diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/arm/boot/dts/imx6qdl.dtsi linux-libre-4.19.118-gnu/arch/arm/boot/dts/imx6qdl.dtsi
--- linux-libre-4.19.117-gnu/arch/arm/boot/dts/imx6qdl.dtsi	2020-04-21 10:17:46.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/arm/boot/dts/imx6qdl.dtsi	2020-04-23 20:08:23.000000000 -0400
@@ -1013,9 +1013,8 @@
 				compatible = "fsl,imx6q-fec";
 				reg = <0x02188000 0x4000>;
 				interrupt-names = "int0", "pps";
-				interrupts-extended =
-					<&intc 0 118 IRQ_TYPE_LEVEL_HIGH>,
-					<&intc 0 119 IRQ_TYPE_LEVEL_HIGH>;
+				interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>,
+					     <0 119 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX6QDL_CLK_ENET>,
 					 <&clks IMX6QDL_CLK_ENET>,
 					 <&clks IMX6QDL_CLK_ENET_REF>;
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/arm/boot/dts/imx6qp.dtsi linux-libre-4.19.118-gnu/arch/arm/boot/dts/imx6qp.dtsi
--- linux-libre-4.19.117-gnu/arch/arm/boot/dts/imx6qp.dtsi	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/arm/boot/dts/imx6qp.dtsi	2020-04-23 04:30:24.000000000 -0400
@@ -77,7 +77,6 @@
 };
 
 &fec {
-	/delete-property/interrupts-extended;
 	interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>,
 		     <0 119 IRQ_TYPE_LEVEL_HIGH>;
 };
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/arm/net/bpf_jit_32.c linux-libre-4.19.118-gnu/arch/arm/net/bpf_jit_32.c
--- linux-libre-4.19.117-gnu/arch/arm/net/bpf_jit_32.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/arm/net/bpf_jit_32.c	2020-04-23 04:30:24.000000000 -0400
@@ -930,7 +930,11 @@ static inline void emit_a32_rsh_i64(cons
 	rd = arm_bpf_get_reg64(dst, tmp, ctx);
 
 	/* Do LSR operation */
-	if (val < 32) {
+	if (val == 0) {
+		/* An immediate value of 0 encodes a shift amount of 32
+		 * for LSR. To shift by 0, don't do anything.
+		 */
+	} else if (val < 32) {
 		emit(ARM_MOV_SI(tmp2[1], rd[1], SRTYPE_LSR, val), ctx);
 		emit(ARM_ORR_SI(rd[1], tmp2[1], rd[0], SRTYPE_ASL, 32 - val), ctx);
 		emit(ARM_MOV_SI(rd[0], rd[0], SRTYPE_LSR, val), ctx);
@@ -956,7 +960,11 @@ static inline void emit_a32_arsh_i64(con
 	rd = arm_bpf_get_reg64(dst, tmp, ctx);
 
 	/* Do ARSH operation */
-	if (val < 32) {
+	if (val == 0) {
+		/* An immediate value of 0 encodes a shift amount of 32
+		 * for ASR. To shift by 0, don't do anything.
+		 */
+	} else if (val < 32) {
 		emit(ARM_MOV_SI(tmp2[1], rd[1], SRTYPE_LSR, val), ctx);
 		emit(ARM_ORR_SI(rd[1], tmp2[1], rd[0], SRTYPE_ASL, 32 - val), ctx);
 		emit(ARM_MOV_SI(rd[0], rd[0], SRTYPE_ASR, val), ctx);
@@ -993,21 +1001,35 @@ static inline void emit_a32_mul_r64(cons
 	arm_bpf_put_reg32(dst_hi, rd[0], ctx);
 }
 
+static bool is_ldst_imm(s16 off, const u8 size)
+{
+	s16 off_max = 0;
+
+	switch (size) {
+	case BPF_B:
+	case BPF_W:
+		off_max = 0xfff;
+		break;
+	case BPF_H:
+		off_max = 0xff;
+		break;
+	case BPF_DW:
+		/* Need to make sure off+4 does not overflow. */
+		off_max = 0xfff - 4;
+		break;
+	}
+	return -off_max <= off && off <= off_max;
+}
+
 /* *(size *)(dst + off) = src */
 static inline void emit_str_r(const s8 dst, const s8 src[],
-			      s32 off, struct jit_ctx *ctx, const u8 sz){
+			      s16 off, struct jit_ctx *ctx, const u8 sz){
 	const s8 *tmp = bpf2a32[TMP_REG_1];
-	s32 off_max;
 	s8 rd;
 
 	rd = arm_bpf_get_reg32(dst, tmp[1], ctx);
 
