[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Mike Pagano]

commit:     1bb602ad6adb38293ba3d45967d7d636fdd71698
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Dec  5 11:37:39 2017 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Dec  5 11:37:39 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1bb602ad

Linux patch 4.14.4

 0000_README             |    4 +
 1003_linux-4.14.4.patch | 3494 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 3498 insertions(+)

diff --git a/0000_README b/0000_README
index 9aaf65a..3b5d05b 100644
--- a/0000_README
+++ b/0000_README
@@ -55,6 +55,10 @@ Patch:  1002_linux-4.14.3.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.3
 
+Patch:  1003_linux-4.14.4.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.4
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1003_linux-4.14.4.patch b/1003_linux-4.14.4.patch
new file mode 100644
index 0000000..c43b800
--- /dev/null
+++ b/1003_linux-4.14.4.patch
@@ -0,0 +1,3494 @@
+diff --git a/Documentation/devicetree/bindings/hwmon/jc42.txt b/Documentation/devicetree/bindings/hwmon/jc42.txt
+index 07a250498fbb..f569db58f64a 100644
+--- a/Documentation/devicetree/bindings/hwmon/jc42.txt
++++ b/Documentation/devicetree/bindings/hwmon/jc42.txt
+@@ -34,6 +34,10 @@ Required properties:
+ 
+ - reg: I2C address
+ 
++Optional properties:
++- smbus-timeout-disable: When set, the smbus timeout function will be disabled.
++			 This is not supported on all chips.
++
+ Example:
+ 
+ temp-sensor@1a {
+diff --git a/Makefile b/Makefile
+index ede4de0d8634..ba1648c093fe 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index 939b310913cf..3eb4397150df 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -77,9 +77,6 @@ endif
+ 
+ ifeq ($(CONFIG_ARM64_MODULE_PLTS),y)
+ KBUILD_LDFLAGS_MODULE	+= -T $(srctree)/arch/arm64/kernel/module.lds
+-ifeq ($(CONFIG_DYNAMIC_FTRACE),y)
+-KBUILD_LDFLAGS_MODULE	+= $(objtree)/arch/arm64/kernel/ftrace-mod.o
+-endif
+ endif
+ 
+ # Default value
+diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h
+index 19bd97671bb8..4f766178fa6f 100644
+--- a/arch/arm64/include/asm/module.h
++++ b/arch/arm64/include/asm/module.h
+@@ -32,7 +32,7 @@ struct mod_arch_specific {
+ 	struct mod_plt_sec	init;
+ 
+ 	/* for CONFIG_DYNAMIC_FTRACE */
+-	void			*ftrace_trampoline;
++	struct plt_entry 	*ftrace_trampoline;
+ };
+ #endif
+ 
+@@ -45,4 +45,48 @@ extern u64 module_alloc_base;
+ #define module_alloc_base	((u64)_etext - MODULES_VSIZE)
+ #endif
+ 
++struct plt_entry {
++	/*
++	 * A program that conforms to the AArch64 Procedure Call Standard
++	 * (AAPCS64) must assume that a veneer that alters IP0 (x16) and/or
++	 * IP1 (x17) may be inserted at any branch instruction that is
++	 * exposed to a relocation that supports long branches. Since that
++	 * is exactly what we are dealing with here, we are free to use x16
++	 * as a scratch register in the PLT veneers.
++	 */
++	__le32	mov0;	/* movn	x16, #0x....			*/
++	__le32	mov1;	/* movk	x16, #0x...., lsl #16		*/
++	__le32	mov2;	/* movk	x16, #0x...., lsl #32		*/
++	__le32	br;	/* br	x16				*/
++};
++
++static inline struct plt_entry get_plt_entry(u64 val)
++{
++	/*
++	 * MOVK/MOVN/MOVZ opcode:
++	 * +--------+------------+--------+-----------+-------------+---------+
++	 * | sf[31] | opc[30:29] | 100101 | hw[22:21] | imm16[20:5] | Rd[4:0] |
++	 * +--------+------------+--------+-----------+-------------+---------+
++	 *
++	 * Rd     := 0x10 (x16)
++	 * hw     := 0b00 (no shift), 0b01 (lsl #16), 0b10 (lsl #32)
++	 * opc    := 0b11 (MOVK), 0b00 (MOVN), 0b10 (MOVZ)
++	 * sf     := 1 (64-bit variant)
++	 */
++	return (struct plt_entry){
++		cpu_to_le32(0x92800010 | (((~val      ) & 0xffff)) << 5),
++		cpu_to_le32(0xf2a00010 | ((( val >> 16) & 0xffff)) << 5),
++		cpu_to_le32(0xf2c00010 | ((( val >> 32) & 0xffff)) << 5),
++		cpu_to_le32(0xd61f0200)
++	};
++}
++
++static inline bool plt_entries_equal(const struct plt_entry *a,
++				     const struct plt_entry *b)
++{
++	return a->mov0 == b->mov0 &&
++	       a->mov1 == b->mov1 &&
++	       a->mov2 == b->mov2;
++}
++
+ #endif /* __ASM_MODULE_H */
+diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
+index 0029e13adb59..2f5ff2a65db3 100644
+--- a/arch/arm64/kernel/Makefile
++++ b/arch/arm64/kernel/Makefile
+@@ -63,6 +63,3 @@ extra-y					+= $(head-y) vmlinux.lds
+ ifeq ($(CONFIG_DEBUG_EFI),y)
+ AFLAGS_head.o += -DVMLINUX_PATH="\"$(realpath $(objtree)/vmlinux)\""
+ endif
+-
+-# will be included by each individual module but not by the core kernel itself
+-extra-$(CONFIG_DYNAMIC_FTRACE) += ftrace-mod.o
+diff --git a/arch/arm64/kernel/ftrace-mod.S b/arch/arm64/kernel/ftrace-mod.S
+deleted file mode 100644
+index 00c4025be4ff..000000000000
+--- a/arch/arm64/kernel/ftrace-mod.S
++++ /dev/null
+@@ -1,18 +0,0 @@
+-/*
+- * Copyright (C) 2017 Linaro Ltd <ard.biesheuvel@××××××.org>
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
+- */
+-
+-#include <linux/linkage.h>
+-#include <asm/assembler.h>
+-
+-	.section	".text.ftrace_trampoline", "ax"
+-	.align		3
+-0:	.quad		0
+-__ftrace_trampoline:
+-	ldr		x16, 0b
+-	br		x16
+-ENDPROC(__ftrace_trampoline)
+diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
+index c13b1fca0e5b..50986e388d2b 100644
+--- a/arch/arm64/kernel/ftrace.c
++++ b/arch/arm64/kernel/ftrace.c
+@@ -76,7 +76,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+ 
+ 	if (offset < -SZ_128M || offset >= SZ_128M) {
+ #ifdef CONFIG_ARM64_MODULE_PLTS
+-		unsigned long *trampoline;
++		struct plt_entry trampoline;
+ 		struct module *mod;
+ 
+ 		/*
+@@ -104,22 +104,24 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+ 		 * is added in the future, but for now, the pr_err() below
+ 		 * deals with a theoretical issue only.
+ 		 */
+-		trampoline = (unsigned long *)mod->arch.ftrace_trampoline;
+-		if (trampoline[0] != addr) {
+-			if (trampoline[0] != 0) {
++		trampoline = get_plt_entry(addr);
++		if (!plt_entries_equal(mod->arch.ftrace_trampoline,
++				       &trampoline)) {
++			if (!plt_entries_equal(mod->arch.ftrace_trampoline,
++					       &(struct plt_entry){})) {
+ 				pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n");
+ 				return -EINVAL;
+ 			}
+ 
+ 			/* point the trampoline to our ftrace entry point */
+ 			module_disable_ro(mod);
+-			trampoline[0] = addr;
++			*mod->arch.ftrace_trampoline = trampoline;
+ 			module_enable_ro(mod, true);
+ 
+ 			/* update trampoline before patching in the branch */
+ 			smp_wmb();
+ 		}
+-		addr = (unsigned long)&trampoline[1];
++		addr = (unsigned long)(void *)mod->arch.ftrace_trampoline;
+ #else /* CONFIG_ARM64_MODULE_PLTS */
+ 		return -EINVAL;
+ #endif /* CONFIG_ARM64_MODULE_PLTS */
+diff --git a/arch/arm64/kernel/module-plts.c b/arch/arm64/kernel/module-plts.c
+index d05dbe658409..ea640f92fe5a 100644
+--- a/arch/arm64/kernel/module-plts.c
++++ b/arch/arm64/kernel/module-plts.c
+@@ -11,21 +11,6 @@
+ #include <linux/module.h>
+ #include <linux/sort.h>
+ 
+-struct plt_entry {
+-	/*
+-	 * A program that conforms to the AArch64 Procedure Call Standard
+-	 * (AAPCS64) must assume that a veneer that alters IP0 (x16) and/or
+-	 * IP1 (x17) may be inserted at any branch instruction that is
+-	 * exposed to a relocation that supports long branches. Since that
+-	 * is exactly what we are dealing with here, we are free to use x16
+-	 * as a scratch register in the PLT veneers.
+-	 */
+-	__le32	mov0;	/* movn	x16, #0x....			*/
+-	__le32	mov1;	/* movk	x16, #0x...., lsl #16		*/
+-	__le32	mov2;	/* movk	x16, #0x...., lsl #32		*/
+-	__le32	br;	/* br	x16				*/
+-};
+-
+ static bool in_init(const struct module *mod, void *loc)
+ {
+ 	return (u64)loc - (u64)mod->init_layout.base < mod->init_layout.size;
+@@ -40,33 +25,14 @@ u64 module_emit_plt_entry(struct module *mod, void *loc, const Elf64_Rela *rela,
+ 	int i = pltsec->plt_num_entries;
+ 	u64 val = sym->st_value + rela->r_addend;
+ 
+-	/*
+-	 * MOVK/MOVN/MOVZ opcode:
+-	 * +--------+------------+--------+-----------+-------------+---------+
+-	 * | sf[31] | opc[30:29] | 100101 | hw[22:21] | imm16[20:5] | Rd[4:0] |
+-	 * +--------+------------+--------+-----------+-------------+---------+
+-	 *
+-	 * Rd     := 0x10 (x16)
+-	 * hw     := 0b00 (no shift), 0b01 (lsl #16), 0b10 (lsl #32)
+-	 * opc    := 0b11 (MOVK), 0b00 (MOVN), 0b10 (MOVZ)
+-	 * sf     := 1 (64-bit variant)
+-	 */
+-	plt[i] = (struct plt_entry){
+-		cpu_to_le32(0x92800010 | (((~val      ) & 0xffff)) << 5),
+-		cpu_to_le32(0xf2a00010 | ((( val >> 16) & 0xffff)) << 5),
+-		cpu_to_le32(0xf2c00010 | ((( val >> 32) & 0xffff)) << 5),
+-		cpu_to_le32(0xd61f0200)
+-	};
++	plt[i] = get_plt_entry(val);
+ 
+ 	/*
+ 	 * Check if the entry we just created is a duplicate. Given that the
+ 	 * relocations are sorted, this will be the last entry we allocated.
+ 	 * (if one exists).
+ 	 */
+-	if (i > 0 &&
+-	    plt[i].mov0 == plt[i - 1].mov0 &&
+-	    plt[i].mov1 == plt[i - 1].mov1 &&
+-	    plt[i].mov2 == plt[i - 1].mov2)
++	if (i > 0 && plt_entries_equal(plt + i, plt + i - 1))
+ 		return (u64)&plt[i - 1];
+ 
+ 	pltsec->plt_num_entries++;
+@@ -154,6 +120,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
+ 	unsigned long core_plts = 0;
+ 	unsigned long init_plts = 0;
+ 	Elf64_Sym *syms = NULL;
++	Elf_Shdr *tramp = NULL;
+ 	int i;
+ 
+ 	/*
+@@ -165,6 +132,10 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
+ 			mod->arch.core.plt = sechdrs + i;
+ 		else if (!strcmp(secstrings + sechdrs[i].sh_name, ".init.plt"))
+ 			mod->arch.init.plt = sechdrs + i;
++		else if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) &&
++			 !strcmp(secstrings + sechdrs[i].sh_name,
++				 ".text.ftrace_trampoline"))
++			tramp = sechdrs + i;
+ 		else if (sechdrs[i].sh_type == SHT_SYMTAB)
+ 			syms = (Elf64_Sym *)sechdrs[i].sh_addr;
+ 	}
+@@ -215,5 +186,12 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
+ 	mod->arch.init.plt_num_entries = 0;
+ 	mod->arch.init.plt_max_entries = init_plts;
+ 
++	if (tramp) {
++		tramp->sh_type = SHT_NOBITS;
++		tramp->sh_flags = SHF_EXECINSTR | SHF_ALLOC;
++		tramp->sh_addralign = __alignof__(struct plt_entry);
++		tramp->sh_size = sizeof(struct plt_entry);
++	}
++
+ 	return 0;
+ }
+diff --git a/arch/arm64/kernel/module.lds b/arch/arm64/kernel/module.lds
+index f7c9781a9d48..22e36a21c113 100644
+--- a/arch/arm64/kernel/module.lds
++++ b/arch/arm64/kernel/module.lds
+@@ -1,4 +1,5 @@
+ SECTIONS {
+ 	.plt (NOLOAD) : { BYTE(0) }
+ 	.init.plt (NOLOAD) : { BYTE(0) }
++	.text.ftrace_trampoline (NOLOAD) : { BYTE(0) }
+ }
+diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
+index 8ac0bd2bddb0..3280953a82cf 100644
+--- a/arch/powerpc/kernel/misc_64.S
++++ b/arch/powerpc/kernel/misc_64.S
+@@ -623,7 +623,9 @@ BEGIN_FTR_SECTION
+ 	 * NOTE, we rely on r0 being 0 from above.
+ 	 */
+ 	mtspr	SPRN_IAMR,r0
++BEGIN_FTR_SECTION_NESTED(42)
+ 	mtspr	SPRN_AMOR,r0
++END_FTR_SECTION_NESTED_IFSET(CPU_FTR_HVMODE, 42)
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+ 
+ 	/* save regs for local vars on new stack.
+diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
+index 3848af167df9..640cf566e986 100644
+--- a/arch/powerpc/mm/hash_native_64.c
++++ b/arch/powerpc/mm/hash_native_64.c
+@@ -47,7 +47,8 @@
+ 
+ DEFINE_RAW_SPINLOCK(native_tlbie_lock);
+ 
+-static inline void __tlbie(unsigned long vpn, int psize, int apsize, int ssize)
++static inline unsigned long  ___tlbie(unsigned long vpn, int psize,
++						int apsize, int ssize)
+ {
+ 	unsigned long va;
+ 	unsigned int penc;
+@@ -100,7 +101,15 @@ static inline void __tlbie(unsigned long vpn, int psize, int apsize, int ssize)
+ 			     : "memory");
+ 		break;
+ 	}
+-	trace_tlbie(0, 0, va, 0, 0, 0, 0);
++	return va;
++}
++
++static inline void __tlbie(unsigned long vpn, int psize, int apsize, int ssize)
++{
++	unsigned long rb;
++
++	rb = ___tlbie(vpn, psize, apsize, ssize);
++	trace_tlbie(0, 0, rb, 0, 0, 0, 0);
+ }
+ 
+ static inline void __tlbiel(unsigned long vpn, int psize, int apsize, int ssize)
+@@ -652,7 +661,7 @@ static void native_hpte_clear(void)
+ 		if (hpte_v & HPTE_V_VALID) {
+ 			hpte_decode(hptep, slot, &psize, &apsize, &ssize, &vpn);
+ 			hptep->v = 0;
+-			__tlbie(vpn, psize, apsize, ssize);
++			___tlbie(vpn, psize, apsize, ssize);
+ 		}
+ 	}
+ 
+diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
+index 9a3cb3983c01..1a61b1b997f2 100644
+--- a/arch/s390/include/asm/elf.h
++++ b/arch/s390/include/asm/elf.h
+@@ -194,13 +194,14 @@ struct arch_elf_state {
+ #define CORE_DUMP_USE_REGSET
+ #define ELF_EXEC_PAGESIZE	PAGE_SIZE
+ 
+-/*
+- * This is the base location for PIE (ET_DYN with INTERP) loads. On
+- * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+- * space open for things that want to use the area for 32-bit pointers.
