf_bindcnt - bind;
+ 
+ 	if (p->tcfp_keys_ex) {
+-		tcf_pedit_key_ex_dump(skb, p->tcfp_keys_ex, p->tcfp_nkeys);
++		if (tcf_pedit_key_ex_dump(skb,
++					  p->tcfp_keys_ex,
++					  p->tcfp_nkeys))
++			goto nla_put_failure;
+ 
+ 		if (nla_put(skb, TCA_PEDIT_PARMS_EX, s, opt))
+ 			goto nla_put_failure;
+diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
+index fb861f90fde6..260749956ef3 100644
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -912,6 +912,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
+ 	struct nlattr *opt = tca[TCA_OPTIONS];
+ 	struct nlattr *tb[TCA_U32_MAX + 1];
+ 	u32 htid, flags = 0;
++	size_t sel_size;
+ 	int err;
+ #ifdef CONFIG_CLS_U32_PERF
+ 	size_t size;
+@@ -1074,8 +1075,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
+ 	}
+ 
+ 	s = nla_data(tb[TCA_U32_SEL]);
++	sel_size = struct_size(s, keys, s->nkeys);
++	if (nla_len(tb[TCA_U32_SEL]) < sel_size) {
++		err = -EINVAL;
++		goto erridr;
++	}
+ 
+-	n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
++	n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL);
+ 	if (n == NULL) {
+ 		err = -ENOBUFS;
+ 		goto erridr;
+@@ -1090,7 +1096,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
+ 	}
+ #endif
+ 
+-	memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key));
++	memcpy(&n->sel, s, sel_size);
+ 	RCU_INIT_POINTER(n->ht_up, ht);
+ 	n->handle = handle;
+ 	n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;
+diff --git a/net/sctp/proc.c b/net/sctp/proc.c
+index ef5c9a82d4e8..a644292f9faf 100644
+--- a/net/sctp/proc.c
++++ b/net/sctp/proc.c
+@@ -215,7 +215,6 @@ static const struct seq_operations sctp_eps_ops = {
+ struct sctp_ht_iter {
+ 	struct seq_net_private p;
+ 	struct rhashtable_iter hti;
+-	int start_fail;
+ };
+ 
+ static void *sctp_transport_seq_start(struct seq_file *seq, loff_t *pos)
+@@ -224,7 +223,6 @@ static void *sctp_transport_seq_start(struct seq_file *seq, loff_t *pos)
+ 
+ 	sctp_transport_walk_start(&iter->hti);
+ 
+-	iter->start_fail = 0;
+ 	return sctp_transport_get_idx(seq_file_net(seq), &iter->hti, *pos);
+ }
+ 
+@@ -232,8 +230,6 @@ static void sctp_transport_seq_stop(struct seq_file *seq, void *v)
+ {
+ 	struct sctp_ht_iter *iter = seq->private;
+ 
+-	if (iter->start_fail)
+-		return;
+ 	sctp_transport_walk_stop(&iter->hti);
+ }
+ 
+@@ -264,8 +260,6 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
+ 	}
+ 
+ 	transport = (struct sctp_transport *)v;
+-	if (!sctp_transport_hold(transport))
+-		return 0;
+ 	assoc = transport->asoc;
+ 	epb = &assoc->base;
+ 	sk = epb->sk;
+@@ -322,8 +316,6 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
+ 	}
+ 
+ 	transport = (struct sctp_transport *)v;
+-	if (!sctp_transport_hold(transport))
+-		return 0;
+ 	assoc = transport->asoc;
+ 
+ 	list_for_each_entry_rcu(tsp, &assoc->peer.transport_addr_list,
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index ce620e878538..50ee07cd20c4 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4881,9 +4881,14 @@ struct sctp_transport *sctp_transport_get_next(struct net *net,