-	if (sz == BPF_H)
-		off_max = 0xff;
-	else
-		off_max = 0xfff;
-
-	if (off < 0 || off > off_max) {
+	if (!is_ldst_imm(off, sz)) {
 		emit_a32_mov_i(tmp[0], off, ctx);
 		emit(ARM_ADD_R(tmp[0], tmp[0], rd), ctx);
 		rd = tmp[0];
@@ -1036,18 +1058,12 @@ static inline void emit_str_r(const s8 d
 
 /* dst = *(size*)(src + off) */
 static inline void emit_ldx_r(const s8 dst[], const s8 src,
-			      s32 off, struct jit_ctx *ctx, const u8 sz){
+			      s16 off, struct jit_ctx *ctx, const u8 sz){
 	const s8 *tmp = bpf2a32[TMP_REG_1];
 	const s8 *rd = is_stacked(dst_lo) ? tmp : dst;
 	s8 rm = src;
-	s32 off_max;
 
-	if (sz == BPF_H)
-		off_max = 0xff;
-	else
-		off_max = 0xfff;
-
-	if (off < 0 || off > off_max) {
+	if (!is_ldst_imm(off, sz)) {
 		emit_a32_mov_i(tmp[0], off, ctx);
 		emit(ARM_ADD_R(tmp[0], tmp[0], src), ctx);
 		rm = tmp[0];
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/powerpc/platforms/maple/setup.c linux-libre-4.19.118-gnu/arch/powerpc/platforms/maple/setup.c
--- linux-libre-4.19.117-gnu/arch/powerpc/platforms/maple/setup.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/powerpc/platforms/maple/setup.c	2020-04-23 04:30:24.000000000 -0400
@@ -299,23 +299,6 @@ static int __init maple_probe(void)
 	return 1;
 }
 
-define_machine(maple) {
-	.name			= "Maple",
-	.probe			= maple_probe,
-	.setup_arch		= maple_setup_arch,
-	.init_IRQ		= maple_init_IRQ,
-	.pci_irq_fixup		= maple_pci_irq_fixup,
-	.pci_get_legacy_ide_irq	= maple_pci_get_legacy_ide_irq,
-	.restart		= maple_restart,
-	.halt			= maple_halt,
-       	.get_boot_time		= maple_get_boot_time,
-       	.set_rtc_time		= maple_set_rtc_time,
-       	.get_rtc_time		= maple_get_rtc_time,
-      	.calibrate_decr		= generic_calibrate_decr,
-	.progress		= maple_progress,
-	.power_save		= power4_idle,
-};
-
 #ifdef CONFIG_EDAC
 /*
  * Register a platform device for CPC925 memory controller on
@@ -372,3 +355,20 @@ static int __init maple_cpc925_edac_setu
 }
 machine_device_initcall(maple, maple_cpc925_edac_setup);
 #endif
+
+define_machine(maple) {
+	.name			= "Maple",
+	.probe			= maple_probe,
+	.setup_arch		= maple_setup_arch,
+	.init_IRQ		= maple_init_IRQ,
+	.pci_irq_fixup		= maple_pci_irq_fixup,
+	.pci_get_legacy_ide_irq	= maple_pci_get_legacy_ide_irq,
+	.restart		= maple_restart,
+	.halt			= maple_halt,
+	.get_boot_time		= maple_get_boot_time,
+	.set_rtc_time		= maple_set_rtc_time,
+	.get_rtc_time		= maple_get_rtc_time,
+	.calibrate_decr		= generic_calibrate_decr,
+	.progress		= maple_progress,
+	.power_save		= power4_idle,
+};
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/s390/kernel/perf_cpum_sf.c linux-libre-4.19.118-gnu/arch/s390/kernel/perf_cpum_sf.c
--- linux-libre-4.19.117-gnu/arch/s390/kernel/perf_cpum_sf.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/s390/kernel/perf_cpum_sf.c	2020-04-23 04:30:24.000000000 -0400
@@ -1537,6 +1537,7 @@ static void hw_collect_aux(struct cpu_hw
 	perf_aux_output_end(handle, size);
 	num_sdb = aux->sfb.num_sdb;
 
+	num_sdb = aux->sfb.num_sdb;
 	while (!done) {
 		/* Get an output handle */
 		aux = perf_aux_output_begin(handle, cpuhw->event);
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/s390/kernel/processor.c linux-libre-4.19.118-gnu/arch/s390/kernel/processor.c
--- linux-libre-4.19.117-gnu/arch/s390/kernel/processor.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/s390/kernel/processor.c	2020-04-23 04:30:24.000000000 -0400
@@ -157,8 +157,9 @@ static void show_cpu_mhz(struct seq_file
 static int show_cpuinfo(struct seq_file *m, void *v)
 {
 	unsigned long n = (unsigned long) v - 1;
+	unsigned long first = cpumask_first(cpu_online_mask);
 