+- */
+-#define ELF_ET_DYN_BASE		(is_compat_task() ? 0x000400000UL : \
+-						    0x100000000UL)
++/* This is the location that an ET_DYN program is loaded if exec'ed.  Typical
++   use of this is to invoke "./ld.so someprog" to test out a new version of
++   the loader.  We need to make sure that it is out of the way of the program
++   that it will "exec", and that there is sufficient room for the brk. 64-bit
++   tasks are aligned to 4GB. */
++#define ELF_ET_DYN_BASE (is_compat_task() ? \
++				(STACK_TOP / 3 * 2) : \
++				(STACK_TOP / 3 * 2) & ~((1UL << 32) - 1))
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports. */
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index 518d9286b3d1..2e956afe272c 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -51,19 +51,15 @@ ENTRY(native_usergs_sysret64)
+ END(native_usergs_sysret64)
+ #endif /* CONFIG_PARAVIRT */
+ 
+-.macro TRACE_IRQS_FLAGS flags:req
++.macro TRACE_IRQS_IRETQ
+ #ifdef CONFIG_TRACE_IRQFLAGS
+-	bt	$9, \flags		/* interrupts off? */
++	bt	$9, EFLAGS(%rsp)		/* interrupts off? */
+ 	jnc	1f
+ 	TRACE_IRQS_ON
+ 1:
+ #endif
+ .endm
+ 
+-.macro TRACE_IRQS_IRETQ
+-	TRACE_IRQS_FLAGS EFLAGS(%rsp)
+-.endm
+-
+ /*
+  * When dynamic function tracer is enabled it will add a breakpoint
+  * to all locations that it is about to modify, sync CPUs, update
+@@ -927,13 +923,11 @@ ENTRY(native_load_gs_index)
+ 	FRAME_BEGIN
+ 	pushfq
+ 	DISABLE_INTERRUPTS(CLBR_ANY & ~CLBR_RDI)
+-	TRACE_IRQS_OFF
+ 	SWAPGS
+ .Lgs_change:
+ 	movl	%edi, %gs
+ 2:	ALTERNATIVE "", "mfence", X86_BUG_SWAPGS_FENCE
+ 	SWAPGS
+-	TRACE_IRQS_FLAGS (%rsp)
+ 	popfq
+ 	FRAME_END
+ 	ret
+diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
+index f735c3016325..f02de8bc1f72 100644
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -1093,6 +1093,12 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm,
+ 	clear_bit(_PAGE_BIT_RW, (unsigned long *)pmdp);
+ }
+ 
++#define pud_write pud_write
++static inline int pud_write(pud_t pud)
++{
++	return pud_flags(pud) & _PAGE_RW;
++}
++
+ /*
+  * clone_pgd_range(pgd_t *dst, pgd_t *src, int count);
+  *
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 36c90d631096..ef03efba1c23 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -266,9 +266,14 @@ static inline void kvm_apic_set_ldr(struct kvm_lapic *apic, u32 id)
+ 	recalculate_apic_map(apic->vcpu->kvm);
+ }
+ 
++static inline u32 kvm_apic_calc_x2apic_ldr(u32 id)
++{
++	return ((id >> 4) << 16) | (1 << (id & 0xf));
++}
++
+ static inline void kvm_apic_set_x2apic_id(struct kvm_lapic *apic, u32 id)
+ {
+-	u32 ldr = ((id >> 4) << 16) | (1 << (id & 0xf));
++	u32 ldr = kvm_apic_calc_x2apic_ldr(id);
+ 
+ 	WARN_ON_ONCE(id != apic->vcpu->vcpu_id);
+ 
+@@ -2196,6 +2201,7 @@ static int kvm_apic_state_fixup(struct kvm_vcpu *vcpu,
+ {
+ 	if (apic_x2apic_mode(vcpu->arch.apic)) {
+ 		u32 *id = (u32 *)(s->regs + APIC_ID);
++		u32 *ldr = (u32 *)(s->regs + APIC_LDR);
+ 
+ 		if (vcpu->kvm->arch.x2apic_format) {
+ 			if (*id != vcpu->vcpu_id)
+@@ -2206,6 +2212,10 @@ static int kvm_apic_state_fixup(struct kvm_vcpu *vcpu,
+ 			else
+ 				*id <<= 24;
+ 		}
++
++		/* In x2APIC mode, the LDR is fixed and based on the id */
++		if (set)
++			*ldr = kvm_apic_calc_x2apic_ldr(*id);
+ 	}
+ 
+ 	return 0;
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index ca209a4a7834..17fb6c6d939a 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -2189,6 +2189,8 @@ static int ud_interception(struct vcpu_svm *svm)
+ 	int er;
+ 
+ 	er = emulate_instruction(&svm->vcpu, EMULTYPE_TRAP_UD);
++	if (er == EMULATE_USER_EXIT)
++		return 0;
+ 	if (er != EMULATE_DONE)
+ 		kvm_queue_exception(&svm->vcpu, UD_VECTOR);
+ 	return 1;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 21cad7068cbf..b21113bcf227 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -5914,6 +5914,8 @@ static int handle_exception(struct kvm_vcpu *vcpu)
+ 			return 1;
+ 		}
+ 		er = emulate_instruction(vcpu, EMULTYPE_TRAP_UD);
++		if (er == EMULATE_USER_EXIT)
++			return 0;
+ 		if (er != EMULATE_DONE)
+ 			kvm_queue_exception(vcpu, UD_VECTOR);
+ 		return 1;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 03869eb7fcd6..4195cbcdb310 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1830,6 +1830,9 @@ static void kvm_setup_pvclock_page(struct kvm_vcpu *v)
+ 	 */
+ 	BUILD_BUG_ON(offsetof(struct pvclock_vcpu_time_info, version) != 0);
+ 
++	if (guest_hv_clock.version & 1)
++		++guest_hv_clock.version;  /* first time write, random junk */
++
+ 	vcpu->hv_clock.version = guest_hv_clock.version + 1;
+ 	kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
+ 				&vcpu->hv_clock,
+@@ -5705,6 +5708,8 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
+ 			if (reexecute_instruction(vcpu, cr2, write_fault_to_spt,
+ 						emulation_type))
+ 				return EMULATE_DONE;
++			if (ctxt->have_exception && inject_emulated_exception(vcpu))
++				return EMULATE_DONE;
+ 			if (emulation_type & EMULTYPE_SKIP)
+ 				return EMULATE_FAIL;
+ 			return handle_emulation_failure(vcpu);
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index 337cf382718e..a72659f452a5 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -1047,6 +1047,18 @@ ssize_t af_alg_sendpage(struct socket *sock, struct page *page,
+ }
+ EXPORT_SYMBOL_GPL(af_alg_sendpage);
+ 
++/**
++ * af_alg_free_resources - release resources required for crypto request
++ */
++void af_alg_free_resources(struct af_alg_async_req *areq)
++{
++	struct sock *sk = areq->sk;
++
++	af_alg_free_areq_sgls(areq);
++	sock_kfree_s(sk, areq, areq->areqlen);
++}
++EXPORT_SYMBOL_GPL(af_alg_free_resources);
++
+ /**
+  * af_alg_async_cb - AIO callback handler
+  *
+@@ -1063,18 +1075,13 @@ void af_alg_async_cb(struct crypto_async_request *_req, int err)
+ 	struct kiocb *iocb = areq->iocb;
+ 	unsigned int resultlen;
+ 
+-	lock_sock(sk);
+-
+ 	/* Buffer size written by crypto operation. */
+ 	resultlen = areq->outlen;
+ 
+-	af_alg_free_areq_sgls(areq);
+-	sock_kfree_s(sk, areq, areq->areqlen);
+-	__sock_put(sk);
++	af_alg_free_resources(areq);
++	sock_put(sk);
+ 
+ 	iocb->ki_complete(iocb, err ? err : resultlen, 0);
+-
+-	release_sock(sk);
+ }
+ EXPORT_SYMBOL_GPL(af_alg_async_cb);
+ 
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index 516b38c3a169..d0b45145cb30 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -101,10 +101,10 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
+ 	struct aead_tfm *aeadc = pask->private;
+ 	struct crypto_aead *tfm = aeadc->aead;
+ 	struct crypto_skcipher *null_tfm = aeadc->null_tfm;
+-	unsigned int as = crypto_aead_authsize(tfm);
++	unsigned int i, as = crypto_aead_authsize(tfm);
+ 	struct af_alg_async_req *areq;
+-	struct af_alg_tsgl *tsgl;
+-	struct scatterlist *src;
++	struct af_alg_tsgl *tsgl, *tmp;
++	struct scatterlist *rsgl_src, *tsgl_src = NULL;
+ 	int err = 0;
+ 	size_t used = 0;		/* [in]  TX bufs to be en/decrypted */
+ 	size_t outlen = 0;		/* [out] RX bufs produced by kernel */
+@@ -178,7 +178,22 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
+ 	}
+ 
+ 	processed = used + ctx->aead_assoclen;
+-	tsgl = list_first_entry(&ctx->tsgl_list, struct af_alg_tsgl, list);
++	list_for_each_entry_safe(tsgl, tmp, &ctx->tsgl_list, list) {
++		for (i = 0; i < tsgl->cur; i++) {
++			struct scatterlist *process_sg = tsgl->sg + i;
++
++			if (!(process_sg->length) || !sg_page(process_sg))
++				continue;
++			tsgl_src = process_sg;
++			break;
++		}
++		if (tsgl_src)
++			break;
++	}
++	if (processed && !tsgl_src) {
++		err = -EFAULT;
++		goto free;
++	}
+ 
+ 	/*
+ 	 * Copy of AAD from source to destination
+@@ -194,7 +209,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
+ 	 */
+ 
+ 	/* Use the RX SGL as source (and destination) for crypto op. */
+-	src = areq->first_rsgl.sgl.sg;
++	rsgl_src = areq->first_rsgl.sgl.sg;
+ 
+ 	if (ctx->enc) {
+ 		/*
+@@ -207,7 +222,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
+ 		 *	    v	   v
+ 		 * RX SGL: AAD || PT || Tag
+ 		 */
+-		err = crypto_aead_copy_sgl(null_tfm, tsgl->sg,
++		err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
+ 					   areq->first_rsgl.sgl.sg, processed);
+ 		if (err)
+ 			goto free;
+@@ -225,7 +240,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
+ 		 */
+ 
+ 		 /* Copy AAD || CT to RX SGL buffer for in-place operation. */
+-		err = crypto_aead_copy_sgl(null_tfm, tsgl->sg,
++		err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
+ 					   areq->first_rsgl.sgl.sg, outlen);
+ 		if (err)
+ 			goto free;
+@@ -257,23 +272,34 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
+ 				 areq->tsgl);
+ 		} else
+ 			/* no RX SGL present (e.g. authentication only) */
+-			src = areq->tsgl;
++			rsgl_src = areq->tsgl;
+ 	}
+ 
+ 	/* Initialize the crypto operation */
+-	aead_request_set_crypt(&areq->cra_u.aead_req, src,
++	aead_request_set_crypt(&areq->cra_u.aead_req, rsgl_src,
+ 			       areq->first_rsgl.sgl.sg, used, ctx->iv);
+ 	aead_request_set_ad(&areq->cra_u.aead_req, ctx->aead_assoclen);
+ 	aead_request_set_tfm(&areq->cra_u.aead_req, tfm);
+ 
+ 	if (msg->msg_iocb && !is_sync_kiocb(msg->msg_iocb)) {
+ 		/* AIO operation */
++		sock_hold(sk);
+ 		areq->iocb = msg->msg_iocb;
+ 		aead_request_set_callback(&areq->cra_u.aead_req,
+ 					  CRYPTO_TFM_REQ_MAY_BACKLOG,
+ 					  af_alg_async_cb, areq);
+ 		err = ctx->enc ? crypto_aead_encrypt(&areq->cra_u.aead_req) :
+ 				 crypto_aead_decrypt(&areq->cra_u.aead_req);
++
++		/* AIO operation in progress */
++		if (err == -EINPROGRESS || err == -EBUSY) {
++			/* Remember output size that will be generated. */
++			areq->outlen = outlen;
++
++			return -EIOCBQUEUED;
++		}
++
++		sock_put(sk);
+ 	} else {
+ 		/* Synchronous operation */
+ 		aead_request_set_callback(&areq->cra_u.aead_req,
+@@ -285,19 +311,9 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
+ 						 &ctx->completion);
+ 	}
+ 
+-	/* AIO operation in progress */
+-	if (err == -EINPROGRESS) {
+-		sock_hold(sk);
+-
+-		/* Remember output size that will be generated. */
+-		areq->outlen = outlen;
+-
+-		return -EIOCBQUEUED;
+-	}
+ 
+ free:
+-	af_alg_free_areq_sgls(areq);
+-	sock_kfree_s(sk, areq, areq->areqlen);
++	af_alg_free_resources(areq);
+ 
+ 	return err ? err : outlen;
+ }
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index 8ae4170aaeb4..30ee2a8e8f42 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -117,6 +117,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
+ 
+ 	if (msg->msg_iocb && !is_sync_kiocb(msg->msg_iocb)) {
+ 		/* AIO operation */
++		sock_hold(sk);
+ 		areq->iocb = msg->msg_iocb;
+ 		skcipher_request_set_callback(&areq->cra_u.skcipher_req,
+ 					      CRYPTO_TFM_REQ_MAY_SLEEP,
+@@ -124,6 +125,16 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
+ 		err = ctx->enc ?
+ 			crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) :
+ 			crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
++
++		/* AIO operation in progress */
++		if (err == -EINPROGRESS || err == -EBUSY) {
++			/* Remember output size that will be generated. */
++			areq->outlen = len;
++
++			return -EIOCBQUEUED;
++		}
++
++		sock_put(sk);
+ 	} else {
+ 		/* Synchronous operation */
+ 		skcipher_request_set_callback(&areq->cra_u.skcipher_req,
+@@ -137,19 +148,9 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
+ 						 &ctx->completion);
+ 	}
+ 
+-	/* AIO operation in progress */
+-	if (err == -EINPROGRESS) {
+-		sock_hold(sk);
+-
+-		/* Remember output size that will be generated. */
+-		areq->outlen = len;
+-
+-		return -EIOCBQUEUED;
+-	}
+ 
+ free:
+-	af_alg_free_areq_sgls(areq);
+-	sock_kfree_s(sk, areq, areq->areqlen);
++	af_alg_free_resources(areq);
+ 
+ 	return err ? err : len;
+ }
+diff --git a/crypto/skcipher.c b/crypto/skcipher.c
+index d5692e35fab1..778e0ff42bfa 100644
+--- a/crypto/skcipher.c
++++ b/crypto/skcipher.c
+@@ -522,6 +522,9 @@ static int skcipher_walk_aead_common(struct skcipher_walk *walk,
+ 	scatterwalk_copychunks(NULL, &walk->in, req->assoclen, 2);
+ 	scatterwalk_copychunks(NULL, &walk->out, req->assoclen, 2);
+ 
++	scatterwalk_done(&walk->in, 0, walk->total);
++	scatterwalk_done(&walk->out, 0, walk->total);
++
+ 	walk->iv = req->iv;
+ 	walk->oiv = req->iv;
+ 
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 82b3ce5e937e..df842465634a 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1597,32 +1597,41 @@ static int acpi_ec_add(struct acpi_device *device)
+ {
+ 	struct acpi_ec *ec = NULL;
+ 	int ret;
++	bool is_ecdt = false;
++	acpi_status status;
+ 
+ 	strcpy(acpi_device_name(device), ACPI_EC_DEVICE_NAME);
+ 	strcpy(acpi_device_class(device), ACPI_EC_CLASS);
+ 
+-	ec = acpi_ec_alloc();
+-	if (!ec)
+-		return -ENOMEM;
+-	if (ec_parse_device(device->handle, 0, ec, NULL) !=
+-		AE_CTRL_TERMINATE) {
++	if (!strcmp(acpi_device_hid(device), ACPI_ECDT_HID)) {
++		is_ecdt = true;
++		ec = boot_ec;
++	} else {
++		ec = acpi_ec_alloc();
++		if (!ec)
++			return -ENOMEM;
++		status = ec_parse_device(device->handle, 0, ec, NULL);
++		if (status != AE_CTRL_TERMINATE) {
+ 			ret = -EINVAL;
+ 			goto err_alloc;
++		}
+ 	}
+ 
+ 	if (acpi_is_boot_ec(ec)) {
+-		boot_ec_is_ecdt = false;
+-		/*
+-		 * Trust PNP0C09 namespace location rather than ECDT ID.
+-		 *
+-		 * But trust ECDT GPE rather than _GPE because of ASUS quirks,
+-		 * so do not change boot_ec->gpe to ec->gpe.
+-		 */
+-		boot_ec->handle = ec->handle;
+-		acpi_handle_debug(ec->handle, "duplicated.\n");
+-		acpi_ec_free(ec);
+-		ec = boot_ec;
+-		ret = acpi_config_boot_ec(ec, ec->handle, true, false);
++		boot_ec_is_ecdt = is_ecdt;
++		if (!is_ecdt) {
++			/*
++			 * Trust PNP0C09 namespace location rather than
++			 * ECDT ID. But trust ECDT GPE rather than _GPE
++			 * because of ASUS quirks, so do not change
++			 * boot_ec->gpe to ec->gpe.
++			 */
++			boot_ec->handle = ec->handle;
++			acpi_handle_debug(ec->handle, "duplicated.\n");
++			acpi_ec_free(ec);
++			ec = boot_ec;
++		}
++		ret = acpi_config_boot_ec(ec, ec->handle, true, is_ecdt);
+ 	} else
+ 		ret = acpi_ec_setup(ec, true);
+ 	if (ret)
+@@ -1635,8 +1644,10 @@ static int acpi_ec_add(struct acpi_device *device)
+ 	ret = !!request_region(ec->command_addr, 1, "EC cmd");
+ 	WARN(!ret, "Could not request EC cmd io port 0x%lx", ec->command_addr);
+ 
+-	/* Reprobe devices depending on the EC */
+-	acpi_walk_dep_device_list(ec->handle);
++	if (!is_ecdt) {
++		/* Reprobe devices depending on the EC */
++		acpi_walk_dep_device_list(ec->handle);
++	}
+ 	acpi_handle_debug(ec->handle, "enumerated.\n");
+ 	return 0;
+ 
+@@ -1692,6 +1703,7 @@ ec_parse_io_ports(struct acpi_resource *resource, void *context)
+ 
+ static const struct acpi_device_id ec_device_ids[] = {
+ 	{"PNP0C09", 0},
++	{ACPI_ECDT_HID, 0},
+ 	{"", 0},
+ };
+ 
+@@ -1764,11 +1776,14 @@ static int __init acpi_ec_ecdt_start(void)
+ 	 * Note: ec->handle can be valid if this function is called after
+ 	 * acpi_ec_add(), hence the fast path.