+ 			break;
+ 		}
+ 
++		if (!sctp_transport_hold(t))
++			continue;
++
+ 		if (net_eq(sock_net(t->asoc->base.sk), net) &&
+ 		    t->asoc->peer.primary_path == t)
+ 			break;
++
++		sctp_transport_put(t);
+ 	}
+ 
+ 	return t;
+@@ -4893,13 +4898,18 @@ struct sctp_transport *sctp_transport_get_idx(struct net *net,
+ 					      struct rhashtable_iter *iter,
+ 					      int pos)
+ {
+-	void *obj = SEQ_START_TOKEN;
++	struct sctp_transport *t;
+ 
+-	while (pos && (obj = sctp_transport_get_next(net, iter)) &&
+-	       !IS_ERR(obj))
+-		pos--;
++	if (!pos)
++		return SEQ_START_TOKEN;
+ 
+-	return obj;
++	while ((t = sctp_transport_get_next(net, iter)) && !IS_ERR(t)) {
++		if (!--pos)
++			break;
++		sctp_transport_put(t);
++	}
++
++	return t;
+ }
+ 
+ int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
+@@ -4958,8 +4968,6 @@ again:
+ 
+ 	tsp = sctp_transport_get_idx(net, &hti, *pos + 1);
+ 	for (; !IS_ERR_OR_NULL(tsp); tsp = sctp_transport_get_next(net, &hti)) {
+-		if (!sctp_transport_hold(tsp))
+-			continue;
+ 		ret = cb(tsp, p);
+ 		if (ret)
+ 			break;
+diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
+index 8654494b4d0a..834eb2b9e41b 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
++++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
+@@ -169,7 +169,7 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen,
+ 	struct scatterlist              sg[1];
+ 	int err = -1;
+ 	u8 *checksumdata;
+-	u8 rc4salt[4];
++	u8 *rc4salt;
+ 	struct crypto_ahash *md5;
+ 	struct crypto_ahash *hmac_md5;
+ 	struct ahash_request *req;
+@@ -183,14 +183,18 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen,
+ 		return GSS_S_FAILURE;
+ 	}
+ 
++	rc4salt = kmalloc_array(4, sizeof(*rc4salt), GFP_NOFS);
++	if (!rc4salt)
++		return GSS_S_FAILURE;
++
+ 	if (arcfour_hmac_md5_usage_to_salt(usage, rc4salt)) {
+ 		dprintk("%s: invalid usage value %u\n", __func__, usage);
+-		return GSS_S_FAILURE;
++		goto out_free_rc4salt;
+ 	}
+ 
+ 	checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS);
+ 	if (!checksumdata)
+-		return GSS_S_FAILURE;
++		goto out_free_rc4salt;
+ 
+ 	md5 = crypto_alloc_ahash("md5", 0, CRYPTO_ALG_ASYNC);
+ 	if (IS_ERR(md5))
+@@ -258,6 +262,8 @@ out_free_md5:
+ 	crypto_free_ahash(md5);
+ out_free_cksum:
+ 	kfree(checksumdata);
++out_free_rc4salt:
++	kfree(rc4salt);
+ 	return err ? GSS_S_FAILURE : 0;
+ }
+ 
+diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
+index bebe88cae07b..ff968c7afef6 100644
+--- a/net/tipc/name_table.c
++++ b/net/tipc/name_table.c
+@@ -980,20 +980,17 @@ int tipc_nl_name_table_dump(struct sk_buff *skb, struct netlink_callback *cb)
+ 
+ struct tipc_dest *tipc_dest_find(struct list_head *l, u32 node, u32 port)
+ {
+-	u64 value = (u64)node << 32 | port;
+ 	struct tipc_dest *dst;
+ 
+ 	list_for_each_entry(dst, l, list) {
+-		if (dst->value != value)
+-			continue;
+-		return dst;
++		if (dst->node == node && dst->port == port)
++			return dst;
+ 	}
+ 	return NULL;
+ }
+ 
+ bool tipc_dest_push(struct list_head *l, u32 node, u32 port)