-	if (!n)
+	if (n == first)
 		show_cpu_summary(m, v);
 	if (!machine_has_cpu_mhz)
 		return 0;
@@ -171,6 +172,8 @@ static inline void *c_update(loff_t *pos
 {
 	if (*pos)
 		*pos = cpumask_next(*pos - 1, cpu_online_mask);
+	else
+		*pos = cpumask_first(cpu_online_mask);
 	return *pos < nr_cpu_ids ? (void *)*pos + 1 : NULL;
 }
 
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/s390/mm/gmap.c linux-libre-4.19.118-gnu/arch/s390/mm/gmap.c
--- linux-libre-4.19.117-gnu/arch/s390/mm/gmap.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/s390/mm/gmap.c	2020-04-23 04:30:24.000000000 -0400
@@ -1838,6 +1838,7 @@ int gmap_shadow_r3t(struct gmap *sg, uns
 		goto out_free;
 	} else if (*table & _REGION_ENTRY_ORIGIN) {
 		rc = -EAGAIN;		/* Race with shadow */
+		goto out_free;
 	}
 	crst_table_init(s_r3t, _REGION3_ENTRY_EMPTY);
 	/* mark as invalid as long as the parent table is not protected */
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/um/drivers/ubd_kern.c linux-libre-4.19.118-gnu/arch/um/drivers/ubd_kern.c
--- linux-libre-4.19.117-gnu/arch/um/drivers/ubd_kern.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/um/drivers/ubd_kern.c	2020-04-23 04:30:24.000000000 -0400
@@ -1574,7 +1574,9 @@ int io_thread(void *arg)
 		written = 0;
 
 		do {
-			res = os_write_file(kernel_fd, ((char *) io_req_buffer) + written, n);
+			res = os_write_file(kernel_fd,
+					    ((char *) io_req_buffer) + written,
+					    n - written);
 			if (res >= 0) {
 				written += res;
 			} else {
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/x86/hyperv/hv_init.c linux-libre-4.19.118-gnu/arch/x86/hyperv/hv_init.c
--- linux-libre-4.19.117-gnu/arch/x86/hyperv/hv_init.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/x86/hyperv/hv_init.c	2020-04-23 04:30:24.000000000 -0400
@@ -30,6 +30,7 @@
 #include <linux/clockchips.h>
 #include <linux/hyperv.h>
 #include <linux/slab.h>
+#include <linux/kernel.h>
 #include <linux/cpuhotplug.h>
 
 #ifdef CONFIG_HYPERV_TSCPAGE
@@ -427,11 +428,14 @@ void hyperv_cleanup(void)
 }
 EXPORT_SYMBOL_GPL(hyperv_cleanup);
 
-void hyperv_report_panic(struct pt_regs *regs, long err)
+void hyperv_report_panic(struct pt_regs *regs, long err, bool in_die)
 {
 	static bool panic_reported;
 	u64 guest_id;
 
+	if (in_die && !panic_on_oops)
+		return;
+
 	/*
 	 * We prefer to report panic on 'die' chain as we have proper
 	 * registers to report, but if we miss it (e.g. on BUG()) we need
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/x86/include/asm/mshyperv.h linux-libre-4.19.118-gnu/arch/x86/include/asm/mshyperv.h
--- linux-libre-4.19.117-gnu/arch/x86/include/asm/mshyperv.h	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/x86/include/asm/mshyperv.h	2020-04-23 04:30:24.000000000 -0400
@@ -338,7 +338,7 @@ static inline int cpumask_to_vpset(struc
 
 void __init hyperv_init(void);
 void hyperv_setup_mmu_ops(void);
-void hyperv_report_panic(struct pt_regs *regs, long err);
+void hyperv_report_panic(struct pt_regs *regs, long err, bool in_die);
 void hyperv_report_panic_msg(phys_addr_t pa, size_t size);
 bool hv_is_hyperv_initialized(void);
 void hyperv_cleanup(void);
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/x86/kernel/acpi/cstate.c linux-libre-4.19.118-gnu/arch/x86/kernel/acpi/cstate.c
--- linux-libre-4.19.117-gnu/arch/x86/kernel/acpi/cstate.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/x86/kernel/acpi/cstate.c	2020-04-23 04:30:24.000000000 -0400
@@ -133,7 +133,8 @@ int acpi_processor_ffh_cstate_probe(unsi
 