+ 	 */
+-	if (boot_ec->handle != ACPI_ROOT_OBJECT)
+-		handle = boot_ec->handle;
+-	else if (!acpi_ec_ecdt_get_handle(&handle))
+-		return -ENODEV;
+-	return acpi_config_boot_ec(boot_ec, handle, true, true);
++	if (boot_ec->handle == ACPI_ROOT_OBJECT) {
++		if (!acpi_ec_ecdt_get_handle(&handle))
++			return -ENODEV;
++		boot_ec->handle = handle;
++	}
++
++	/* Register to ACPI bus with PM ops attached */
++	return acpi_bus_register_early_device(ACPI_BUS_TYPE_ECDT_EC);
+ }
+ 
+ #if 0
+@@ -2020,6 +2035,12 @@ int __init acpi_ec_init(void)
+ 
+ 	/* Drivers must be started after acpi_ec_query_init() */
+ 	dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver);
++	/*
++	 * Register ECDT to ACPI bus only when PNP0C09 probe fails. This is
++	 * useful for platforms (confirmed on ASUS X550ZE) with valid ECDT
++	 * settings but invalid DSDT settings.
++	 * https://bugzilla.kernel.org/show_bug.cgi?id=196847
++	 */
+ 	ecdt_fail = acpi_ec_ecdt_start();
+ 	return ecdt_fail && dsdt_fail ? -ENODEV : 0;
+ }
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index 4361c4415b4f..ede83d38beed 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -115,6 +115,7 @@ bool acpi_device_is_present(const struct acpi_device *adev);
+ bool acpi_device_is_battery(struct acpi_device *adev);
+ bool acpi_device_is_first_physical_node(struct acpi_device *adev,
+ 					const struct device *dev);
++int acpi_bus_register_early_device(int type);
+ 
+ /* --------------------------------------------------------------------------
+                      Device Matching and Notification
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 602f8ff212f2..2f2f50322ffb 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -1024,6 +1024,9 @@ static void acpi_device_get_busid(struct acpi_device *device)
+ 	case ACPI_BUS_TYPE_SLEEP_BUTTON:
+ 		strcpy(device->pnp.bus_id, "SLPF");
+ 		break;
++	case ACPI_BUS_TYPE_ECDT_EC:
++		strcpy(device->pnp.bus_id, "ECDT");
++		break;
+ 	default:
+ 		acpi_get_name(device->handle, ACPI_SINGLE_NAME, &buffer);
+ 		/* Clean up trailing underscores (if any) */
+@@ -1304,6 +1307,9 @@ static void acpi_set_pnp_ids(acpi_handle handle, struct acpi_device_pnp *pnp,
+ 	case ACPI_BUS_TYPE_SLEEP_BUTTON:
+ 		acpi_add_id(pnp, ACPI_BUTTON_HID_SLEEPF);
+ 		break;
++	case ACPI_BUS_TYPE_ECDT_EC:
++		acpi_add_id(pnp, ACPI_ECDT_HID);
++		break;
+ 	}
+ }
+ 
+@@ -2049,6 +2055,21 @@ void acpi_bus_trim(struct acpi_device *adev)
+ }
+ EXPORT_SYMBOL_GPL(acpi_bus_trim);
+ 
++int acpi_bus_register_early_device(int type)
++{
++	struct acpi_device *device = NULL;
++	int result;
++
++	result = acpi_add_single_object(&device, NULL,
++					type, ACPI_STA_DEFAULT);
++	if (result)
++		return result;
++
++	device->flags.match_driver = true;
++	return device_attach(&device->dev);
++}
++EXPORT_SYMBOL_GPL(acpi_bus_register_early_device);
++
+ static int acpi_bus_scan_fixed(void)
+ {
+ 	int result = 0;
+diff --git a/drivers/dax/device.c b/drivers/dax/device.c
+index e9f3b3e4bbf4..375b99bca002 100644
+--- a/drivers/dax/device.c
++++ b/drivers/dax/device.c
+@@ -427,9 +427,21 @@ static int dev_dax_fault(struct vm_fault *vmf)
+ 	return dev_dax_huge_fault(vmf, PE_SIZE_PTE);
+ }
+ 
++static int dev_dax_split(struct vm_area_struct *vma, unsigned long addr)
++{
++	struct file *filp = vma->vm_file;
++	struct dev_dax *dev_dax = filp->private_data;
++	struct dax_region *dax_region = dev_dax->region;
++
++	if (!IS_ALIGNED(addr, dax_region->align))
++		return -EINVAL;
++	return 0;
++}
++
+ static const struct vm_operations_struct dax_vm_ops = {
+ 	.fault = dev_dax_fault,
+ 	.huge_fault = dev_dax_huge_fault,
++	.split = dev_dax_split,
+ };
+ 
+ static int dax_mmap(struct file *filp, struct vm_area_struct *vma)
+diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
+index dec3a815455d..b44d9d7db347 100644
+--- a/drivers/dma-buf/reservation.c
++++ b/drivers/dma-buf/reservation.c
+@@ -266,8 +266,7 @@ EXPORT_SYMBOL(reservation_object_add_excl_fence);
+ * @dst: the destination reservation object
+ * @src: the source reservation object
+ *
+-* Copy all fences from src to dst. Both src->lock as well as dst-lock must be
+-* held.
++* Copy all fences from src to dst. dst-lock must be held.
+ */
+ int reservation_object_copy_fences(struct reservation_object *dst,
+ 				   struct reservation_object *src)
+@@ -277,33 +276,62 @@ int reservation_object_copy_fences(struct reservation_object *dst,
+ 	size_t size;
+ 	unsigned i;
+ 
+-	src_list = reservation_object_get_list(src);
++	rcu_read_lock();
++	src_list = rcu_dereference(src->fence);
+ 
++retry:
+ 	if (src_list) {
+-		size = offsetof(typeof(*src_list),
+-				shared[src_list->shared_count]);
++		unsigned shared_count = src_list->shared_count;
++
++		size = offsetof(typeof(*src_list), shared[shared_count]);
++		rcu_read_unlock();
++
+ 		dst_list = kmalloc(size, GFP_KERNEL);
+ 		if (!dst_list)
+ 			return -ENOMEM;
+ 
+-		dst_list->shared_count = src_list->shared_count;
+-		dst_list->shared_max = src_list->shared_count;
+-		for (i = 0; i < src_list->shared_count; ++i)
+-			dst_list->shared[i] =
+-				dma_fence_get(src_list->shared[i]);
++		rcu_read_lock();
++		src_list = rcu_dereference(src->fence);
++		if (!src_list || src_list->shared_count > shared_count) {
++			kfree(dst_list);
++			goto retry;
++		}
++
++		dst_list->shared_count = 0;
++		dst_list->shared_max = shared_count;
++		for (i = 0; i < src_list->shared_count; ++i) {
++			struct dma_fence *fence;
++
++			fence = rcu_dereference(src_list->shared[i]);
++			if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
++				     &fence->flags))
++				continue;
++
++			if (!dma_fence_get_rcu(fence)) {
++				kfree(dst_list);
++				src_list = rcu_dereference(src->fence);
++				goto retry;
++			}
++
++			if (dma_fence_is_signaled(fence)) {
++				dma_fence_put(fence);
++				continue;
++			}
++
++			dst_list->shared[dst_list->shared_count++] = fence;
++		}
+ 	} else {
+ 		dst_list = NULL;
+ 	}
+ 
++	new = dma_fence_get_rcu_safe(&src->fence_excl);
++	rcu_read_unlock();
++
+ 	kfree(dst->staged);
+ 	dst->staged = NULL;
+ 
+ 	src_list = reservation_object_get_list(dst);
+-
+ 	old = reservation_object_get_excl(dst);
+-	new = reservation_object_get_excl(src);
+-
+-	dma_fence_get(new);
+ 
+ 	preempt_disable();
+ 	write_seqcount_begin(&dst->seq);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index 103635ab784c..87801faaf264 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -1536,18 +1536,14 @@ struct amdgpu_device {
+ 	/* sdma */
+ 	struct amdgpu_sdma		sdma;
+ 
+-	union {
+-		struct {
+-			/* uvd */
+-			struct amdgpu_uvd		uvd;
+-
+-			/* vce */
+-			struct amdgpu_vce		vce;
+-		};
+-
+-		/* vcn */
+-		struct amdgpu_vcn		vcn;
+-	};
++	/* uvd */
++	struct amdgpu_uvd		uvd;
++
++	/* vce */
++	struct amdgpu_vce		vce;
++
++	/* vcn */
++	struct amdgpu_vcn		vcn;
+ 
+ 	/* firmwares */
+ 	struct amdgpu_firmware		firmware;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+index ce443586a0c7..cc4e18dcd8b6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+@@ -1766,34 +1766,32 @@ bool amdgpu_atombios_scratch_need_asic_init(struct amdgpu_device *adev)
+ 		return true;
+ }
+ 
+-/* Atom needs data in little endian format
+- * so swap as appropriate when copying data to
+- * or from atom. Note that atom operates on
+- * dw units.
++/* Atom needs data in little endian format so swap as appropriate when copying
++ * data to or from atom. Note that atom operates on dw units.
++ *
++ * Use to_le=true when sending data to atom and provide at least
++ * ALIGN(num_bytes,4) bytes in the dst buffer.
++ *
++ * Use to_le=false when receiving data from atom and provide ALIGN(num_bytes,4)
++ * byes in the src buffer.
+  */
+ void amdgpu_atombios_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le)
+ {
+ #ifdef __BIG_ENDIAN
+-	u8 src_tmp[20], dst_tmp[20]; /* used for byteswapping */
+-	u32 *dst32, *src32;
++	u32 src_tmp[5], dst_tmp[5];
+ 	int i;
++	u8 align_num_bytes = ALIGN(num_bytes, 4);
+ 
+-	memcpy(src_tmp, src, num_bytes);
+-	src32 = (u32 *)src_tmp;
+-	dst32 = (u32 *)dst_tmp;
+ 	if (to_le) {
+-		for (i = 0; i < ((num_bytes + 3) / 4); i++)
+-			dst32[i] = cpu_to_le32(src32[i]);
+-		memcpy(dst, dst_tmp, num_bytes);
++		memcpy(src_tmp, src, num_bytes);
++		for (i = 0; i < align_num_bytes / 4; i++)
++			dst_tmp[i] = cpu_to_le32(src_tmp[i]);
++		memcpy(dst, dst_tmp, align_num_bytes);
+ 	} else {
+-		u8 dws = num_bytes & ~3;
+-		for (i = 0; i < ((num_bytes + 3) / 4); i++)
+-			dst32[i] = le32_to_cpu(src32[i]);
+-		memcpy(dst, dst_tmp, dws);
+-		if (num_bytes % 4) {
+-			for (i = 0; i < (num_bytes % 4); i++)
+-				dst[dws+i] = dst_tmp[dws+i];
+-		}
++		memcpy(src_tmp, src, align_num_bytes);
++		for (i = 0; i < align_num_bytes / 4; i++)
++			dst_tmp[i] = le32_to_cpu(src_tmp[i]);
++		memcpy(dst, dst_tmp, num_bytes);
+ 	}
+ #else
+ 	memcpy(dst, src, num_bytes);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+index c21adf60a7f2..057e1ecd83ce 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+@@ -59,12 +59,6 @@ static bool check_atom_bios(uint8_t *bios, size_t size)
+ 		return false;
+ 	}
+ 
+-	tmp = bios[0x18] | (bios[0x19] << 8);
+-	if (bios[tmp + 0x14] != 0x0) {
+-		DRM_INFO("Not an x86 BIOS ROM\n");
+-		return false;
+-	}
+-
+ 	bios_header_start = bios[0x48] | (bios[0x49] << 8);
+ 	if (!bios_header_start) {
+ 		DRM_INFO("Can't locate bios header\n");
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+index 9e495da0bb03..ffe483980362 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -391,6 +391,9 @@ int amdgpu_bo_create_restricted(struct amdgpu_device *adev,
+ 	r = ttm_bo_init_reserved(&adev->mman.bdev, &bo->tbo, size, type,
+ 				 &bo->placement, page_align, !kernel, NULL,
+ 				 acc_size, sg, resv, &amdgpu_ttm_bo_destroy);
++	if (unlikely(r != 0))
++		return r;
++
+ 	bytes_moved = atomic64_read(&adev->num_bytes_moved) -
+ 		      initial_bytes_moved;
+ 	if (adev->mc.visible_vram_size < adev->mc.real_vram_size &&
+@@ -400,9 +403,6 @@ int amdgpu_bo_create_restricted(struct amdgpu_device *adev,
+ 	else
+ 		amdgpu_cs_report_moved_bytes(adev, bytes_moved, 0);
+ 
+-	if (unlikely(r != 0))
+-		return r;
+-
+ 	if (kernel)
+ 		bo->tbo.priority = 1;
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+index c855366521ab..9fc3d387eae3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+@@ -647,7 +647,7 @@ int amdgpu_vce_ring_parse_cs(struct amdgpu_cs_parser *p, uint32_t ib_idx)
+ 	uint32_t allocated = 0;
+ 	uint32_t tmp, handle = 0;
+ 	uint32_t *size = &tmp;
+-	int i, r, idx = 0;
++	int i, r = 0, idx = 0;
+ 
+ 	p->job->vm = NULL;
+ 	ib->gpu_addr = amdgpu_sa_bo_gpu_addr(ib->sa_bo);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index bd20ff018512..863c6dd0123a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -1201,7 +1201,7 @@ static void amdgpu_vm_invalidate_level(struct amdgpu_vm_pt *parent)
+ int amdgpu_vm_update_directories(struct amdgpu_device *adev,
+ 				 struct amdgpu_vm *vm)
+ {
+-	int r;
++	int r = 0;
+ 
+ 	r = amdgpu_vm_update_level(adev, vm, &vm->root, 0);
+ 	if (r)
+@@ -2586,7 +2586,8 @@ void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm)
+ {
+ 	struct amdgpu_bo_va_mapping *mapping, *tmp;
+ 	bool prt_fini_needed = !!adev->gart.gart_funcs->set_prt;
+-	int i;
++	struct amdgpu_bo *root;
++	int i, r;
+ 
+ 	amd_sched_entity_fini(vm->entity.sched, &vm->entity);
+ 
+@@ -2609,7 +2610,15 @@ void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm)
+ 		amdgpu_vm_free_mapping(adev, vm, mapping, NULL);
+ 	}
+ 
+-	amdgpu_vm_free_levels(&vm->root);
++	root = amdgpu_bo_ref(vm->root.bo);
++	r = amdgpu_bo_reserve(root, true);
++	if (r) {
++		dev_err(adev->dev, "Leaking page tables because BO reservation failed\n");
++	} else {
++		amdgpu_vm_free_levels(&vm->root);
++		amdgpu_bo_unreserve(root);
++	}
++	amdgpu_bo_unref(&root);
+ 	dma_fence_put(vm->last_dir_update);
+ 	for (i = 0; i < AMDGPU_MAX_VMHUBS; i++)
+ 		amdgpu_vm_free_reserved_vmid(adev, vm, i);
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+index d04d0b123212..6dc0f6e346e7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+@@ -395,7 +395,16 @@ static int gmc_v9_0_early_init(void *handle)
+ static int gmc_v9_0_late_init(void *handle)
+ {
+ 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+-	unsigned vm_inv_eng[AMDGPU_MAX_VMHUBS] = { 3, 3 };
++	/*
++	 * The latest engine allocation on gfx9 is:
++	 * Engine 0, 1: idle
++	 * Engine 2, 3: firmware
++	 * Engine 4~13: amdgpu ring, subject to change when ring number changes
++	 * Engine 14~15: idle
++	 * Engine 16: kfd tlb invalidation
++	 * Engine 17: Gart flushes
++	 */
++	unsigned vm_inv_eng[AMDGPU_MAX_VMHUBS] = { 4, 4 };
+ 	unsigned i;
+ 
+ 	for(i = 0; i < adev->num_rings; ++i) {
+@@ -408,9 +417,9 @@ static int gmc_v9_0_late_init(void *handle)
+ 			 ring->funcs->vmhub);
+ 	}
+ 
+-	/* Engine 17 is used for GART flushes */
++	/* Engine 16 is used for KFD and 17 for GART flushes */
+ 	for(i = 0; i < AMDGPU_MAX_VMHUBS; ++i)
+-		BUG_ON(vm_inv_eng[i] > 17);
++		BUG_ON(vm_inv_eng[i] > 16);
+ 
+ 	return amdgpu_irq_get(adev, &adev->mc.vm_fault, 0);
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
+index f2c3a49f73a0..3e59c766722c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -279,10 +279,7 @@ static void soc15_init_golden_registers(struct amdgpu_device *adev)
+ }
+ static u32 soc15_get_xclk(struct amdgpu_device *adev)
+ {
+-	if (adev->asic_type == CHIP_VEGA10)
+-		return adev->clock.spll.reference_freq/4;
+-	else
+-		return adev->clock.spll.reference_freq;
++	return adev->clock.spll.reference_freq;
+ }
+ 
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+index 21e7b88401e1..a098712bdd2f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+@@ -1175,7 +1175,7 @@ static const struct amdgpu_irq_src_funcs vcn_v1_0_irq_funcs = {
+ 
+ static void vcn_v1_0_set_irq_funcs(struct amdgpu_device *adev)
+ {
+-	adev->uvd.irq.num_types = adev->vcn.num_enc_rings + 1;
++	adev->vcn.irq.num_types = adev->vcn.num_enc_rings + 1;
+ 	adev->vcn.irq.funcs = &vcn_v1_0_irq_funcs;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c b/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
+index 84f01fd33aff..b50aa292d026 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
+@@ -850,9 +850,9 @@ static int init_over_drive_limits(
+ 		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table)
+ {
+ 	hwmgr->platform_descriptor.overdriveLimit.engineClock =
+-		le16_to_cpu(powerplay_table->ulMaxODEngineClock);
++		le32_to_cpu(powerplay_table->ulMaxODEngineClock);
+ 	hwmgr->platform_descriptor.overdriveLimit.memoryClock =
+-		le16_to_cpu(powerplay_table->ulMaxODMemoryClock);
++		le32_to_cpu(powerplay_table->ulMaxODMemoryClock);
+ 
+ 	hwmgr->platform_descriptor.minOverdriveVDDC = 0;
+ 	hwmgr->platform_descriptor.maxOverdriveVDDC = 0;
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 6bb6337be920..fc7946eb6665 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -4809,7 +4809,8 @@ void
+ drm_hdmi_avi_infoframe_quant_range(struct hdmi_avi_infoframe *frame,
+ 				   const struct drm_display_mode *mode,
+ 				   enum hdmi_quantization_range rgb_quant_range,
+-				   bool rgb_quant_range_selectable)
++				   bool rgb_quant_range_selectable,
++				   bool is_hdmi2_sink)
+ {
+ 	/*
+ 	 * CEA-861:
+@@ -4833,8 +4834,15 @@ drm_hdmi_avi_infoframe_quant_range(struct hdmi_avi_infoframe *frame,
+ 	 *  YQ-field to match the RGB Quantization Range being transmitted
+ 	 *  (e.g., when Limited Range RGB, set YQ=0 or when Full Range RGB,
+ 	 *  set YQ=1) and the Sink shall ignore the YQ-field."