+ {
+-	u64 value = (u64)node << 32 | port;
+ 	struct tipc_dest *dst;
+ 
+ 	if (tipc_dest_find(l, node, port))
+@@ -1002,7 +999,8 @@ bool tipc_dest_push(struct list_head *l, u32 node, u32 port)
+ 	dst = kmalloc(sizeof(*dst), GFP_ATOMIC);
+ 	if (unlikely(!dst))
+ 		return false;
+-	dst->value = value;
++	dst->node = node;
++	dst->port = port;
+ 	list_add(&dst->list, l);
+ 	return true;
+ }
+diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
+index 0febba41da86..892bd750b85f 100644
+--- a/net/tipc/name_table.h
++++ b/net/tipc/name_table.h
+@@ -133,13 +133,8 @@ void tipc_nametbl_stop(struct net *net);
+ 
+ struct tipc_dest {
+ 	struct list_head list;
+-	union {
+-		struct {
+-			u32 port;
+-			u32 node;
+-		};
+-		u64 value;
+-	};
++	u32 port;
++	u32 node;
+ };
+ 
+ struct tipc_dest *tipc_dest_find(struct list_head *l, u32 node, u32 port);
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 930852c54d7a..0a5fa347135e 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2675,6 +2675,8 @@ void tipc_sk_reinit(struct net *net)
+ 
+ 		rhashtable_walk_stop(&iter);
+ 	} while (tsk == ERR_PTR(-EAGAIN));
++
++	rhashtable_walk_exit(&iter);
+ }
+ 
+ static struct tipc_sock *tipc_sk_lookup(struct net *net, u32 portid)
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 301f22430469..45188d920013 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -45,6 +45,7 @@
+ MODULE_AUTHOR("Mellanox Technologies");
+ MODULE_DESCRIPTION("Transport Layer Security Support");
+ MODULE_LICENSE("Dual BSD/GPL");
++MODULE_ALIAS_TCP_ULP("tls");
+ 
+ enum {
+ 	TLSV4,
+diff --git a/samples/bpf/xdp_redirect_cpu_user.c b/samples/bpf/xdp_redirect_cpu_user.c
+index 4b4d78fffe30..da9070889223 100644
+--- a/samples/bpf/xdp_redirect_cpu_user.c
++++ b/samples/bpf/xdp_redirect_cpu_user.c
+@@ -679,8 +679,9 @@ int main(int argc, char **argv)
+ 		return EXIT_FAIL_OPTION;
+ 	}
+ 
+-	/* Remove XDP program when program is interrupted */
++	/* Remove XDP program when program is interrupted or killed */
+ 	signal(SIGINT, int_exit);
++	signal(SIGTERM, int_exit);
+ 
+ 	if (bpf_set_link_xdp_fd(ifindex, prog_fd[prog_num], xdp_flags) < 0) {
+ 		fprintf(stderr, "link set xdp fd failed\n");
+diff --git a/samples/bpf/xdp_rxq_info_user.c b/samples/bpf/xdp_rxq_info_user.c
+index e4e9ba52bff0..bb278447299c 100644
+--- a/samples/bpf/xdp_rxq_info_user.c
++++ b/samples/bpf/xdp_rxq_info_user.c
+@@ -534,8 +534,9 @@ int main(int argc, char **argv)
+ 		exit(EXIT_FAIL_BPF);
+ 	}
+ 
+-	/* Remove XDP program when program is interrupted */
++	/* Remove XDP program when program is interrupted or killed */
+ 	signal(SIGINT, int_exit);
++	signal(SIGTERM, int_exit);
+ 
+ 	if (bpf_set_link_xdp_fd(ifindex, prog_fd, xdp_flags) < 0) {
+ 		fprintf(stderr, "link set xdp fd failed\n");
+diff --git a/scripts/coccicheck b/scripts/coccicheck
+index 9fedca611b7f..e04d328210ac 100755
+--- a/scripts/coccicheck
++++ b/scripts/coccicheck
+@@ -128,9 +128,10 @@ run_cmd_parmap() {
+ 	fi
+ 	echo $@ >>$DEBUG_FILE
+ 	$@ 2>>$DEBUG_FILE
+-	if [[ $? -ne 0 ]]; then
++	err=$?