 	/* Make sure we are running on right CPU */
 
-	retval = work_on_cpu(cpu, acpi_processor_ffh_cstate_probe_cpu, cx);
+	retval = call_on_cpu(cpu, acpi_processor_ffh_cstate_probe_cpu, cx,
+			     false);
 	if (retval == 0) {
 		/* Use the hint in CST */
 		percpu_entry->states[cx->index].eax = cx->address;
diff -druNp --no-dereference linux-libre-4.19.117-gnu/arch/x86/kernel/cpu/mshyperv.c linux-libre-4.19.118-gnu/arch/x86/kernel/cpu/mshyperv.c
--- linux-libre-4.19.117-gnu/arch/x86/kernel/cpu/mshyperv.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/arch/x86/kernel/cpu/mshyperv.c	2020-04-23 04:30:24.000000000 -0400
@@ -250,6 +250,16 @@ static void __init ms_hyperv_init_platfo
 			cpuid_eax(HYPERV_CPUID_NESTED_FEATURES);
 	}
 
+	/*
+	 * Hyper-V expects to get crash register data or kmsg when
+	 * crash enlightment is available and system crashes. Set
+	 * crash_kexec_post_notifiers to be true to make sure that
+	 * calling crash enlightment interface before running kdump
+	 * kernel.
+	 */
+	if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE)
+		crash_kexec_post_notifiers = true;
+
 #ifdef CONFIG_X86_LOCAL_APIC
 	if (ms_hyperv.features & HV_X64_ACCESS_FREQUENCY_MSRS &&
 	    ms_hyperv.misc_features & HV_FEATURE_FREQUENCY_MSRS_AVAILABLE) {
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/acpi/processor_throttling.c linux-libre-4.19.118-gnu/drivers/acpi/processor_throttling.c
--- linux-libre-4.19.117-gnu/drivers/acpi/processor_throttling.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/acpi/processor_throttling.c	2020-04-23 04:30:24.000000000 -0400
@@ -910,13 +910,6 @@ static long __acpi_processor_get_throttl
 	return pr->throttling.acpi_processor_get_throttling(pr);
 }
 
-static int call_on_cpu(int cpu, long (*fn)(void *), void *arg, bool direct)
-{
-	if (direct || (is_percpu_thread() && cpu == smp_processor_id()))
-		return fn(arg);
-	return work_on_cpu(cpu, fn, arg);
-}
-
 static int acpi_processor_get_throttling(struct acpi_processor *pr)
 {
 	if (!pr)
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/block/rbd.c linux-libre-4.19.118-gnu/drivers/block/rbd.c
--- linux-libre-4.19.117-gnu/drivers/block/rbd.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/block/rbd.c	2020-04-23 04:30:24.000000000 -0400
@@ -3427,6 +3427,10 @@ static void cancel_tasks_sync(struct rbd
 	cancel_work_sync(&rbd_dev->unlock_work);
 }
 
+/*
+ * header_rwsem must not be held to avoid a deadlock with
+ * rbd_dev_refresh() when flushing notifies.
+ */
 static void rbd_unregister_watch(struct rbd_device *rbd_dev)
 {
 	WARN_ON(waitqueue_active(&rbd_dev->lock_waitq));
@@ -5719,9 +5723,10 @@ static int rbd_dev_header_name(struct rb
 
 static void rbd_dev_image_release(struct rbd_device *rbd_dev)
 {
-	rbd_dev_unprobe(rbd_dev);
 	if (rbd_dev->opts)
 		rbd_unregister_watch(rbd_dev);
+
+	rbd_dev_unprobe(rbd_dev);
 	rbd_dev->image_format = 0;
 	kfree(rbd_dev->spec->image_id);
 	rbd_dev->spec->image_id = NULL;
@@ -5732,6 +5737,9 @@ static void rbd_dev_image_release(struct
  * device.  If this image is the one being mapped (i.e., not a
  * parent), initiate a watch on its header object before using that
  * object to get detailed information about the rbd image.
+ *
+ * On success, returns with header_rwsem held for write if called
+ * with @depth == 0.
  */
 static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)
 {
@@ -5764,9 +5772,12 @@ static int rbd_dev_image_probe(struct rb
 		}
 	}
 
+	if (!depth)
+		down_write(&rbd_dev->header_rwsem);
+
 	ret = rbd_dev_header_info(rbd_dev);
 	if (ret)
-		goto err_out_watch;
+		goto err_out_probe;
 
 	/*
 	 * If this image is the one being mapped, we have pool name and
@@ -5812,10 +5823,11 @@ static int rbd_dev_image_probe(struct rb
 	return 0;
 
 err_out_probe:
-	rbd_dev_unprobe(rbd_dev);
-err_out_watch:
+	if (!depth)
+		up_write(&rbd_dev->header_rwsem);
 	if (!depth)
 		rbd_unregister_watch(rbd_dev);
+	rbd_dev_unprobe(rbd_dev);
 err_out_format:
 	rbd_dev->image_format = 0;
 	kfree(rbd_dev->spec->image_id);
@@ -5872,12 +5884,9 @@ static ssize_t do_rbd_add(struct bus_typ
 		goto err_out_rbd_dev;
 	}
 