++	 *
++	 * Unfortunate certain sinks (eg. VIZ Model 67/E261VA) get confused
++	 * by non-zero YQ when receiving RGB. There doesn't seem to be any
++	 * good way to tell which version of CEA-861 the sink supports, so
++	 * we limit non-zero YQ to HDMI 2.0 sinks only as HDMI 2.0 is based
++	 * on on CEA-861-F.
+ 	 */
+-	if (rgb_quant_range == HDMI_QUANTIZATION_RANGE_LIMITED)
++	if (!is_hdmi2_sink ||
++	    rgb_quant_range == HDMI_QUANTIZATION_RANGE_LIMITED)
+ 		frame->ycc_quantization_range =
+ 			HDMI_YCC_QUANTIZATION_RANGE_LIMITED;
+ 	else
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 1b8f013ffa65..5e93589c335c 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1809,6 +1809,10 @@ static int drm_fb_helper_single_fb_probe(struct drm_fb_helper *fb_helper,
+ 
+ 	if (crtc_count == 0 || sizes.fb_width == -1 || sizes.fb_height == -1) {
+ 		DRM_INFO("Cannot find any crtc or sizes\n");
++
++		/* First time: disable all crtc's.. */
++		if (!fb_helper->deferred_setup && !READ_ONCE(fb_helper->dev->master))
++			restore_fbdev_mode(fb_helper);
+ 		return -EAGAIN;
+ 	}
+ 
+diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c
+index 70f2b9593edc..17e8ef9a1c11 100644
+--- a/drivers/gpu/drm/drm_vblank.c
++++ b/drivers/gpu/drm/drm_vblank.c
+@@ -311,8 +311,8 @@ u32 drm_crtc_accurate_vblank_count(struct drm_crtc *crtc)
+ 	u32 vblank;
+ 	unsigned long flags;
+ 
+-	WARN(!dev->driver->get_vblank_timestamp,
+-	     "This function requires support for accurate vblank timestamps.");
++	WARN_ONCE(drm_debug & DRM_UT_VBL && !dev->driver->get_vblank_timestamp,
++		  "This function requires support for accurate vblank timestamps.");
+ 
+ 	spin_lock_irqsave(&dev->vblank_time_lock, flags);
+ 
+@@ -869,7 +869,7 @@ void drm_crtc_arm_vblank_event(struct drm_crtc *crtc,
+ 	assert_spin_locked(&dev->event_lock);
+ 
+ 	e->pipe = pipe;
+-	e->event.sequence = drm_vblank_count(dev, pipe);
++	e->event.sequence = drm_crtc_accurate_vblank_count(crtc) + 1;
+ 	e->event.crtc_id = crtc->base.id;
+ 	list_add_tail(&e->base.link, &dev->vblank_event_list);
+ }
+diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c
+index edd7d8127d19..c54806d08dd7 100644
+--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c
++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c
+@@ -102,7 +102,6 @@ static int fsl_dcu_attach_panel(struct fsl_dcu_drm_device *fsl_dev,
+ {
+ 	struct drm_encoder *encoder = &fsl_dev->encoder;
+ 	struct drm_connector *connector = &fsl_dev->connector.base;
+-	struct drm_mode_config *mode_config = &fsl_dev->drm->mode_config;
+ 	int ret;
+ 
+ 	fsl_dev->connector.encoder = encoder;
+@@ -122,10 +121,6 @@ static int fsl_dcu_attach_panel(struct fsl_dcu_drm_device *fsl_dev,
+ 	if (ret < 0)
+ 		goto err_sysfs;
+ 
+-	drm_object_property_set_value(&connector->base,
+-				      mode_config->dpms_property,
+-				      DRM_MODE_DPMS_OFF);
+-
+ 	ret = drm_panel_attach(panel, connector);
+ 	if (ret) {
+ 		dev_err(fsl_dev->dev, "failed to attach panel\n");
+diff --git a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c
+index 9823477b1855..2269be91f3e1 100644
+--- a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c
++++ b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c
+@@ -534,9 +534,12 @@ static void ade_crtc_atomic_begin(struct drm_crtc *crtc,
+ {
+ 	struct ade_crtc *acrtc = to_ade_crtc(crtc);
+ 	struct ade_hw_ctx *ctx = acrtc->ctx;
++	struct drm_display_mode *mode = &crtc->state->mode;
++	struct drm_display_mode *adj_mode = &crtc->state->adjusted_mode;
+ 
+ 	if (!ctx->power_on)
+ 		(void)ade_power_up(ctx);
++	ade_ldi_set_mode(acrtc, mode, adj_mode);
+ }
+ 
+ static void ade_crtc_atomic_flush(struct drm_crtc *crtc,
+diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
+index e6dfc3331f4b..a385838e2919 100644
+--- a/drivers/gpu/drm/i915/gvt/gtt.c
++++ b/drivers/gpu/drm/i915/gvt/gtt.c
+@@ -311,9 +311,9 @@ static inline int gtt_set_entry64(void *pt,
+ 
+ #define GTT_HAW 46
+ 
+-#define ADDR_1G_MASK (((1UL << (GTT_HAW - 30 + 1)) - 1) << 30)
+-#define ADDR_2M_MASK (((1UL << (GTT_HAW - 21 + 1)) - 1) << 21)
+-#define ADDR_4K_MASK (((1UL << (GTT_HAW - 12 + 1)) - 1) << 12)
++#define ADDR_1G_MASK (((1UL << (GTT_HAW - 30)) - 1) << 30)
++#define ADDR_2M_MASK (((1UL << (GTT_HAW - 21)) - 1) << 21)
++#define ADDR_4K_MASK (((1UL << (GTT_HAW - 12)) - 1) << 12)
+ 
+ static unsigned long gen8_gtt_get_pfn(struct intel_gvt_gtt_entry *e)
+ {
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 9f45cfeae775..82498f8232eb 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -2591,6 +2591,8 @@ static int intel_runtime_resume(struct device *kdev)
+ 		ret = vlv_resume_prepare(dev_priv, true);
+ 	}
+ 
++	intel_uncore_runtime_resume(dev_priv);
++
+ 	/*
+ 	 * No point of rolling back things in case of an error, as the best
+ 	 * we can do is to hope that things will still work (and disable RPM).
+diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
+index 262e75c00dd2..da2d309574ba 100644
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -694,10 +694,8 @@ static void intel_fbdev_initial_config(void *data, async_cookie_t cookie)
+ 
+ 	/* Due to peculiar init order wrt to hpd handling this is separate. */
+ 	if (drm_fb_helper_initial_config(&ifbdev->helper,
+-					 ifbdev->preferred_bpp)) {
++					 ifbdev->preferred_bpp))
+ 		intel_fbdev_unregister(to_i915(ifbdev->helper.dev));
+-		intel_fbdev_fini(to_i915(ifbdev->helper.dev));
+-	}
+ }
+ 
+ void intel_fbdev_initial_config_async(struct drm_device *dev)
+@@ -797,7 +795,11 @@ void intel_fbdev_output_poll_changed(struct drm_device *dev)
+ {
+ 	struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
+ 
+-	if (ifbdev)
++	if (!ifbdev)
++		return;
++
++	intel_fbdev_sync(ifbdev);
++	if (ifbdev->vma)
+ 		drm_fb_helper_hotplug_event(&ifbdev->helper);
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
+index e8abea7594ec..3fed1d3ecded 100644
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -481,7 +481,8 @@ static void intel_hdmi_set_avi_infoframe(struct drm_encoder *encoder,
+ 					   crtc_state->limited_color_range ?
+ 					   HDMI_QUANTIZATION_RANGE_LIMITED :
+ 					   HDMI_QUANTIZATION_RANGE_FULL,
+-					   intel_hdmi->rgb_quant_range_selectable);
++					   intel_hdmi->rgb_quant_range_selectable,
++					   is_hdmi2_sink);
+ 
+ 	/* TODO: handle pixel repetition for YCBCR420 outputs */
+ 	intel_write_infoframe(encoder, crtc_state, &frame);
+diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
+index eb5827110d8f..49fdf09f9919 100644
+--- a/drivers/gpu/drm/i915/intel_i2c.c
++++ b/drivers/gpu/drm/i915/intel_i2c.c
+@@ -438,7 +438,9 @@ static bool
+ gmbus_is_index_read(struct i2c_msg *msgs, int i, int num)
+ {
+ 	return (i + 1 < num &&
+-		!(msgs[i].flags & I2C_M_RD) && msgs[i].len <= 2 &&
++		msgs[i].addr == msgs[i + 1].addr &&
++		!(msgs[i].flags & I2C_M_RD) &&
++		(msgs[i].len == 1 || msgs[i].len == 2) &&
+ 		(msgs[i + 1].flags & I2C_M_RD));
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
+index 1d7b879cc68c..e9ed02518406 100644
+--- a/drivers/gpu/drm/i915/intel_uncore.c
++++ b/drivers/gpu/drm/i915/intel_uncore.c
+@@ -434,6 +434,12 @@ void intel_uncore_resume_early(struct drm_i915_private *dev_priv)
+ 	i915_check_and_clear_faults(dev_priv);
+ }
+ 
++void intel_uncore_runtime_resume(struct drm_i915_private *dev_priv)
++{
++	iosf_mbi_register_pmic_bus_access_notifier(
++		&dev_priv->uncore.pmic_bus_access_nb);
++}
++
+ void intel_uncore_sanitize(struct drm_i915_private *dev_priv)
+ {
+ 	i915.enable_rc6 = sanitize_rc6_option(dev_priv, i915.enable_rc6);
+@@ -1171,8 +1177,15 @@ static int i915_pmic_bus_access_notifier(struct notifier_block *nb,
+ 		 * bus, which will be busy after this notification, leading to:
+ 		 * "render: timed out waiting for forcewake ack request."
+ 		 * errors.
++		 *
++		 * The notifier is unregistered during intel_runtime_suspend(),
++		 * so it's ok to access the HW here without holding a RPM
++		 * wake reference -> disable wakeref asserts for the time of
++		 * the access.
+ 		 */
++		disable_rpm_wakeref_asserts(dev_priv);
+ 		intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
++		enable_rpm_wakeref_asserts(dev_priv);
+ 		break;
+ 	case MBI_PMIC_BUS_ACCESS_END:
+ 		intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
+diff --git a/drivers/gpu/drm/i915/intel_uncore.h b/drivers/gpu/drm/i915/intel_uncore.h
+index 5f90278da461..0bdc3fcc0e64 100644
+--- a/drivers/gpu/drm/i915/intel_uncore.h
++++ b/drivers/gpu/drm/i915/intel_uncore.h
+@@ -121,6 +121,7 @@ bool intel_uncore_arm_unclaimed_mmio_detection(struct drm_i915_private *dev_priv
+ void intel_uncore_fini(struct drm_i915_private *dev_priv);
+ void intel_uncore_suspend(struct drm_i915_private *dev_priv);
+ void intel_uncore_resume_early(struct drm_i915_private *dev_priv);
++void intel_uncore_runtime_resume(struct drm_i915_private *dev_priv);
+ 
+ u64 intel_uncore_edram_size(struct drm_i915_private *dev_priv);
+ void assert_forcewakes_inactive(struct drm_i915_private *dev_priv);
+diff --git a/drivers/gpu/drm/omapdrm/dss/dpi.c b/drivers/gpu/drm/omapdrm/dss/dpi.c
+index daf286fc8a40..ca1e3b489540 100644
+--- a/drivers/gpu/drm/omapdrm/dss/dpi.c
++++ b/drivers/gpu/drm/omapdrm/dss/dpi.c
+@@ -566,8 +566,8 @@ static int dpi_verify_pll(struct dss_pll *pll)
+ }
+ 
+ static const struct soc_device_attribute dpi_soc_devices[] = {
+-	{ .family = "OMAP3[456]*" },
+-	{ .family = "[AD]M37*" },
++	{ .machine = "OMAP3[456]*" },
++	{ .machine = "[AD]M37*" },
+ 	{ /* sentinel */ }
+ };
+ 
+diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
+index 365cf07daa01..c3453f3bd603 100644
+--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
++++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
+@@ -889,25 +889,36 @@ struct hdmi4_features {
+ 	bool audio_use_mclk;
+ };
+ 
+-static const struct hdmi4_features hdmi4_es1_features = {
++static const struct hdmi4_features hdmi4430_es1_features = {
+ 	.cts_swmode = false,
+ 	.audio_use_mclk = false,
+ };
+ 
+-static const struct hdmi4_features hdmi4_es2_features = {
++static const struct hdmi4_features hdmi4430_es2_features = {
+ 	.cts_swmode = true,
+ 	.audio_use_mclk = false,
+ };
+ 
+-static const struct hdmi4_features hdmi4_es3_features = {
++static const struct hdmi4_features hdmi4_features = {
+ 	.cts_swmode = true,
+ 	.audio_use_mclk = true,
+ };
+ 
+ static const struct soc_device_attribute hdmi4_soc_devices[] = {
+-	{ .family = "OMAP4", .revision = "ES1.?", .data = &hdmi4_es1_features },
+-	{ .family = "OMAP4", .revision = "ES2.?", .data = &hdmi4_es2_features },
+-	{ .family = "OMAP4",			  .data = &hdmi4_es3_features },
++	{
++		.machine = "OMAP4430",
++		.revision = "ES1.?",
++		.data = &hdmi4430_es1_features,
++	},
++	{
++		.machine = "OMAP4430",
++		.revision = "ES2.?",
++		.data = &hdmi4430_es2_features,
++	},
++	{
++		.family = "OMAP4",
++		.data = &hdmi4_features,
++	},
+ 	{ /* sentinel */ }
+ };
+ 
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 474fa759e06e..234af81fb3d0 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -369,6 +369,7 @@ static int panel_simple_remove(struct device *dev)
+ 	drm_panel_remove(&panel->base);
+ 
+ 	panel_simple_disable(&panel->base);
++	panel_simple_unprepare(&panel->base);
+ 
+ 	if (panel->ddc)
+ 		put_device(&panel->ddc->dev);
+@@ -384,6 +385,7 @@ static void panel_simple_shutdown(struct device *dev)
+ 	struct panel_simple *panel = dev_get_drvdata(dev);
+ 
+ 	panel_simple_disable(&panel->base);
++	panel_simple_unprepare(&panel->base);
+ }
+ 
+ static const struct drm_display_mode ampire_am_480272h3tmqw_t01h_mode = {
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 432cb46f6a34..fd7682bf335d 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -45,34 +45,32 @@ static char *pre_emph_names[] = {
+ 
+ /***** radeon AUX functions *****/
+ 
+-/* Atom needs data in little endian format
+- * so swap as appropriate when copying data to
+- * or from atom. Note that atom operates on
+- * dw units.