++	if [[ $err -ne 0 ]]; then
+ 		echo "coccicheck failed"
+-		exit $?
++		exit $err
+ 	fi
+ }
+ 
+diff --git a/scripts/depmod.sh b/scripts/depmod.sh
+index 999d585eaa73..e5f0aad75b96 100755
+--- a/scripts/depmod.sh
++++ b/scripts/depmod.sh
+@@ -15,9 +15,9 @@ if ! test -r System.map ; then
+ fi
+ 
+ if [ -z $(command -v $DEPMOD) ]; then
+-	echo "'make modules_install' requires $DEPMOD. Please install it." >&2
++	echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2
+ 	echo "This is probably in the kmod package." >&2
+-	exit 1
++	exit 0
+ fi
+ 
+ # older versions of depmod require the version string to start with three
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 1663fb19343a..b95cf57782a3 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -672,7 +672,7 @@ static void handle_modversions(struct module *mod, struct elf_info *info,
+ 			if (ELF_ST_TYPE(sym->st_info) == STT_SPARC_REGISTER)
+ 				break;
+ 			if (symname[0] == '.') {
+-				char *munged = strdup(symname);
++				char *munged = NOFAIL(strdup(symname));
+ 				munged[0] = '_';
+ 				munged[1] = toupper(munged[1]);
+ 				symname = munged;
+@@ -1318,7 +1318,7 @@ static Elf_Sym *find_elf_symbol2(struct elf_info *elf, Elf_Addr addr,
+ static char *sec2annotation(const char *s)
+ {
+ 	if (match(s, init_exit_sections)) {
+-		char *p = malloc(20);
++		char *p = NOFAIL(malloc(20));
+ 		char *r = p;
+ 
+ 		*p++ = '_';
+@@ -1338,7 +1338,7 @@ static char *sec2annotation(const char *s)
+ 			strcat(p, " ");
+ 		return r;
+ 	} else {
+-		return strdup("");
++		return NOFAIL(strdup(""));
+ 	}
+ }
+ 
+@@ -2036,7 +2036,7 @@ void buf_write(struct buffer *buf, const char *s, int len)
+ {
+ 	if (buf->size - buf->pos < len) {
+ 		buf->size += len + SZ;
+-		buf->p = realloc(buf->p, buf->size);
++		buf->p = NOFAIL(realloc(buf->p, buf->size));
+ 	}
+ 	strncpy(buf->p + buf->pos, s, len);
+ 	buf->pos += len;
+diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
+index b0f9dc3f765a..1a7cec5d9cac 100644
+--- a/security/apparmor/policy_ns.c
++++ b/security/apparmor/policy_ns.c
+@@ -255,7 +255,7 @@ static struct aa_ns *__aa_create_ns(struct aa_ns *parent, const char *name,
+ 
+ 	ns = alloc_ns(parent->base.hname, name);
+ 	if (!ns)
+-		return NULL;
++		return ERR_PTR(-ENOMEM);
+ 	ns->level = parent->level + 1;
+ 	mutex_lock_nested(&ns->lock, ns->level);
+ 	error = __aafs_ns_mkdir(ns, ns_subns_dir(parent), name, dir);
+diff --git a/security/keys/dh.c b/security/keys/dh.c
+index b203f7758f97..1a68d27e72b4 100644
+--- a/security/keys/dh.c
++++ b/security/keys/dh.c
+@@ -300,7 +300,7 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
+ 	}
+ 	dh_inputs.g_size = dlen;
+ 
+-	dlen = dh_data_from_key(pcopy.private, &dh_inputs.key);
++	dlen = dh_data_from_key(pcopy.dh_private, &dh_inputs.key);
+ 	if (dlen < 0) {
+ 		ret = dlen;
+ 		goto out2;
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 79d3709b0671..0b66d7283b00 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1365,13 +1365,18 @@ static int sel_make_bools(struct selinux_fs_info *fsi)