-	down_write(&rbd_dev->header_rwsem);
 	rc = rbd_dev_image_probe(rbd_dev, 0);
-	if (rc < 0) {
-		up_write(&rbd_dev->header_rwsem);
+	if (rc < 0)
 		goto err_out_rbd_dev;
-	}
 
 	/* If we are mapping a snapshot it must be marked read-only */
 	if (rbd_dev->spec->snap_id != CEPH_NOSNAP)
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/clk/at91/clk-usb.c linux-libre-4.19.118-gnu/drivers/clk/at91/clk-usb.c
--- linux-libre-4.19.117-gnu/drivers/clk/at91/clk-usb.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/clk/at91/clk-usb.c	2020-04-23 04:30:24.000000000 -0400
@@ -78,6 +78,9 @@ static int at91sam9x5_clk_usb_determine_
 			tmp_parent_rate = req->rate * div;
 			tmp_parent_rate = clk_hw_round_rate(parent,
 							   tmp_parent_rate);
+			if (!tmp_parent_rate)
+				continue;
+
 			tmp_rate = DIV_ROUND_CLOSEST(tmp_parent_rate, div);
 			if (tmp_rate < req->rate)
 				tmp_diff = req->rate - tmp_rate;
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/clk/tegra/clk-tegra-pmc.c linux-libre-4.19.118-gnu/drivers/clk/tegra/clk-tegra-pmc.c
--- linux-libre-4.19.117-gnu/drivers/clk/tegra/clk-tegra-pmc.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/clk/tegra/clk-tegra-pmc.c	2020-04-23 04:30:24.000000000 -0400
@@ -60,16 +60,16 @@ struct pmc_clk_init_data {
 
 static DEFINE_SPINLOCK(clk_out_lock);
 
-static const char *clk_out1_parents[] = { "clk_m", "clk_m_div2",
-	"clk_m_div4", "extern1",
+static const char *clk_out1_parents[] = { "osc", "osc_div2",
+	"osc_div4", "extern1",
 };
 
-static const char *clk_out2_parents[] = { "clk_m", "clk_m_div2",
-	"clk_m_div4", "extern2",
+static const char *clk_out2_parents[] = { "osc", "osc_div2",
+	"osc_div4", "extern2",
 };
 
-static const char *clk_out3_parents[] = { "clk_m", "clk_m_div2",
-	"clk_m_div4", "extern3",
+static const char *clk_out3_parents[] = { "osc", "osc_div2",
+	"osc_div4", "extern3",
 };
 
 static struct pmc_clk_init_data pmc_clks[] = {
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/gpu/drm/amd/amdkfd/kfd_device.c linux-libre-4.19.118-gnu/drivers/gpu/drm/amd/amdkfd/kfd_device.c
--- linux-libre-4.19.117-gnu/drivers/gpu/drm/amd/amdkfd/kfd_device.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/gpu/drm/amd/amdkfd/kfd_device.c	2020-04-23 04:30:24.000000000 -0400
@@ -921,9 +921,9 @@ kfd_gtt_out:
 	return 0;
 
 kfd_gtt_no_free_chunk:
-	pr_debug("Allocation failed with mem_obj = %p\n", mem_obj);
+	pr_debug("Allocation failed with mem_obj = %p\n", *mem_obj);
 	mutex_unlock(&kfd->gtt_sa_lock);
-	kfree(mem_obj);
+	kfree(*mem_obj);
 	return -ENOMEM;
 }
 
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/gpu/drm/vc4/vc4_hdmi.c linux-libre-4.19.118-gnu/drivers/gpu/drm/vc4/vc4_hdmi.c
--- linux-libre-4.19.117-gnu/drivers/gpu/drm/vc4/vc4_hdmi.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/gpu/drm/vc4/vc4_hdmi.c	2020-04-23 04:30:24.000000000 -0400
@@ -698,11 +698,23 @@ static enum drm_mode_status
 vc4_hdmi_encoder_mode_valid(struct drm_encoder *crtc,
 			    const struct drm_display_mode *mode)
 {
-	/* HSM clock must be 108% of the pixel clock.  Additionally,
-	 * the AXI clock needs to be at least 25% of pixel clock, but
-	 * HSM ends up being the limiting factor.
+	/*
+	 * As stated in RPi's vc4 firmware "HDMI state machine (HSM) clock must
+	 * be faster than pixel clock, infinitesimally faster, tested in
+	 * simulation. Otherwise, exact value is unimportant for HDMI
+	 * operation." This conflicts with bcm2835's vc4 documentation, which
+	 * states HSM's clock has to be at least 108% of the pixel clock.
+	 *
+	 * Real life tests reveal that vc4's firmware statement holds up, and
+	 * users are able to use pixel clocks closer to HSM's, namely for
+	 * 1920x1200@60Hz. So it was decided to have leave a 1% margin between
+	 * both clocks. Which, for RPi0-3 implies a maximum pixel clock of
+	 * 162MHz.
+	 *
+	 * Additionally, the AXI clock needs to be at least 25% of
+	 * pixel clock, but HSM ends up being the limiting factor.
 	 */
-	if (mode->clock > HSM_CLOCK_FREQ / (1000 * 108 / 100))
+	if (mode->clock > HSM_CLOCK_FREQ / (1000 * 101 / 100))
 		return MODE_CLOCK_HIGH;
 