++/* Atom needs data in little endian format so swap as appropriate when copying
++ * data to or from atom. Note that atom operates on dw units.
++ *
++ * Use to_le=true when sending data to atom and provide at least
++ * ALIGN(num_bytes,4) bytes in the dst buffer.
++ *
++ * Use to_le=false when receiving data from atom and provide ALIGN(num_bytes,4)
++ * byes in the src buffer.
+  */
+ void radeon_atom_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le)
+ {
+ #ifdef __BIG_ENDIAN
+-	u8 src_tmp[20], dst_tmp[20]; /* used for byteswapping */
+-	u32 *dst32, *src32;
++	u32 src_tmp[5], dst_tmp[5];
+ 	int i;
++	u8 align_num_bytes = ALIGN(num_bytes, 4);
+ 
+-	memcpy(src_tmp, src, num_bytes);
+-	src32 = (u32 *)src_tmp;
+-	dst32 = (u32 *)dst_tmp;
+ 	if (to_le) {
+-		for (i = 0; i < ((num_bytes + 3) / 4); i++)
+-			dst32[i] = cpu_to_le32(src32[i]);
+-		memcpy(dst, dst_tmp, num_bytes);
++		memcpy(src_tmp, src, num_bytes);
++		for (i = 0; i < align_num_bytes / 4; i++)
++			dst_tmp[i] = cpu_to_le32(src_tmp[i]);
++		memcpy(dst, dst_tmp, align_num_bytes);
+ 	} else {
+-		u8 dws = num_bytes & ~3;
+-		for (i = 0; i < ((num_bytes + 3) / 4); i++)
+-			dst32[i] = le32_to_cpu(src32[i]);
+-		memcpy(dst, dst_tmp, dws);
+-		if (num_bytes % 4) {
+-			for (i = 0; i < (num_bytes % 4); i++)
+-				dst[dws+i] = dst_tmp[dws+i];
+-		}
++		memcpy(src_tmp, src, align_num_bytes);
++		for (i = 0; i < align_num_bytes / 4; i++)
++			dst_tmp[i] = le32_to_cpu(src_tmp[i]);
++		memcpy(dst, dst_tmp, num_bytes);
+ 	}
+ #else
+ 	memcpy(dst, src, num_bytes);
+diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
+index fd25361ac681..4ef967d1a9de 100644
+--- a/drivers/gpu/drm/radeon/radeon_fb.c
++++ b/drivers/gpu/drm/radeon/radeon_fb.c
+@@ -245,7 +245,6 @@ static int radeonfb_create(struct drm_fb_helper *helper,
+ 	}
+ 
+ 	info->par = rfbdev;
+-	info->skip_vt_switch = true;
+ 
+ 	ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
+ 	if (ret) {
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
+index 406fe4544b83..06d6e785c920 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
+@@ -24,6 +24,7 @@
+ #include <linux/completion.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/of_graph.h>
++#include <linux/math64.h>
+ 
+ #include "tilcdc_drv.h"
+ #include "tilcdc_regs.h"
+@@ -48,6 +49,7 @@ struct tilcdc_crtc {
+ 	unsigned int lcd_fck_rate;
+ 
+ 	ktime_t last_vblank;
++	unsigned int hvtotal_us;
+ 
+ 	struct drm_framebuffer *curr_fb;
+ 	struct drm_framebuffer *next_fb;
+@@ -292,6 +294,12 @@ static void tilcdc_crtc_set_clk(struct drm_crtc *crtc)
+ 				LCDC_V2_CORE_CLK_EN);
+ }
+ 
++uint tilcdc_mode_hvtotal(const struct drm_display_mode *mode)
++{
++	return (uint) div_u64(1000llu * mode->htotal * mode->vtotal,
++			      mode->clock);
++}
++
+ static void tilcdc_crtc_set_mode(struct drm_crtc *crtc)
+ {
+ 	struct tilcdc_crtc *tilcdc_crtc = to_tilcdc_crtc(crtc);
+@@ -459,6 +467,9 @@ static void tilcdc_crtc_set_mode(struct drm_crtc *crtc)
+ 	drm_framebuffer_reference(fb);
+ 
+ 	crtc->hwmode = crtc->state->adjusted_mode;
++
++	tilcdc_crtc->hvtotal_us =
++		tilcdc_mode_hvtotal(&crtc->hwmode);
+ }
+ 
+ static void tilcdc_crtc_enable(struct drm_crtc *crtc)
+@@ -648,7 +659,7 @@ int tilcdc_crtc_update_fb(struct drm_crtc *crtc,
+ 		spin_lock_irqsave(&tilcdc_crtc->irq_lock, flags);
+ 
+ 		next_vblank = ktime_add_us(tilcdc_crtc->last_vblank,
+-					   1000000 / crtc->hwmode.vrefresh);
++					   tilcdc_crtc->hvtotal_us);
+ 		tdiff = ktime_to_us(ktime_sub(next_vblank, ktime_get()));
+ 
+ 		if (tdiff < TILCDC_VBLANK_SAFETY_THRESHOLD_US)
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 180ce6296416..c088703777e2 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -150,8 +150,7 @@ static void ttm_bo_release_list(struct kref *list_kref)
+ 	ttm_tt_destroy(bo->ttm);
+ 	atomic_dec(&bo->glob->bo_count);
+ 	dma_fence_put(bo->moving);
+-	if (bo->resv == &bo->ttm_resv)
+-		reservation_object_fini(&bo->ttm_resv);
++	reservation_object_fini(&bo->ttm_resv);
+ 	mutex_destroy(&bo->wu_mutex);
+ 	if (bo->destroy)
+ 		bo->destroy(bo);
+@@ -402,14 +401,11 @@ static int ttm_bo_individualize_resv(struct ttm_buffer_object *bo)
+ 	if (bo->resv == &bo->ttm_resv)
+ 		return 0;
+ 
+-	reservation_object_init(&bo->ttm_resv);
+ 	BUG_ON(!reservation_object_trylock(&bo->ttm_resv));
+ 
+ 	r = reservation_object_copy_fences(&bo->ttm_resv, bo->resv);
+-	if (r) {
++	if (r)
+ 		reservation_object_unlock(&bo->ttm_resv);
+-		reservation_object_fini(&bo->ttm_resv);
+-	}
+ 
+ 	return r;
+ }
+@@ -440,28 +436,30 @@ static void ttm_bo_cleanup_refs_or_queue(struct ttm_buffer_object *bo)
+ 	struct ttm_bo_global *glob = bo->glob;
+ 	int ret;
+ 
++	ret = ttm_bo_individualize_resv(bo);
++	if (ret) {
++		/* Last resort, if we fail to allocate memory for the
++		 * fences block for the BO to become idle
++		 */
++		reservation_object_wait_timeout_rcu(bo->resv, true, false,
++						    30 * HZ);
++		spin_lock(&glob->lru_lock);
++		goto error;
++	}
++
+ 	spin_lock(&glob->lru_lock);
+ 	ret = __ttm_bo_reserve(bo, false, true, NULL);
+-
+ 	if (!ret) {
+-		if (!ttm_bo_wait(bo, false, true)) {
++		if (reservation_object_test_signaled_rcu(&bo->ttm_resv, true)) {
+ 			ttm_bo_del_from_lru(bo);
+ 			spin_unlock(&glob->lru_lock);
+-			ttm_bo_cleanup_memtype_use(bo);
++			if (bo->resv != &bo->ttm_resv)
++				reservation_object_unlock(&bo->ttm_resv);
+ 
+-			return;
+-		}
+-
+-		ret = ttm_bo_individualize_resv(bo);
+-		if (ret) {
+-			/* Last resort, if we fail to allocate memory for the
+-			 * fences block for the BO to become idle and free it.
+-			 */
+-			spin_unlock(&glob->lru_lock);
+-			ttm_bo_wait(bo, true, true);
+ 			ttm_bo_cleanup_memtype_use(bo);
+ 			return;
+ 		}
++
+ 		ttm_bo_flush_all_fences(bo);
+ 
+ 		/*
+@@ -474,11 +472,12 @@ static void ttm_bo_cleanup_refs_or_queue(struct ttm_buffer_object *bo)
+ 			ttm_bo_add_to_lru(bo);
+ 		}
+ 
+-		if (bo->resv != &bo->ttm_resv)
+-			reservation_object_unlock(&bo->ttm_resv);
+ 		__ttm_bo_unreserve(bo);
+ 	}
++	if (bo->resv != &bo->ttm_resv)
++		reservation_object_unlock(&bo->ttm_resv);
+ 
++error:
+ 	kref_get(&bo->list_kref);
+ 	list_add_tail(&bo->ddestroy, &bdev->ddestroy);
+ 	spin_unlock(&glob->lru_lock);
+@@ -1203,8 +1202,8 @@ int ttm_bo_init_reserved(struct ttm_bo_device *bdev,
+ 		lockdep_assert_held(&bo->resv->lock.base);
+ 	} else {
+ 		bo->resv = &bo->ttm_resv;
+-		reservation_object_init(&bo->ttm_resv);
+ 	}
++	reservation_object_init(&bo->ttm_resv);
+ 	atomic_inc(&bo->glob->bo_count);
+ 	drm_vma_node_reset(&bo->vma_node);
+ 	bo->priority = 0;
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
+index c934ad5b3903..7c2fbdbbd048 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
+@@ -474,6 +474,7 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
+ 	INIT_LIST_HEAD(&fbo->lru);
+ 	INIT_LIST_HEAD(&fbo->swap);
+ 	INIT_LIST_HEAD(&fbo->io_reserve_lru);
++	mutex_init(&fbo->wu_mutex);
+ 	fbo->moving = NULL;
+ 	drm_vma_node_reset(&fbo->vma_node);
+ 	atomic_set(&fbo->cpu_writers, 0);
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 937da8dd65b8..8f71157a2b06 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -433,7 +433,8 @@ static void vc4_hdmi_set_avi_infoframe(struct drm_encoder *encoder)
+ 					   vc4_encoder->limited_rgb_range ?
+ 					   HDMI_QUANTIZATION_RANGE_LIMITED :
+ 					   HDMI_QUANTIZATION_RANGE_FULL,
+-					   vc4_encoder->rgb_range_selectable);
++					   vc4_encoder->rgb_range_selectable,
++					   false);
+ 
+ 	vc4_hdmi_write_infoframe(encoder, &frame);
+ }
+diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
+index 5f11dc014ed6..e5234f953a6d 100644
+--- a/drivers/hwmon/jc42.c
++++ b/drivers/hwmon/jc42.c
+@@ -22,6 +22,7 @@
+  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+  */
+ 
++#include <linux/bitops.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+ #include <linux/slab.h>
+@@ -45,6 +46,7 @@ static const unsigned short normal_i2c[] = {
+ #define JC42_REG_TEMP		0x05
+ #define JC42_REG_MANID		0x06
+ #define JC42_REG_DEVICEID	0x07
++#define JC42_REG_SMBUS		0x22 /* NXP and Atmel, possibly others? */
+ 
+ /* Status bits in temperature register */
+ #define JC42_ALARM_CRIT_BIT	15
+@@ -75,6 +77,9 @@ static const unsigned short normal_i2c[] = {
+ #define GT_MANID		0x1c68	/* Giantec */
+ #define GT_MANID2		0x132d	/* Giantec, 2nd mfg ID */
+ 
++/* SMBUS register */
++#define SMBUS_STMOUT		BIT(7)  /* SMBus time-out, active low */
++
+ /* Supported chips */
+ 
+ /* Analog Devices */
+@@ -495,6 +500,22 @@ static int jc42_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 
+ 	data->extended = !!(cap & JC42_CAP_RANGE);
+ 
++	if (device_property_read_bool(dev, "smbus-timeout-disable")) {
++		int smbus;
++
++		/*
++		 * Not all chips support this register, but from a
++		 * quick read of various datasheets no chip appears
++		 * incompatible with the below attempt to disable
++		 * the timeout. And the whole thing is opt-in...
++		 */
++		smbus = i2c_smbus_read_word_swapped(client, JC42_REG_SMBUS);
++		if (smbus < 0)
++			return smbus;
++		i2c_smbus_write_word_swapped(client, JC42_REG_SMBUS,
++					     smbus | SMBUS_STMOUT);
++	}
++
+ 	config = i2c_smbus_read_word_swapped(client, JC42_REG_CONFIG);
+ 	if (config < 0)
+ 		return config;
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 9e12a53ef7b8..8eac00efadc1 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -1617,6 +1617,9 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 	/* Default timeout in interrupt mode: 200 ms */
+ 	priv->adapter.timeout = HZ / 5;
+ 
++	if (dev->irq == IRQ_NOTCONNECTED)
++		priv->features &= ~FEATURE_IRQ;
++
+ 	if (priv->features & FEATURE_IRQ) {
+ 		u16 pcictl, pcists;
+ 
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index 21e60b1e2ff4..130606c3b07c 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -191,7 +191,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ 	sg_list_start = umem->sg_head.sgl;
+ 
+ 	while (npages) {
+-		ret = get_user_pages(cur_base,
++		ret = get_user_pages_longterm(cur_base,
+ 				     min_t(unsigned long, npages,
+ 					   PAGE_SIZE / sizeof (struct page *)),
+ 				     gup_flags, page_list, vma_list);
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index c1696e6084b2..603acaf91828 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -229,7 +229,16 @@ static void recv_handler(struct ib_mad_agent *agent,
+ 	packet->mad.hdr.status	   = 0;
+ 	packet->mad.hdr.length	   = hdr_size(file) + mad_recv_wc->mad_len;
+ 	packet->mad.hdr.qpn	   = cpu_to_be32(mad_recv_wc->wc->src_qp);
+-	packet->mad.hdr.lid	   = ib_lid_be16(mad_recv_wc->wc->slid);
++	/*
++	 * On OPA devices it is okay to lose the upper 16 bits of LID as this
++	 * information is obtained elsewhere. Mask off the upper 16 bits.
++	 */
++	if (agent->device->port_immutable[agent->port_num].core_cap_flags &
++	    RDMA_CORE_PORT_INTEL_OPA)
++		packet->mad.hdr.lid = ib_lid_be16(0xFFFF &
++						  mad_recv_wc->wc->slid);
++	else
++		packet->mad.hdr.lid = ib_lid_be16(mad_recv_wc->wc->slid);
+ 	packet->mad.hdr.sl	   = mad_recv_wc->wc->sl;
+ 	packet->mad.hdr.path_bits  = mad_recv_wc->wc->dlid_path_bits;
+ 	packet->mad.hdr.pkey_index = mad_recv_wc->wc->pkey_index;
+diff --git a/drivers/infiniband/hw/hfi1/mad.c b/drivers/infiniband/hw/hfi1/mad.c
+index f4c0ffc040cc..07b80faf1675 100644
+--- a/drivers/infiniband/hw/hfi1/mad.c
++++ b/drivers/infiniband/hw/hfi1/mad.c
+@@ -4293,7 +4293,6 @@ static int opa_local_smp_check(struct hfi1_ibport *ibp,
+ 			       const struct ib_wc *in_wc)
+ {
+ 	struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
+-	u16 slid = ib_lid_cpu16(in_wc->slid);
+ 	u16 pkey;
+ 
+ 	if (in_wc->pkey_index >= ARRAY_SIZE(ppd->pkeys))
+@@ -4320,7 +4319,11 @@ static int opa_local_smp_check(struct hfi1_ibport *ibp,
+ 	 */
+ 	if (pkey == LIM_MGMT_P_KEY || pkey == FULL_MGMT_P_KEY)
+ 		return 0;
+-	ingress_pkey_table_fail(ppd, pkey, slid);
++	/*
++	 * On OPA devices it is okay to lose the upper 16 bits of LID as this
++	 * information is obtained elsewhere. Mask off the upper 16 bits.
++	 */
++	ingress_pkey_table_fail(ppd, pkey, ib_lid_cpu16(0xFFFF & in_wc->slid));
+ 	return 1;
+ }
+ 
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index c9934139d609..934b1fce4ce1 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -480,7 +480,7 @@ int __bch_bucket_alloc_set(struct cache_set *c, unsigned reserve,
+ 		if (b == -1)
+ 			goto err;
+ 
+-		k->ptr[i] = PTR(ca->buckets[b].gen,
++		k->ptr[i] = MAKE_PTR(ca->buckets[b].gen,
+ 				bucket_to_sector(c, b),
+ 				ca->sb.nr_this_dev);
+ 
+diff --git a/drivers/md/bcache/extents.c b/drivers/md/bcache/extents.c
+index 41c238fc3733..f9d391711595 100644
+--- a/drivers/md/bcache/extents.c
++++ b/drivers/md/bcache/extents.c
+@@ -585,7 +585,7 @@ static bool bch_extent_merge(struct btree_keys *bk, struct bkey *l, struct bkey
+ 		return false;
+ 
+ 	for (i = 0; i < KEY_PTRS(l); i++)
+-		if (l->ptr[i] + PTR(0, KEY_SIZE(l), 0) != r->ptr[i] ||
++		if (l->ptr[i] + MAKE_PTR(0, KEY_SIZE(l), 0) != r->ptr[i] ||
+ 		    PTR_BUCKET_NR(b->c, l, i) != PTR_BUCKET_NR(b->c, r, i))
+ 			return false;
+ 
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 02a98ddb592d..03cc0722ae48 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -507,7 +507,7 @@ static void journal_reclaim(struct cache_set *c)
+ 			continue;
+ 
+ 		ja->cur_idx = next;
+-		k->ptr[n++] = PTR(0,
++		k->ptr[n++] = MAKE_PTR(0,
+ 				  bucket_to_sector(c, ca->sb.d[ja->cur_idx]),
+ 				  ca->sb.nr_this_dev);
+ 	}
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index 3475d6628e21..14d13cab5cda 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -699,7 +699,14 @@ static void cached_dev_read_error(struct closure *cl)
+ 	struct search *s = container_of(cl, struct search, cl);
+ 	struct bio *bio = &s->bio.bio;
+ 
+-	if (s->recoverable) {
++	/*
++	 * If read request hit dirty data (s->read_dirty_data is true),
++	 * then recovery a failed read request from cached device may
++	 * get a stale data back. So read failure recovery is only
++	 * permitted when read request hit clean data in cache device,
++	 * or when cache read race happened.