+ 
+ 		ret = -ENOMEM;
+ 		inode = sel_make_inode(dir->d_sb, S_IFREG | S_IRUGO | S_IWUSR);
+-		if (!inode)
++		if (!inode) {
++			dput(dentry);
+ 			goto out;
++		}
+ 
+ 		ret = -ENAMETOOLONG;
+ 		len = snprintf(page, PAGE_SIZE, "/%s/%s", BOOL_DIR_NAME, names[i]);
+-		if (len >= PAGE_SIZE)
++		if (len >= PAGE_SIZE) {
++			dput(dentry);
++			iput(inode);
+ 			goto out;
++		}
+ 
+ 		isec = (struct inode_security_struct *)inode->i_security;
+ 		ret = security_genfs_sid(fsi->state, "selinuxfs", page,
+@@ -1586,8 +1591,10 @@ static int sel_make_avc_files(struct dentry *dir)
+ 			return -ENOMEM;
+ 
+ 		inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode);
+-		if (!inode)
++		if (!inode) {
++			dput(dentry);
+ 			return -ENOMEM;
++		}
+ 
+ 		inode->i_fop = files[i].ops;
+ 		inode->i_ino = ++fsi->last_ino;
+@@ -1632,8 +1639,10 @@ static int sel_make_initcon_files(struct dentry *dir)
+ 			return -ENOMEM;
+ 
+ 		inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
+-		if (!inode)
++		if (!inode) {
++			dput(dentry);
+ 			return -ENOMEM;
++		}
+ 
+ 		inode->i_fop = &sel_initcon_ops;
+ 		inode->i_ino = i|SEL_INITCON_INO_OFFSET;
+@@ -1733,8 +1742,10 @@ static int sel_make_perm_files(char *objclass, int classvalue,
+ 
+ 		rc = -ENOMEM;
+ 		inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
+-		if (!inode)
++		if (!inode) {
++			dput(dentry);
+ 			goto out;
++		}
+ 
+ 		inode->i_fop = &sel_perm_ops;
+ 		/* i+1 since perm values are 1-indexed */
+@@ -1763,8 +1774,10 @@ static int sel_make_class_dir_entries(char *classname, int index,
+ 		return -ENOMEM;
+ 
+ 	inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
+-	if (!inode)
++	if (!inode) {
++		dput(dentry);
+ 		return -ENOMEM;
++	}
+ 
+ 	inode->i_fop = &sel_class_ops;
+ 	inode->i_ino = sel_class_to_ino(index);
+@@ -1838,8 +1851,10 @@ static int sel_make_policycap(struct selinux_fs_info *fsi)
+ 			return -ENOMEM;
+ 
+ 		inode = sel_make_inode(fsi->sb, S_IFREG | 0444);
+-		if (inode == NULL)
++		if (inode == NULL) {
++			dput(dentry);
+ 			return -ENOMEM;
++		}
+ 
+ 		inode->i_fop = &sel_policycap_ops;
+ 		inode->i_ino = iter | SEL_POLICYCAP_INO_OFFSET;
+@@ -1932,8 +1947,10 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
+ 
+ 	ret = -ENOMEM;
+ 	inode = sel_make_inode(sb, S_IFCHR | S_IRUGO | S_IWUGO);
+-	if (!inode)
++	if (!inode) {
++		dput(dentry);
+ 		goto err;
++	}
+ 
+ 	inode->i_ino = ++fsi->last_ino;
+ 	isec = (struct inode_security_struct *)inode->i_security;
+diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
+index 8a0181a2db08..47feef30dadb 100644
+--- a/sound/soc/codecs/rt5677.c
++++ b/sound/soc/codecs/rt5677.c
+@@ -5007,7 +5007,7 @@ static const struct regmap_config rt5677_regmap = {
+ };
+ 
+ static const struct of_device_id rt5677_of_match[] = {
+-	{ .compatible = "realtek,rt5677", RT5677 },