 	return MODE_OK;
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/hv/channel_mgmt.c linux-libre-4.19.118-gnu/drivers/hv/channel_mgmt.c
--- linux-libre-4.19.117-gnu/drivers/hv/channel_mgmt.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/hv/channel_mgmt.c	2020-04-23 04:30:24.000000000 -0400
@@ -849,6 +849,9 @@ void vmbus_initiate_unload(bool crash)
 {
 	struct vmbus_channel_message_header hdr;
 
+	if (xchg(&vmbus_connection.conn_state, DISCONNECTED) == DISCONNECTED)
+		return;
+
 	/* Pre-Win2012R2 hosts don't support reconnect */
 	if (vmbus_proto_version < VERSION_WIN8_1)
 		return;
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/hv/vmbus_drv.c linux-libre-4.19.118-gnu/drivers/hv/vmbus_drv.c
--- linux-libre-4.19.117-gnu/drivers/hv/vmbus_drv.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/hv/vmbus_drv.c	2020-04-23 04:30:24.000000000 -0400
@@ -43,6 +43,7 @@
 #include <linux/kdebug.h>
 #include <linux/efi.h>
 #include <linux/random.h>
+#include <linux/kernel.h>
 #include "hyperv_vmbus.h"
 
 struct vmbus_dynid {
@@ -58,14 +59,35 @@ static int hyperv_cpuhp_online;
 
 static void *hv_panic_page;
 
+/*
+ * Boolean to control whether to report panic messages over Hyper-V.
+ *
+ * It can be set via /proc/sys/kernel/hyperv/record_panic_msg
+ */
+static int sysctl_record_panic_msg = 1;
+
+static int hyperv_report_reg(void)
+{
+	return !sysctl_record_panic_msg || !hv_panic_page;
+}
+
 static int hyperv_panic_event(struct notifier_block *nb, unsigned long val,
 			      void *args)
 {
 	struct pt_regs *regs;
 
-	regs = current_pt_regs();
+	vmbus_initiate_unload(true);
 
-	hyperv_report_panic(regs, val);
+	/*
+	 * Hyper-V should be notified only once about a panic.  If we will be
+	 * doing hyperv_report_panic_msg() later with kmsg data, don't do
+	 * the notification here.
+	 */
+	if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE
+	    && hyperv_report_reg()) {
+		regs = current_pt_regs();
+		hyperv_report_panic(regs, val, false);
+	}
 	return NOTIFY_DONE;
 }
 
@@ -75,7 +97,13 @@ static int hyperv_die_event(struct notif
 	struct die_args *die = (struct die_args *)args;
 	struct pt_regs *regs = die->regs;
 
-	hyperv_report_panic(regs, val);
+	/*
+	 * Hyper-V should be notified only once about a panic.  If we will be
+	 * doing hyperv_report_panic_msg() later with kmsg data, don't do
+	 * the notification here.
+	 */
+	if (hyperv_report_reg())
+		hyperv_report_panic(regs, val, true);
 	return NOTIFY_DONE;
 }
 
@@ -1089,13 +1117,6 @@ static void vmbus_isr(void)
 }
 
 /*
- * Boolean to control whether to report panic messages over Hyper-V.
- *
- * It can be set via /proc/sys/kernel/hyperv/record_panic_msg
- */
-static int sysctl_record_panic_msg = 1;
-
-/*
  * Callback from kmsg_dump. Grab as much as possible from the end of the kmsg
  * buffer and call into Hyper-V to transfer the data.
  */
@@ -1219,19 +1240,29 @@ static int vmbus_bus_init(void)
 			hv_panic_page = (void *)get_zeroed_page(GFP_KERNEL);
 			if (hv_panic_page) {
 				ret = kmsg_dump_register(&hv_kmsg_dumper);
-				if (ret)
+				if (ret) {
 					pr_err("Hyper-V: kmsg dump register "
 						"error 0x%x\n", ret);
+					free_page(
+					    (unsigned long)hv_panic_page);
+					hv_panic_page = NULL;
+				}
 			} else
 				pr_err("Hyper-V: panic message page memory "
 					"allocation failed");
 		}
 
 		register_die_notifier(&hyperv_die_block);
-		atomic_notifier_chain_register(&panic_notifier_list,
-					       &hyperv_panic_block);
 	}
 