++	 */
++	if (s->recoverable && !s->read_dirty_data) {
+ 		/* Retry from the backing device: */
+ 		trace_bcache_read_retry(s->orig_bio);
+ 
+diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
+index cae57b5be817..f425905c97fa 100644
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -1816,6 +1816,12 @@ struct bitmap *bitmap_create(struct mddev *mddev, int slot)
+ 
+ 	BUG_ON(file && mddev->bitmap_info.offset);
+ 
++	if (test_bit(MD_HAS_JOURNAL, &mddev->flags)) {
++		pr_notice("md/raid:%s: array with journal cannot have bitmap\n",
++			  mdname(mddev));
++		return ERR_PTR(-EBUSY);
++	}
++
+ 	bitmap = kzalloc(sizeof(*bitmap), GFP_KERNEL);
+ 	if (!bitmap)
+ 		return ERR_PTR(-ENOMEM);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index e019cf8c0d13..98ea86309ceb 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6362,7 +6362,7 @@ static int add_new_disk(struct mddev *mddev, mdu_disk_info_t *info)
+ 					break;
+ 				}
+ 			}
+-			if (has_journal) {
++			if (has_journal || mddev->bitmap) {
+ 				export_rdev(rdev);
+ 				return -EBUSY;
+ 			}
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 928e24a07133..7aed69a4f655 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -7156,6 +7156,13 @@ static int raid5_run(struct mddev *mddev)
+ 			min_offset_diff = diff;
+ 	}
+ 
++	if ((test_bit(MD_HAS_JOURNAL, &mddev->flags) || journal_dev) &&
++	    (mddev->bitmap_info.offset || mddev->bitmap_info.file)) {
++		pr_notice("md/raid:%s: array cannot have both journal and bitmap\n",
++			  mdname(mddev));
++		return -EINVAL;
++	}
++
+ 	if (mddev->reshape_position != MaxSector) {
+ 		/* Check that we can continue the reshape.
+ 		 * Difficulties arise if the stripe we would write to
+diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
+index 0b5c43f7e020..f412429cf5ba 100644
+--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
++++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
+@@ -185,12 +185,13 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
+ 	dprintk(1, "init user [0x%lx+0x%lx => %d pages]\n",
+ 		data, size, dma->nr_pages);
+ 
+-	err = get_user_pages(data & PAGE_MASK, dma->nr_pages,
++	err = get_user_pages_longterm(data & PAGE_MASK, dma->nr_pages,
+ 			     flags, dma->pages, NULL);
+ 
+ 	if (err != dma->nr_pages) {
+ 		dma->nr_pages = (err >= 0) ? err : 0;
+-		dprintk(1, "get_user_pages: err=%d [%d]\n", err, dma->nr_pages);
++		dprintk(1, "get_user_pages_longterm: err=%d [%d]\n", err,
++			dma->nr_pages);
+ 		return err < 0 ? err : -EINVAL;
+ 	}
+ 	return 0;
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index 3ba04f371380..81093f8157a9 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -2043,6 +2043,9 @@ static pci_ers_result_t cxl_vphb_error_detected(struct cxl_afu *afu,
+ 	/* There should only be one entry, but go through the list
+ 	 * anyway
+ 	 */
++	if (afu->phb == NULL)
++		return result;
++
+ 	list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) {
+ 		if (!afu_dev->driver)
+ 			continue;
+@@ -2084,8 +2087,7 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev,
+ 			 * Tell the AFU drivers; but we don't care what they
+ 			 * say, we're going away.
+ 			 */
+-			if (afu->phb != NULL)
+-				cxl_vphb_error_detected(afu, state);
++			cxl_vphb_error_detected(afu, state);
+ 		}
+ 		return PCI_ERS_RESULT_DISCONNECT;
+ 	}
+@@ -2225,6 +2227,9 @@ static pci_ers_result_t cxl_pci_slot_reset(struct pci_dev *pdev)
+ 		if (cxl_afu_select_best_mode(afu))
+ 			goto err;
+ 
++		if (afu->phb == NULL)
++			continue;
++
+ 		list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) {
+ 			/* Reset the device context.
+ 			 * TODO: make this less disruptive
+@@ -2287,6 +2292,9 @@ static void cxl_pci_resume(struct pci_dev *pdev)
+ 	for (i = 0; i < adapter->slices; i++) {
+ 		afu = adapter->afu[i];
+ 
++		if (afu->phb == NULL)
++			continue;
++
+ 		list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) {
+ 			if (afu_dev->driver && afu_dev->driver->err_handler &&
+ 			    afu_dev->driver->err_handler->resume)
+diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
+index 764ff5df0dbc..372b2060fbba 100644
+--- a/drivers/misc/eeprom/at24.c
++++ b/drivers/misc/eeprom/at24.c
+@@ -365,7 +365,8 @@ static ssize_t at24_eeprom_read_mac(struct at24_data *at24, char *buf,
+ 	memset(msg, 0, sizeof(msg));
+ 	msg[0].addr = client->addr;
+ 	msg[0].buf = addrbuf;
+-	addrbuf[0] = 0x90 + offset;
++	/* EUI-48 starts from 0x9a, EUI-64 from 0x98 */
++	addrbuf[0] = 0xa0 - at24->chip.byte_len + offset;
+ 	msg[0].len = 1;
+ 	msg[1].addr = client->addr;
+ 	msg[1].flags = I2C_M_RD;
+@@ -506,6 +507,9 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
+ 	if (unlikely(!count))
+ 		return count;
+ 
++	if (off + count > at24->chip.byte_len)
++		return -EINVAL;
++
+ 	/*
+ 	 * Read data from chip, protecting against concurrent updates
+ 	 * from this host, but not from other I2C masters.
+@@ -538,6 +542,9 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count)
+ 	if (unlikely(!count))
+ 		return -EINVAL;
+ 
++	if (off + count > at24->chip.byte_len)
++		return -EINVAL;
++
+ 	/*
+ 	 * Write data to chip, protecting against concurrent updates
+ 	 * from this host, but not from other I2C masters.
+@@ -631,6 +638,16 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ 		dev_warn(&client->dev,
+ 			"page_size looks suspicious (no power of 2)!\n");
+ 
++	/*
++	 * REVISIT: the size of the EUI-48 byte array is 6 in at24mac402, while
++	 * the call to ilog2() in AT24_DEVICE_MAGIC() rounds it down to 4.
++	 *
++	 * Eventually we'll get rid of the magic values altoghether in favor of
++	 * real structs, but for now just manually set the right size.
++	 */
++	if (chip.flags & AT24_FLAG_MAC && chip.byte_len == 4)
++		chip.byte_len = 6;
++
+ 	/* Use I2C operations unless we're stuck with SMBus extensions. */
+ 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+ 		if (chip.flags & AT24_FLAG_ADDR16)
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 2ad7b5c69156..ccb516f18d72 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -119,6 +119,10 @@ struct mmc_blk_data {
+ 	struct device_attribute force_ro;
+ 	struct device_attribute power_ro_lock;
+ 	int	area_type;
++
++	/* debugfs files (only in main mmc_blk_data) */
++	struct dentry *status_dentry;
++	struct dentry *ext_csd_dentry;
+ };
+ 
+ static DEFINE_MUTEX(open_lock);
+@@ -204,9 +208,14 @@ static ssize_t power_ro_lock_store(struct device *dev,
+ 
+ 	/* Dispatch locking to the block layer */
+ 	req = blk_get_request(mq->queue, REQ_OP_DRV_OUT, __GFP_RECLAIM);
++	if (IS_ERR(req)) {
++		count = PTR_ERR(req);
++		goto out_put;
++	}
+ 	req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP;
+ 	blk_execute_rq(mq->queue, NULL, req, 0);
+ 	ret = req_to_mmc_queue_req(req)->drv_op_result;
++	blk_put_request(req);
+ 
+ 	if (!ret) {
+ 		pr_info("%s: Locking boot partition ro until next power on\n",
+@@ -219,7 +228,7 @@ static ssize_t power_ro_lock_store(struct device *dev,
+ 				set_disk_ro(part_md->disk, 1);
+ 			}
+ 	}
+-
++out_put:
+ 	mmc_blk_put(md);
+ 	return count;
+ }
+@@ -580,6 +589,10 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md,
+ 	req = blk_get_request(mq->queue,
+ 		idata->ic.write_flag ? REQ_OP_DRV_OUT : REQ_OP_DRV_IN,
+ 		__GFP_RECLAIM);
++	if (IS_ERR(req)) {
++		err = PTR_ERR(req);
++		goto cmd_done;
++	}
+ 	idatas[0] = idata;
+ 	req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_IOCTL;
+ 	req_to_mmc_queue_req(req)->drv_op_data = idatas;
+@@ -643,6 +656,10 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md,
+ 	req = blk_get_request(mq->queue,
+ 		idata[0]->ic.write_flag ? REQ_OP_DRV_OUT : REQ_OP_DRV_IN,
+ 		__GFP_RECLAIM);
++	if (IS_ERR(req)) {
++		err = PTR_ERR(req);
++		goto cmd_err;
++	}
+ 	req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_IOCTL;
+ 	req_to_mmc_queue_req(req)->drv_op_data = idata;
+ 	req_to_mmc_queue_req(req)->ioc_count = num_of_cmds;
+@@ -2314,6 +2331,8 @@ static int mmc_dbg_card_status_get(void *data, u64 *val)
+ 
+ 	/* Ask the block layer about the card status */
+ 	req = blk_get_request(mq->queue, REQ_OP_DRV_IN, __GFP_RECLAIM);
++	if (IS_ERR(req))
++		return PTR_ERR(req);
+ 	req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS;
+ 	blk_execute_rq(mq->queue, NULL, req, 0);
+ 	ret = req_to_mmc_queue_req(req)->drv_op_result;
+@@ -2321,6 +2340,7 @@ static int mmc_dbg_card_status_get(void *data, u64 *val)
+ 		*val = ret;
+ 		ret = 0;
+ 	}
++	blk_put_request(req);
+ 
+ 	return ret;
+ }
+@@ -2347,10 +2367,15 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp)
+ 
+ 	/* Ask the block layer for the EXT CSD */
+ 	req = blk_get_request(mq->queue, REQ_OP_DRV_IN, __GFP_RECLAIM);
++	if (IS_ERR(req)) {
++		err = PTR_ERR(req);
++		goto out_free;
++	}
+ 	req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD;
+ 	req_to_mmc_queue_req(req)->drv_op_data = &ext_csd;
+ 	blk_execute_rq(mq->queue, NULL, req, 0);
+ 	err = req_to_mmc_queue_req(req)->drv_op_result;
++	blk_put_request(req);
+ 	if (err) {
+ 		pr_err("FAILED %d\n", err);
+ 		goto out_free;
+@@ -2396,7 +2421,7 @@ static const struct file_operations mmc_dbg_ext_csd_fops = {
+ 	.llseek		= default_llseek,
+ };
+ 
+-static int mmc_blk_add_debugfs(struct mmc_card *card)
++static int mmc_blk_add_debugfs(struct mmc_card *card, struct mmc_blk_data *md)
+ {
+ 	struct dentry *root;
+ 
+@@ -2406,28 +2431,53 @@ static int mmc_blk_add_debugfs(struct mmc_card *card)
+ 	root = card->debugfs_root;
+ 
+ 	if (mmc_card_mmc(card) || mmc_card_sd(card)) {
+-		if (!debugfs_create_file("status", S_IRUSR, root, card,
+-					 &mmc_dbg_card_status_fops))
++		md->status_dentry =
++			debugfs_create_file("status", S_IRUSR, root, card,
++					    &mmc_dbg_card_status_fops);
++		if (!md->status_dentry)
+ 			return -EIO;
+ 	}
+ 
+ 	if (mmc_card_mmc(card)) {
+-		if (!debugfs_create_file("ext_csd", S_IRUSR, root, card,
+-					 &mmc_dbg_ext_csd_fops))
++		md->ext_csd_dentry =
++			debugfs_create_file("ext_csd", S_IRUSR, root, card,
++					    &mmc_dbg_ext_csd_fops);
++		if (!md->ext_csd_dentry)
+ 			return -EIO;
+ 	}
+ 
+ 	return 0;
+ }
+ 
++static void mmc_blk_remove_debugfs(struct mmc_card *card,
++				   struct mmc_blk_data *md)
++{
++	if (!card->debugfs_root)
++		return;
++
++	if (!IS_ERR_OR_NULL(md->status_dentry)) {
++		debugfs_remove(md->status_dentry);
++		md->status_dentry = NULL;
++	}
++
++	if (!IS_ERR_OR_NULL(md->ext_csd_dentry)) {
++		debugfs_remove(md->ext_csd_dentry);
++		md->ext_csd_dentry = NULL;
++	}
++}
+ 
+ #else
+ 
+-static int mmc_blk_add_debugfs(struct mmc_card *card)
++static int mmc_blk_add_debugfs(struct mmc_card *card, struct mmc_blk_data *md)
+ {
+ 	return 0;
+ }
+ 
++static void mmc_blk_remove_debugfs(struct mmc_card *card,
++				   struct mmc_blk_data *md)
++{
++}
++
+ #endif /* CONFIG_DEBUG_FS */
+ 
+ static int mmc_blk_probe(struct mmc_card *card)
+@@ -2467,7 +2517,7 @@ static int mmc_blk_probe(struct mmc_card *card)
+ 	}
+ 
+ 	/* Add two debugfs entries */
+-	mmc_blk_add_debugfs(card);
++	mmc_blk_add_debugfs(card, md);
+ 
+ 	pm_runtime_set_autosuspend_delay(&card->dev, 3000);
+ 	pm_runtime_use_autosuspend(&card->dev);
+@@ -2493,6 +2543,7 @@ static void mmc_blk_remove(struct mmc_card *card)
+ {
+ 	struct mmc_blk_data *md = dev_get_drvdata(&card->dev);
+ 
++	mmc_blk_remove_debugfs(card, md);
+ 	mmc_blk_remove_parts(card, md);
+ 	pm_runtime_get_sync(&card->dev);
+ 	mmc_claim_host(card->host);
+diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
+index 301246513a37..7f428e387de3 100644
+--- a/drivers/mmc/core/bus.c
++++ b/drivers/mmc/core/bus.c
+@@ -157,6 +157,9 @@ static int mmc_bus_suspend(struct device *dev)
+ 		return ret;
+ 
+ 	ret = host->bus_ops->suspend(host);
++	if (ret)
++		pm_generic_resume(dev);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/mmc/core/debugfs.c b/drivers/mmc/core/debugfs.c
+index 01e459a34f33..0f4a7d7b2626 100644
+--- a/drivers/mmc/core/debugfs.c
++++ b/drivers/mmc/core/debugfs.c
+@@ -314,4 +314,5 @@ void mmc_add_card_debugfs(struct mmc_card *card)
+ void mmc_remove_card_debugfs(struct mmc_card *card)
+ {
+ 	debugfs_remove_recursive(card->debugfs_root);
++	card->debugfs_root = NULL;
+ }
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 36217ad5e9b1..bad5c1bf4ed9 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -780,7 +780,7 @@ MMC_DEV_ATTR(manfid, "0x%06x\n", card->cid.manfid);
+ MMC_DEV_ATTR(name, "%s\n", card->cid.prod_name);
+ MMC_DEV_ATTR(oemid, "0x%04x\n", card->cid.oemid);
+ MMC_DEV_ATTR(prv, "0x%x\n", card->cid.prv);
+-MMC_DEV_ATTR(pre_eol_info, "%02x\n", card->ext_csd.pre_eol_info);
++MMC_DEV_ATTR(pre_eol_info, "0x%02x\n", card->ext_csd.pre_eol_info);
+ MMC_DEV_ATTR(life_time, "0x%02x 0x%02x\n",
+ 	card->ext_csd.device_life_time_est_typ_a,
+ 	card->ext_csd.device_life_time_est_typ_b);
+@@ -790,7 +790,7 @@ MMC_DEV_ATTR(enhanced_area_offset, "%llu\n",
+ MMC_DEV_ATTR(enhanced_area_size, "%u\n", card->ext_csd.enhanced_area_size);
+ MMC_DEV_ATTR(raw_rpmb_size_mult, "%#x\n", card->ext_csd.raw_rpmb_size_mult);
+ MMC_DEV_ATTR(rel_sectors, "%#x\n", card->ext_csd.rel_sectors);
+-MMC_DEV_ATTR(ocr, "%08x\n", card->ocr);
++MMC_DEV_ATTR(ocr, "0x%08x\n", card->ocr);
+ MMC_DEV_ATTR(cmdq_en, "%d\n", card->ext_csd.cmdq_en);
+ 
+ static ssize_t mmc_fwrev_show(struct device *dev,
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index 4fd1620b732d..eb9de2134967 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -675,7 +675,7 @@ MMC_DEV_ATTR(manfid, "0x%06x\n", card->cid.manfid);
+ MMC_DEV_ATTR(name, "%s\n", card->cid.prod_name);
+ MMC_DEV_ATTR(oemid, "0x%04x\n", card->cid.oemid);
+ MMC_DEV_ATTR(serial, "0x%08x\n", card->cid.serial);
+-MMC_DEV_ATTR(ocr, "%08x\n", card->ocr);
++MMC_DEV_ATTR(ocr, "0x%08x\n", card->ocr);
+ 
+ 
+ static ssize_t mmc_dsr_show(struct device *dev,
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 0d5fcca18c9e..6152e83ff935 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -21,6 +21,7 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
+ #include <linux/scatterlist.h>
++#include <linux/swiotlb.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/of.h>
+@@ -3650,23 +3651,30 @@ int sdhci_setup_host(struct sdhci_host *host)
+ 
+ 	spin_lock_init(&host->lock);
+ 
++	/*
++	 * Maximum number of sectors in one transfer. Limited by SDMA boundary
++	 * size (512KiB). Note some tuning modes impose a 4MiB limit, but this
++	 * is less anyway.