++	{ .compatible = "realtek,rt5677", .data = (const void *)RT5677 },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, rt5677_of_match);
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 7fdfdf3f6e67..14f1b0c0d286 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2432,6 +2432,7 @@ static int wm8994_set_dai_sysclk(struct snd_soc_dai *dai,
+ 			snd_soc_component_update_bits(component, WM8994_POWER_MANAGEMENT_2,
+ 					    WM8994_OPCLK_ENA, 0);
+ 		}
++		break;
+ 
+ 	default:
+ 		return -EINVAL;
+diff --git a/tools/perf/arch/arm64/util/arm-spe.c b/tools/perf/arch/arm64/util/arm-spe.c
+index 1120e39c1b00..5ccfce87e693 100644
+--- a/tools/perf/arch/arm64/util/arm-spe.c
++++ b/tools/perf/arch/arm64/util/arm-spe.c
+@@ -194,6 +194,7 @@ struct auxtrace_record *arm_spe_recording_init(int *err,
+ 	sper->itr.read_finish = arm_spe_read_finish;
+ 	sper->itr.alignment = 0;
+ 
++	*err = 0;
+ 	return &sper->itr;
+ }
+ 
+diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c
+index 53d83d7e6a09..20e7d74d86cd 100644
+--- a/tools/perf/arch/powerpc/util/sym-handling.c
++++ b/tools/perf/arch/powerpc/util/sym-handling.c
+@@ -141,8 +141,10 @@ void arch__post_process_probe_trace_events(struct perf_probe_event *pev,
+ 	for (i = 0; i < ntevs; i++) {
+ 		tev = &pev->tevs[i];
+ 		map__for_each_symbol(map, sym, tmp) {
+-			if (map->unmap_ip(map, sym->start) == tev->point.address)
++			if (map->unmap_ip(map, sym->start) == tev->point.address) {
+ 				arch__fix_tev_from_maps(pev, tev, map, sym);
++				break;
++			}
+ 		}
+ 	}
+ }
+diff --git a/tools/perf/util/namespaces.c b/tools/perf/util/namespaces.c
+index 5be021701f34..cf8bd123cf73 100644
+--- a/tools/perf/util/namespaces.c
++++ b/tools/perf/util/namespaces.c
+@@ -139,6 +139,9 @@ struct nsinfo *nsinfo__copy(struct nsinfo *nsi)
+ {
+ 	struct nsinfo *nnsi;
+ 
++	if (nsi == NULL)
++		return NULL;
++
+ 	nnsi = calloc(1, sizeof(*nnsi));
+ 	if (nnsi != NULL) {
+ 		nnsi->pid = nsi->pid;
+diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c
+index 66d31de60b9a..9d7166dfad1e 100644
+--- a/tools/testing/selftests/powerpc/harness.c
++++ b/tools/testing/selftests/powerpc/harness.c
+@@ -85,13 +85,13 @@ wait:
+ 	return status;
+ }
+ 
+-static void alarm_handler(int signum)
++static void sig_handler(int signum)
+ {
+-	/* Jut wake us up from waitpid */
++	/* Just wake us up from waitpid */
+ }
+ 
+-static struct sigaction alarm_action = {
+-	.sa_handler = alarm_handler,
++static struct sigaction sig_action = {
++	.sa_handler = sig_handler,
+ };
+ 
+ void test_harness_set_timeout(uint64_t time)
+@@ -106,8 +106,14 @@ int test_harness(int (test_function)(void), char *name)
+ 	test_start(name);
+ 	test_set_git_version(GIT_VERSION);
+ 
+-	if (sigaction(SIGALRM, &alarm_action, NULL)) {
+-		perror("sigaction");
++	if (sigaction(SIGINT, &sig_action, NULL)) {
++		perror("sigaction (sigint)");
++		test_error(name);
++		return 1;
++	}
++
++	if (sigaction(SIGALRM, &sig_action, NULL)) {
++		perror("sigaction (sigalrm)");
+ 		test_error(name);
+ 		return 1;
+ 	}