+	/*
+	 * Always register the panic notifier because we need to unload
+	 * the VMbus channel connection to prevent any VMbus
+	 * activity after the VM panics.
+	 */
+	atomic_notifier_chain_register(&panic_notifier_list,
+			       &hyperv_panic_block);
+
 	vmbus_request_offers();
 
 	return 0;
@@ -1243,7 +1274,6 @@ err_alloc:
 	hv_remove_vmbus_irq();
 
 	bus_unregister(&hv_bus);
-	free_page((unsigned long)hv_panic_page);
 	unregister_sysctl_table(hv_ctl_table_hdr);
 	hv_ctl_table_hdr = NULL;
 	return ret;
@@ -1875,7 +1905,6 @@ static void hv_kexec_handler(void)
 {
 	hv_synic_clockevents_cleanup();
 	vmbus_initiate_unload(false);
-	vmbus_connection.conn_state = DISCONNECTED;
 	/* Make sure conn_state is set as hv_synic_cleanup checks for it */
 	mb();
 	cpuhp_remove_state(hyperv_cpuhp_online);
@@ -1890,7 +1919,6 @@ static void hv_crash_handler(struct pt_r
 	 * doing the cleanup for current CPU only. This should be sufficient
 	 * for kdump.
 	 */
-	vmbus_connection.conn_state = DISCONNECTED;
 	hv_synic_cleanup(smp_processor_id());
 	hyperv_cleanup();
 };
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/iio/light/si1133.c linux-libre-4.19.118-gnu/drivers/iio/light/si1133.c
--- linux-libre-4.19.117-gnu/drivers/iio/light/si1133.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/iio/light/si1133.c	2020-04-23 04:30:24.000000000 -0400
@@ -102,6 +102,9 @@
 #define SI1133_INPUT_FRACTION_LOW	15
 #define SI1133_LUX_OUTPUT_FRACTION	12
 #define SI1133_LUX_BUFFER_SIZE		9
+#define SI1133_MEASURE_BUFFER_SIZE	3
+
+#define SI1133_SIGN_BIT_INDEX 23
 
 static const int si1133_scale_available[] = {
 	1, 2, 4, 8, 16, 32, 64, 128};
@@ -234,13 +237,13 @@ static const struct si1133_lux_coeff lux
 	}
 };
 
-static int si1133_calculate_polynomial_inner(u32 input, u8 fraction, u16 mag,
+static int si1133_calculate_polynomial_inner(s32 input, u8 fraction, u16 mag,
 					     s8 shift)
 {
 	return ((input << fraction) / mag) << shift;
 }
 
-static int si1133_calculate_output(u32 x, u32 y, u8 x_order, u8 y_order,
+static int si1133_calculate_output(s32 x, s32 y, u8 x_order, u8 y_order,
 				   u8 input_fraction, s8 sign,
 				   const struct si1133_coeff *coeffs)
 {
@@ -276,7 +279,7 @@ static int si1133_calculate_output(u32 x
  * The algorithm is from:
  * https://siliconlabs.github.io/Gecko_SDK_Doc/efm32zg/html/si1133_8c_source.html#l00716
  */
-static int si1133_calc_polynomial(u32 x, u32 y, u8 input_fraction, u8 num_coeff,
+static int si1133_calc_polynomial(s32 x, s32 y, u8 input_fraction, u8 num_coeff,
 				  const struct si1133_coeff *coeffs)
 {
 	u8 x_order, y_order;
@@ -614,7 +617,7 @@ static int si1133_measure(struct si1133_
 {
 	int err;
 
-	__be16 resp;
+	u8 buffer[SI1133_MEASURE_BUFFER_SIZE];
 
 	err = si1133_set_adcmux(data, 0, chan->channel);
 	if (err)
@@ -625,12 +628,13 @@ static int si1133_measure(struct si1133_
 	if (err)
 		return err;
 
-	err = si1133_bulk_read(data, SI1133_REG_HOSTOUT(0), sizeof(resp),
-			       (u8 *)&resp);
+	err = si1133_bulk_read(data, SI1133_REG_HOSTOUT(0), sizeof(buffer),
+			       buffer);
 	if (err)
 		return err;
 
-	*val = be16_to_cpu(resp);
+	*val = sign_extend32((buffer[0] << 16) | (buffer[1] << 8) | buffer[2],
+			     SI1133_SIGN_BIT_INDEX);
 
 	return err;
 }
@@ -704,9 +708,9 @@ static int si1133_get_lux(struct si1133_
 {
 	int err;
 	int lux;
-	u32 high_vis;
-	u32 low_vis;
-	u32 ir;
+	s32 high_vis;
+	s32 low_vis;
+	s32 ir;
 	u8 buffer[SI1133_LUX_BUFFER_SIZE];
 