++	 */
++	mmc->max_req_size = 524288;
++
+ 	/*
+ 	 * Maximum number of segments. Depends on if the hardware
+ 	 * can do scatter/gather or not.
+ 	 */
+-	if (host->flags & SDHCI_USE_ADMA)
++	if (host->flags & SDHCI_USE_ADMA) {
+ 		mmc->max_segs = SDHCI_MAX_SEGS;
+-	else if (host->flags & SDHCI_USE_SDMA)
++	} else if (host->flags & SDHCI_USE_SDMA) {
+ 		mmc->max_segs = 1;
+-	else /* PIO */
++		if (swiotlb_max_segment()) {
++			unsigned int max_req_size = (1 << IO_TLB_SHIFT) *
++						IO_TLB_SEGSIZE;
++			mmc->max_req_size = min(mmc->max_req_size,
++						max_req_size);
++		}
++	} else { /* PIO */
+ 		mmc->max_segs = SDHCI_MAX_SEGS;
+-
+-	/*
+-	 * Maximum number of sectors in one transfer. Limited by SDMA boundary
+-	 * size (512KiB). Note some tuning modes impose a 4MiB limit, but this
+-	 * is less anyway.
+-	 */
+-	mmc->max_req_size = 524288;
++	}
+ 
+ 	/*
+ 	 * Maximum segment size. Could be one segment with the maximum number
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+index 67163ca898ba..00a36df02a3f 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+@@ -113,7 +113,8 @@
+ #define NVM_SIZE_MULTIPLIER 4096	/*multiplier for NVMS field */
+ #define E1000_FLASH_BASE_ADDR 0xE000	/*offset of NVM access regs */
+ #define E1000_CTRL_EXT_NVMVS 0x3	/*NVM valid sector */
+-#define E1000_TARC0_CB_MULTIQ_3_REQ	(1 << 28 | 1 << 29)
++#define E1000_TARC0_CB_MULTIQ_3_REQ	0x30000000
++#define E1000_TARC0_CB_MULTIQ_2_REQ	0x20000000
+ #define PCIE_ICH8_SNOOP_ALL	PCIE_NO_SNOOP_ALL
+ 
+ #define E1000_ICH_RAR_ENTRIES	7
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index c38b00c90f48..991c2a0dd67e 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -3030,9 +3030,12 @@ static void e1000_configure_tx(struct e1000_adapter *adapter)
+ 		ew32(IOSFPC, reg_val);
+ 
+ 		reg_val = er32(TARC(0));
+-		/* SPT and KBL Si errata workaround to avoid Tx hang */
+-		reg_val &= ~BIT(28);
+-		reg_val |= BIT(29);
++		/* SPT and KBL Si errata workaround to avoid Tx hang.
++		 * Dropping the number of outstanding requests from
++		 * 3 to 2 in order to avoid a buffer overrun.
++		 */
++		reg_val &= ~E1000_TARC0_CB_MULTIQ_3_REQ;
++		reg_val |= E1000_TARC0_CB_MULTIQ_2_REQ;
+ 		ew32(TARC(0), reg_val);
+ 	}
+ }
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index d3f3c4447515..044af553204c 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -108,7 +108,7 @@ static inline struct nvme_request *nvme_req(struct request *req)
+  * NVME_QUIRK_DELAY_BEFORE_CHK_RDY quirk enabled. The value (in ms) was
+  * found empirically.
+  */
+-#define NVME_QUIRK_DELAY_AMOUNT		2000
++#define NVME_QUIRK_DELAY_AMOUNT		2300
+ 
+ enum nvme_ctrl_state {
+ 	NVME_CTRL_NEW,
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 3f5a04c586ce..75539f7c58b9 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2519,6 +2519,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ 		.driver_data = NVME_QUIRK_IDENTIFY_CNS, },
+ 	{ PCI_DEVICE(0x1c58, 0x0003),	/* HGST adapter */
+ 		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
++	{ PCI_DEVICE(0x1c58, 0x0023),	/* WDC SN200 adapter */
++		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
+ 	{ PCI_DEVICE(0x1c5f, 0x0540),	/* Memblaze Pblaze4 adapter */
+ 		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
+ 	{ PCI_DEVICE(0x144d, 0xa821),   /* Samsung PM1725 */
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index b4ed3dc983d5..b4224389febe 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -297,7 +297,7 @@ static int hp_wmi_hw_state(int mask)
+ 	if (state < 0)
+ 		return state;
+ 
+-	return state & 0x1;
++	return !!(state & mask);
+ }
+ 
+ static int __init hp_wmi_bios_2008_later(void)
+diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
+index d79ced925861..82e8f6edfb48 100644
+--- a/fs/autofs4/root.c
++++ b/fs/autofs4/root.c
+@@ -281,8 +281,8 @@ static int autofs4_mount_wait(const struct path *path, bool rcu_walk)
+ 		pr_debug("waiting for mount name=%pd\n", path->dentry);
+ 		status = autofs4_wait(sbi, path, NFY_MOUNT);
+ 		pr_debug("mount wait done status=%d\n", status);
+-		ino->last_used = jiffies;
+ 	}
++	ino->last_used = jiffies;
+ 	return status;
+ }
+ 
+@@ -321,21 +321,16 @@ static struct dentry *autofs4_mountpoint_changed(struct path *path)
+ 	 */
+ 	if (autofs_type_indirect(sbi->type) && d_unhashed(dentry)) {
+ 		struct dentry *parent = dentry->d_parent;
++		struct autofs_info *ino;
+ 		struct dentry *new;
+ 
+ 		new = d_lookup(parent, &dentry->d_name);
+ 		if (!new)
+ 			return NULL;
+-		if (new == dentry)
+-			dput(new);
+-		else {
+-			struct autofs_info *ino;
+-
+-			ino = autofs4_dentry_ino(new);
+-			ino->last_used = jiffies;
+-			dput(path->dentry);
+-			path->dentry = new;
+-		}
++		ino = autofs4_dentry_ino(new);
++		ino->last_used = jiffies;
++		dput(path->dentry);
++		path->dentry = new;
+ 	}
+ 	return path->dentry;
+ }
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 08698105fa4a..e4774c02d922 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -3526,13 +3526,6 @@ static int cache_save_setup(struct btrfs_block_group_cache *block_group,
+ 		goto again;
+ 	}
+ 
+-	/* We've already setup this transaction, go ahead and exit */
+-	if (block_group->cache_generation == trans->transid &&
+-	    i_size_read(inode)) {
+-		dcs = BTRFS_DC_SETUP;
+-		goto out_put;
+-	}
+-
+ 	/*
+ 	 * We want to set the generation to 0, that way if anything goes wrong
+ 	 * from here on out we know not to trust this cache when we load up next
+@@ -3556,6 +3549,13 @@ static int cache_save_setup(struct btrfs_block_group_cache *block_group,
+ 	}
+ 	WARN_ON(ret);
+ 
++	/* We've already setup this transaction, go ahead and exit */
++	if (block_group->cache_generation == trans->transid &&
++	    i_size_read(inode)) {
++		dcs = BTRFS_DC_SETUP;
++		goto out_put;
++	}
++
+ 	if (i_size_read(inode) > 0) {
+ 		ret = btrfs_check_trunc_cache_free_space(fs_info,
+ 					&fs_info->global_block_rsv);
+diff --git a/fs/exec.c b/fs/exec.c
+index 3e14ba25f678..4726c777dd38 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1340,10 +1340,15 @@ void setup_new_exec(struct linux_binprm * bprm)
+ 		 * avoid bad behavior from the prior rlimits. This has to
+ 		 * happen before arch_pick_mmap_layout(), which examines
+ 		 * RLIMIT_STACK, but after the point of no return to avoid
+-		 * needing to clean up the change on failure.
++		 * races from other threads changing the limits. This also
++		 * must be protected from races with prlimit() calls.
+ 		 */
++		task_lock(current->group_leader);
+ 		if (current->signal->rlim[RLIMIT_STACK].rlim_cur > _STK_LIM)
+ 			current->signal->rlim[RLIMIT_STACK].rlim_cur = _STK_LIM;
++		if (current->signal->rlim[RLIMIT_STACK].rlim_max > _STK_LIM)
++			current->signal->rlim[RLIMIT_STACK].rlim_max = _STK_LIM;
++		task_unlock(current->group_leader);
+ 	}
+ 
+ 	arch_pick_mmap_layout(current->mm);
+diff --git a/fs/fat/inode.c b/fs/fat/inode.c
+index 30c52394a7ad..c7a4dee206b9 100644
+--- a/fs/fat/inode.c
++++ b/fs/fat/inode.c
+@@ -779,7 +779,7 @@ static void __exit fat_destroy_inodecache(void)
+ 
+ static int fat_remount(struct super_block *sb, int *flags, char *data)
+ {
+-	int new_rdonly;
++	bool new_rdonly;
+ 	struct msdos_sb_info *sbi = MSDOS_SB(sb);
+ 	*flags |= MS_NODIRATIME | (sbi->options.isvfat ? 0 : MS_NOATIME);
+ 
+diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
+index f04ecfc7ece0..45e96549ebd2 100644
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -274,6 +274,8 @@ static void lockd_down_net(struct svc_serv *serv, struct net *net)
+ 	if (ln->nlmsvc_users) {
+ 		if (--ln->nlmsvc_users == 0) {
+ 			nlm_shutdown_hosts_net(net);
++			cancel_delayed_work_sync(&ln->grace_period_end);
++			locks_end_grace(&ln->lockd_manager);
+ 			svc_shutdown_net(serv, net);
+ 			dprintk("lockd_down_net: per-net data destroyed; net=%p\n", net);
+ 		}
+diff --git a/fs/namei.c b/fs/namei.c
+index ed8b9488a890..62a0db6e6725 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1129,18 +1129,9 @@ static int follow_automount(struct path *path, struct nameidata *nd,
+ 	 * of the daemon to instantiate them before they can be used.
+ 	 */
+ 	if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
+-			   LOOKUP_OPEN | LOOKUP_CREATE |
+-			   LOOKUP_AUTOMOUNT))) {
+-		/* Positive dentry that isn't meant to trigger an
+-		 * automount, EISDIR will allow it to be used,
+-		 * otherwise there's no mount here "now" so return
+-		 * ENOENT.
+-		 */
+-		if (path->dentry->d_inode)
+-			return -EISDIR;
+-		else
+-			return -ENOENT;
+-	}
++			   LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
++	    path->dentry->d_inode)
++		return -EISDIR;
+ 
+ 	if (path->dentry->d_sb->s_user_ns != &init_user_ns)
+ 		return -EACCES;
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index d386d569edbc..a439a70177a4 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3512,7 +3512,9 @@ nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
+ 		/* ignore lock owners */
+ 		if (local->st_stateowner->so_is_open_owner == 0)
+ 			continue;
+-		if (local->st_stateowner == &oo->oo_owner) {
++		if (local->st_stateowner != &oo->oo_owner)
++			continue;
++		if (local->st_stid.sc_type == NFS4_OPEN_STID) {
+ 			ret = local;
+ 			atomic_inc(&ret->st_stid.sc_count);
+ 			break;
+@@ -3521,6 +3523,52 @@ nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
+ 	return ret;
+ }
+ 
++static __be32
++nfsd4_verify_open_stid(struct nfs4_stid *s)
++{
++	__be32 ret = nfs_ok;
++
++	switch (s->sc_type) {
++	default:
++		break;
++	case NFS4_CLOSED_STID:
++	case NFS4_CLOSED_DELEG_STID:
++		ret = nfserr_bad_stateid;
++		break;
++	case NFS4_REVOKED_DELEG_STID:
++		ret = nfserr_deleg_revoked;
++	}
++	return ret;
++}
++
++/* Lock the stateid st_mutex, and deal with races with CLOSE */
++static __be32
++nfsd4_lock_ol_stateid(struct nfs4_ol_stateid *stp)
++{
++	__be32 ret;
++
++	mutex_lock(&stp->st_mutex);
++	ret = nfsd4_verify_open_stid(&stp->st_stid);
++	if (ret != nfs_ok)
++		mutex_unlock(&stp->st_mutex);
++	return ret;
++}
++
++static struct nfs4_ol_stateid *
++nfsd4_find_and_lock_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
++{
++	struct nfs4_ol_stateid *stp;
++	for (;;) {
++		spin_lock(&fp->fi_lock);
++		stp = nfsd4_find_existing_open(fp, open);
++		spin_unlock(&fp->fi_lock);
++		if (!stp || nfsd4_lock_ol_stateid(stp) == nfs_ok)
++			break;
++		nfs4_put_stid(&stp->st_stid);
++	}
++	return stp;
++}
++
+ static struct nfs4_openowner *
+ alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
+ 			   struct nfsd4_compound_state *cstate)
+@@ -3565,6 +3613,7 @@ init_open_stateid(struct nfs4_file *fp, struct nfsd4_open *open)
+ 	mutex_init(&stp->st_mutex);
+ 	mutex_lock(&stp->st_mutex);
+ 
++retry:
+ 	spin_lock(&oo->oo_owner.so_client->cl_lock);
+ 	spin_lock(&fp->fi_lock);
+ 
+@@ -3589,7 +3638,11 @@ init_open_stateid(struct nfs4_file *fp, struct nfsd4_open *open)
+ 	spin_unlock(&fp->fi_lock);
+ 	spin_unlock(&oo->oo_owner.so_client->cl_lock);
+ 	if (retstp) {
+-		mutex_lock(&retstp->st_mutex);
++		/* Handle races with CLOSE */
++		if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
++			nfs4_put_stid(&retstp->st_stid);
++			goto retry;
++		}
+ 		/* To keep mutex tracking happy */
+ 		mutex_unlock(&stp->st_mutex);
+ 		stp = retstp;
+@@ -4399,6 +4452,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
+ 	struct nfs4_ol_stateid *stp = NULL;
+ 	struct nfs4_delegation *dp = NULL;
+ 	__be32 status;
++	bool new_stp = false;
+ 
+ 	/*
+ 	 * Lookup file; if found, lookup stateid and check open request,
+@@ -4410,9 +4464,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
+ 		status = nfs4_check_deleg(cl, open, &dp);
+ 		if (status)
+ 			goto out;
+-		spin_lock(&fp->fi_lock);
+-		stp = nfsd4_find_existing_open(fp, open);
+-		spin_unlock(&fp->fi_lock);
++		stp = nfsd4_find_and_lock_existing_open(fp, open);
+ 	} else {
+ 		open->op_file = NULL;
+ 		status = nfserr_bad_stateid;
+@@ -4420,35 +4472,31 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
+ 			goto out;
+ 	}
+ 
++	if (!stp) {
++		stp = init_open_stateid(fp, open);
++		if (!open->op_stp)
++			new_stp = true;
++	}
++
+ 	/*
+ 	 * OPEN the file, or upgrade an existing OPEN.
+ 	 * If truncate fails, the OPEN fails.
++	 *
++	 * stp is already locked.