 	/* Activate lux channels */
@@ -719,9 +723,16 @@ static int si1133_get_lux(struct si1133_
 	if (err)
 		return err;
 
-	high_vis = (buffer[0] << 16) | (buffer[1] << 8) | buffer[2];
-	low_vis = (buffer[3] << 16) | (buffer[4] << 8) | buffer[5];
-	ir = (buffer[6] << 16) | (buffer[7] << 8) | buffer[8];
+	high_vis =
+		sign_extend32((buffer[0] << 16) | (buffer[1] << 8) | buffer[2],
+			      SI1133_SIGN_BIT_INDEX);
+
+	low_vis =
+		sign_extend32((buffer[3] << 16) | (buffer[4] << 8) | buffer[5],
+			      SI1133_SIGN_BIT_INDEX);
+
+	ir = sign_extend32((buffer[6] << 16) | (buffer[7] << 8) | buffer[8],
+			   SI1133_SIGN_BIT_INDEX);
 
 	if (high_vis > SI1133_ADC_THRESHOLD || ir > SI1133_ADC_THRESHOLD)
 		lux = si1133_calc_polynomial(high_vis, ir,
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/iommu/amd_iommu_types.h linux-libre-4.19.118-gnu/drivers/iommu/amd_iommu_types.h
--- linux-libre-4.19.117-gnu/drivers/iommu/amd_iommu_types.h	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/iommu/amd_iommu_types.h	2020-04-23 04:30:24.000000000 -0400
@@ -352,7 +352,7 @@
 
 #define DTE_GCR3_VAL_A(x)	(((x) >> 12) & 0x00007ULL)
 #define DTE_GCR3_VAL_B(x)	(((x) >> 15) & 0x0ffffULL)
-#define DTE_GCR3_VAL_C(x)	(((x) >> 31) & 0xfffffULL)
+#define DTE_GCR3_VAL_C(x)	(((x) >> 31) & 0x1fffffULL)
 
 #define DTE_GCR3_INDEX_A	0
 #define DTE_GCR3_INDEX_B	1
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/iommu/intel-svm.c linux-libre-4.19.118-gnu/drivers/iommu/intel-svm.c
--- linux-libre-4.19.117-gnu/drivers/iommu/intel-svm.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/iommu/intel-svm.c	2020-04-23 04:30:24.000000000 -0400
@@ -620,14 +620,15 @@ static irqreturn_t prq_event_thread(int
 		 * any faults on kernel addresses. */
 		if (!svm->mm)
 			goto bad_req;
-		/* If the mm is already defunct, don't handle faults. */
-		if (!mmget_not_zero(svm->mm))
-			goto bad_req;
 
 		/* If address is not canonical, return invalid response */
 		if (!is_canonical_address(address))
 			goto bad_req;
 
+		/* If the mm is already defunct, don't handle faults. */
+		if (!mmget_not_zero(svm->mm))
+			goto bad_req;
+
 		down_read(&svm->mm->mmap_sem);
 		vma = find_extend_vma(svm->mm, address);
 		if (!vma || address < vma->vm_start)
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/irqchip/irq-mbigen.c linux-libre-4.19.118-gnu/drivers/irqchip/irq-mbigen.c
--- linux-libre-4.19.117-gnu/drivers/irqchip/irq-mbigen.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/irqchip/irq-mbigen.c	2020-04-23 04:30:24.000000000 -0400
@@ -231,10 +231,16 @@ static int mbigen_irq_domain_alloc(struc
 	return 0;
 }
 
+static void mbigen_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+				   unsigned int nr_irqs)
+{
+	platform_msi_domain_free(domain, virq, nr_irqs);
+}
+
 static const struct irq_domain_ops mbigen_domain_ops = {
 	.translate	= mbigen_domain_translate,
 	.alloc		= mbigen_irq_domain_alloc,
-	.free		= irq_domain_free_irqs_common,
+	.free		= mbigen_irq_domain_free,
 };
 
 static int mbigen_of_create_domain(struct platform_device *pdev,
diff -druNp --no-dereference linux-libre-4.19.117-gnu/drivers/mtd/devices/phram.c linux-libre-4.19.118-gnu/drivers/mtd/devices/phram.c
--- linux-libre-4.19.117-gnu/drivers/mtd/devices/phram.c	2020-04-21 03:03:13.000000000 -0400
+++ linux-libre-4.19.118-gnu/drivers/mtd/devices/phram.c	2020-04-23 04:30:24.000000000 -0400
@@ -240,22 +240,25 @@ static int phram_setup(const char *val)
 
 	ret = parse_num64(&start, token