+ 	 */
+-	if (stp) {
++	if (!new_stp) {
+ 		/* Stateid was found, this is an OPEN upgrade */
+-		mutex_lock(&stp->st_mutex);
+ 		status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
+ 		if (status) {
+ 			mutex_unlock(&stp->st_mutex);
+ 			goto out;
+ 		}
+ 	} else {
+-		/* stp is returned locked. */
+-		stp = init_open_stateid(fp, open);
+-		/* See if we lost the race to some other thread */
+-		if (stp->st_access_bmap != 0) {
+-			status = nfs4_upgrade_open(rqstp, fp, current_fh,
+-						stp, open);
+-			if (status) {
+-				mutex_unlock(&stp->st_mutex);
+-				goto out;
+-			}
+-			goto upgrade_out;
+-		}
+ 		status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
+ 		if (status) {
+-			mutex_unlock(&stp->st_mutex);
++			stp->st_stid.sc_type = NFS4_CLOSED_STID;
+ 			release_open_stateid(stp);
++			mutex_unlock(&stp->st_mutex);
+ 			goto out;
+ 		}
+ 
+@@ -4457,7 +4505,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
+ 		if (stp->st_clnt_odstate == open->op_odstate)
+ 			open->op_odstate = NULL;
+ 	}
+-upgrade_out:
++
+ 	nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid);
+ 	mutex_unlock(&stp->st_mutex);
+ 
+@@ -4684,7 +4732,7 @@ nfs4_laundromat(struct nfsd_net *nn)
+ 	spin_unlock(&nn->blocked_locks_lock);
+ 
+ 	while (!list_empty(&reaplist)) {
+-		nbl = list_first_entry(&nn->blocked_locks_lru,
++		nbl = list_first_entry(&reaplist,
+ 					struct nfsd4_blocked_lock, nbl_lru);
+ 		list_del_init(&nbl->nbl_lru);
+ 		posix_unblock_lock(&nbl->nbl_lock);
+@@ -5317,7 +5365,6 @@ static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
+ 	bool unhashed;
+ 	LIST_HEAD(reaplist);
+ 
+-	s->st_stid.sc_type = NFS4_CLOSED_STID;
+ 	spin_lock(&clp->cl_lock);
+ 	unhashed = unhash_open_stateid(s, &reaplist);
+ 
+@@ -5357,10 +5404,12 @@ nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 	nfsd4_bump_seqid(cstate, status);
+ 	if (status)
+ 		goto out; 
++
++	stp->st_stid.sc_type = NFS4_CLOSED_STID;
+ 	nfs4_inc_and_copy_stateid(&close->cl_stateid, &stp->st_stid);
+-	mutex_unlock(&stp->st_mutex);
+ 
+ 	nfsd4_close_open_stateid(stp);
++	mutex_unlock(&stp->st_mutex);
+ 
+ 	/* put reference from nfs4_preprocess_seqid_op */
+ 	nfs4_put_stid(&stp->st_stid);
+@@ -7103,7 +7152,7 @@ nfs4_state_shutdown_net(struct net *net)
+ 	spin_unlock(&nn->blocked_locks_lock);
+ 
+ 	while (!list_empty(&reaplist)) {
+-		nbl = list_first_entry(&nn->blocked_locks_lru,
++		nbl = list_first_entry(&reaplist,
+ 					struct nfsd4_blocked_lock, nbl_lru);
+ 		list_del_init(&nbl->nbl_lru);
+ 		posix_unblock_lock(&nbl->nbl_lock);
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index fa1505292f6c..324a04df3785 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -105,6 +105,7 @@ enum acpi_bus_device_type {
+ 	ACPI_BUS_TYPE_THERMAL,
+ 	ACPI_BUS_TYPE_POWER_BUTTON,
+ 	ACPI_BUS_TYPE_SLEEP_BUTTON,
++	ACPI_BUS_TYPE_ECDT_EC,
+ 	ACPI_BUS_DEVICE_TYPE_COUNT
+ };
+ 
+diff --git a/include/acpi/acpi_drivers.h b/include/acpi/acpi_drivers.h
+index 29c691265b49..14499757338f 100644
+--- a/include/acpi/acpi_drivers.h
++++ b/include/acpi/acpi_drivers.h
+@@ -58,6 +58,7 @@
+ #define ACPI_VIDEO_HID			"LNXVIDEO"
+ #define ACPI_BAY_HID			"LNXIOBAY"
+ #define ACPI_DOCK_HID			"LNXDOCK"
++#define ACPI_ECDT_HID			"LNXEC"
+ /* Quirk for broken IBM BIOSes */
+ #define ACPI_SMBUS_IBM_HID		"SMBUSIBM"
+ 
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
+index 757dc6ffc7ba..1ac457511f4e 100644
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -814,6 +814,14 @@ static inline int pmd_write(pmd_t pmd)
+ #endif /* __HAVE_ARCH_PMD_WRITE */
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+ 
++#ifndef pud_write
++static inline int pud_write(pud_t pud)
++{
++	BUG();
++	return 0;
++}
++#endif /* pud_write */
++
+ #if !defined(CONFIG_TRANSPARENT_HUGEPAGE) || \
+ 	(defined(CONFIG_TRANSPARENT_HUGEPAGE) && \
+ 	 !defined(CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD))
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index 75ec9c662268..aeec003a566b 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -255,6 +255,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 		   unsigned int ivsize);
+ ssize_t af_alg_sendpage(struct socket *sock, struct page *page,
+ 			int offset, size_t size, int flags);
++void af_alg_free_resources(struct af_alg_async_req *areq);
+ void af_alg_async_cb(struct crypto_async_request *_req, int err);
+ unsigned int af_alg_poll(struct file *file, struct socket *sock,
+ 			 poll_table *wait);
+diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h
+index 1e1908a6b1d6..a992434ded99 100644
+--- a/include/drm/drm_edid.h
++++ b/include/drm/drm_edid.h
+@@ -360,7 +360,8 @@ void
+ drm_hdmi_avi_infoframe_quant_range(struct hdmi_avi_infoframe *frame,
+ 				   const struct drm_display_mode *mode,
+ 				   enum hdmi_quantization_range rgb_quant_range,
+-				   bool rgb_quant_range_selectable);
++				   bool rgb_quant_range_selectable,
++				   bool is_hdmi2_sink);
+ 
+ /**
+  * drm_eld_mnl - Get ELD monitor name length in bytes.
+diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
+index 54dfef70a072..780b1242bf24 100644
+--- a/include/linux/compiler-clang.h
++++ b/include/linux/compiler-clang.h
+@@ -16,3 +16,6 @@
+  * with any version that can compile the kernel
+  */
+ #define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
++
++#define randomized_struct_fields_start	struct {
++#define randomized_struct_fields_end	};
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 885266aae2d7..440281f8564d 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -3069,7 +3069,8 @@ static inline int vfs_lstat(const char __user *name, struct kstat *stat)
+ static inline int vfs_fstatat(int dfd, const char __user *filename,
+ 			      struct kstat *stat, int flags)
+ {
+-	return vfs_statx(dfd, filename, flags, stat, STATX_BASIC_STATS);
++	return vfs_statx(dfd, filename, flags | AT_NO_AUTOMOUNT,
++			 stat, STATX_BASIC_STATS);
+ }
+ static inline int vfs_fstat(int fd, struct kstat *stat)
+ {
+@@ -3175,6 +3176,20 @@ static inline bool vma_is_dax(struct vm_area_struct *vma)
+ 	return vma->vm_file && IS_DAX(vma->vm_file->f_mapping->host);
+ }
+ 
++static inline bool vma_is_fsdax(struct vm_area_struct *vma)
++{
++	struct inode *inode;
++
++	if (!vma->vm_file)
++		return false;
++	if (!vma_is_dax(vma))
++		return false;
++	inode = file_inode(vma->vm_file);
++	if (inode->i_mode == S_IFCHR)
++		return false; /* device-dax */
++	return true;
++}
++
+ static inline int iocb_flags(struct file *file)
+ {
+ 	int res = 0;
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index fbf5b31d47ee..82a25880714a 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -239,14 +239,6 @@ static inline int pgd_write(pgd_t pgd)
+ }
+ #endif
+ 
+-#ifndef pud_write
+-static inline int pud_write(pud_t pud)
+-{
+-	BUG();
+-	return 0;
+-}
+-#endif
+-
+ #define HUGETLB_ANON_FILE "anon_hugepage"
+ 
+ enum {
+diff --git a/include/linux/migrate.h b/include/linux/migrate.h
+index 895ec0c4942e..a2246cf670ba 100644
+--- a/include/linux/migrate.h
++++ b/include/linux/migrate.h
+@@ -54,7 +54,7 @@ static inline struct page *new_page_nodemask(struct page *page,
+ 	new_page = __alloc_pages_nodemask(gfp_mask, order,
+ 				preferred_nid, nodemask);
+ 
+-	if (new_page && PageTransHuge(page))
++	if (new_page && PageTransHuge(new_page))
+ 		prep_transhuge_page(new_page);
+ 
+ 	return new_page;
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 43edf659453b..db647d428100 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -367,6 +367,7 @@ enum page_entry_size {
+ struct vm_operations_struct {
+ 	void (*open)(struct vm_area_struct * area);
+ 	void (*close)(struct vm_area_struct * area);
++	int (*split)(struct vm_area_struct * area, unsigned long addr);
+ 	int (*mremap)(struct vm_area_struct * area);
+ 	int (*fault)(struct vm_fault *vmf);
+ 	int (*huge_fault)(struct vm_fault *vmf, enum page_entry_size pe_size);
+@@ -1367,6 +1368,19 @@ long get_user_pages_locked(unsigned long start, unsigned long nr_pages,
+ 		    unsigned int gup_flags, struct page **pages, int *locked);
+ long get_user_pages_unlocked(unsigned long start, unsigned long nr_pages,
+ 		    struct page **pages, unsigned int gup_flags);
++#ifdef CONFIG_FS_DAX
++long get_user_pages_longterm(unsigned long start, unsigned long nr_pages,
++			    unsigned int gup_flags, struct page **pages,
++			    struct vm_area_struct **vmas);
++#else
++static inline long get_user_pages_longterm(unsigned long start,
++		unsigned long nr_pages, unsigned int gup_flags,
++		struct page **pages, struct vm_area_struct **vmas)
++{
++	return get_user_pages(start, nr_pages, gup_flags, pages, vmas);
++}
++#endif /* CONFIG_FS_DAX */
++
+ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ 			struct page **pages);
+ 
+diff --git a/include/uapi/linux/bcache.h b/include/uapi/linux/bcache.h
+index 90fc490f973f..821f71a2e48f 100644
+--- a/include/uapi/linux/bcache.h
++++ b/include/uapi/linux/bcache.h
+@@ -91,7 +91,7 @@ PTR_FIELD(PTR_GEN,			0,  8)
+ 
+ #define PTR_CHECK_DEV			((1 << PTR_DEV_BITS) - 1)
+ 
+-#define PTR(gen, offset, dev)						\
++#define MAKE_PTR(gen, offset, dev)					\
+ 	((((__u64) dev) << 51) | ((__u64) offset) << 8 | gen)
+ 
+ /* Bkey utility code */
+diff --git a/mm/frame_vector.c b/mm/frame_vector.c
+index 2f98df0d460e..297c7238f7d4 100644
+--- a/mm/frame_vector.c
++++ b/mm/frame_vector.c
+@@ -53,6 +53,18 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames,
+ 		ret = -EFAULT;
+ 		goto out;
+ 	}
++
++	/*
++	 * While get_vaddr_frames() could be used for transient (kernel
++	 * controlled lifetime) pinning of memory pages all current
++	 * users establish long term (userspace controlled lifetime)
++	 * page pinning. Treat get_vaddr_frames() like
++	 * get_user_pages_longterm() and disallow it for filesystem-dax
++	 * mappings.
++	 */
++	if (vma_is_fsdax(vma))
++		return -EOPNOTSUPP;
++
+ 	if (!(vma->vm_flags & (VM_IO | VM_PFNMAP))) {
+ 		vec->got_ref = true;
+ 		vec->is_pfns = false;
+diff --git a/mm/gup.c b/mm/gup.c
+index b2b4d4263768..165ba2174c75 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -1095,6 +1095,70 @@ long get_user_pages(unsigned long start, unsigned long nr_pages,
+ }
+ EXPORT_SYMBOL(get_user_pages);
+ 
++#ifdef CONFIG_FS_DAX
++/*
++ * This is the same as get_user_pages() in that it assumes we are
++ * operating on the current task's mm, but it goes further to validate
++ * that the vmas associated with the address range are suitable for
++ * longterm elevated page reference counts. For example, filesystem-dax
++ * mappings are subject to the lifetime enforced by the filesystem and
++ * we need guarantees that longterm users like RDMA and V4L2 only
++ * establish mappings that have a kernel enforced revocation mechanism.
++ *
++ * "longterm" == userspace controlled elevated page count lifetime.
++ * Contrast this to iov_iter_get_pages() usages which are transient.
++ */
++long get_user_pages_longterm(unsigned long start, unsigned long nr_pages,
++		unsigned int gup_flags, struct page **pages,
++		struct vm_area_struct **vmas_arg)
++{
++	struct vm_area_struct **vmas = vmas_arg;
++	struct vm_area_struct *vma_prev = NULL;
++	long rc, i;
++
++	if (!pages)
++		return -EINVAL;
++
++	if (!vmas) {
++		vmas = kcalloc(nr_pages, sizeof(struct vm_area_struct *),
++			       GFP_KERNEL);
++		if (!vmas)
++			return -ENOMEM;
++	}
++
++	rc = get_user_pages(start, nr_pages, gup_flags, pages, vmas);
++
++	for (i = 0; i < rc; i++) {
++		struct vm_area_struct *vma = vmas[i];
++
++		if (vma == vma_prev)
++			continue;
++
++		vma_prev = vma;
++
++		if (vma_is_fsdax(vma))
++			break;
++	}
++
++	/*
++	 * Either get_user_pages() failed, or the vma validation
++	 * succeeded, in either case we don't need to put_page() before
++	 * returning.
++	 */
++	if (i >= rc)
++		goto out;
++
++	for (i = 0; i < rc; i++)
++		put_page(pages[i]);
++	rc = -EOPNOTSUPP;
++out:
++	if (vmas != vmas_arg)
++		kfree(vmas);
++	return rc;
++}
++EXPORT_SYMBOL(get_user_pages_longterm);
++#endif /* CONFIG_FS_DAX */
++
+ /**
+  * populate_vma_page_range() -  populate a range of pages in the vma.
+  * @vma:   target vma
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 1981ed697dab..eba34cdfc3e5 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -842,20 +842,15 @@ EXPORT_SYMBOL_GPL(vmf_insert_pfn_pud);
+ #endif /* CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */
+ 
+ static void touch_pmd(struct vm_area_struct *vma, unsigned long addr,
+-		pmd_t *pmd)
++		pmd_t *pmd, int flags)
+ {
+ 	pmd_t _pmd;
+ 
+-	/*
+-	 * We should set the dirty bit only for FOLL_WRITE but for now
+-	 * the dirty bit in the pmd is meaningless.  And if the dirty
+-	 * bit will become meaningful and we'll only set it with
+-	 * FOLL_WRITE, an atomic set_bit will be required on the pmd to
+-	 * set the young bit, instead of the current set_pmd_at.
+-	 */
+-	_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
++	_pmd = pmd_mkyoung(*pmd);
++	if (flags & FOLL_WRITE)
++		_pmd = pmd_mkdirty(_pmd);
+ 	if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
+-				pmd, _pmd,  1))
++				pmd, _pmd, flags & FOLL_WRITE))
+ 		update_mmu_cache_pmd(vma, addr, pmd);
+ }
+ 
+@@ -884,7 +879,7 @@ struct page *follow_devmap_pmd(struct vm_area_struct *vma, unsigned long addr,
+ 		return NULL;
+ 
+ 	if (flags & FOLL_TOUCH)
+-		touch_pmd(vma, addr, pmd);
++		touch_pmd(vma, addr, pmd, flags);
+ 
+ 	/*
+ 	 * device mapped pages can only be returned if the
+@@ -995,20 +990,15 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
+ 
+ #ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
+ static void touch_pud(struct vm_area_struct *vma, unsigned long addr,
+-		pud_t *pud)
++		pud_t *pud, int flags)
+ {
+ 	pud_t _pud;
+ 
+-	/*
+-	 * We should set the dirty bit only for FOLL_WRITE but for now
+-	 * the dirty bit in the pud is meaningless.  And if the dirty
+-	 * bit will become meaningful and we'll only set it with
+-	 * FOLL_WRITE, an atomic set_bit will be required on the pud to
+-	 * set the young bit, instead of the current set_pud_at.
+-	 */
+-	_pud = pud_mkyoung(pud_mkdirty(*pud));
++	_pud = pud_mkyoung(*pud);
++	if (flags & FOLL_WRITE)
++		_pud = pud_mkdirty(_pud);
+ 	if (pudp_set_access_flags(vma, addr & HPAGE_PUD_MASK,
+-				pud, _pud,  1))
++				pud, _pud, flags & FOLL_WRITE))
+ 		update_mmu_cache_pud(vma, addr, pud);
+ }
+ 
+@@ -1031,7 +1021,7 @@ struct page *follow_devmap_pud(struct vm_area_struct *vma, unsigned long addr,
+ 		return NULL;
+ 
+ 	if (flags & FOLL_TOUCH)
+-		touch_pud(vma, addr, pud);
++		touch_pud(vma, addr, pud, flags);
+ 
+ 	/*
+ 	 * device mapped pages can only be returned if the
+@@ -1407,7 +1397,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
+ 	page = pmd_page(*pmd);
+ 	VM_BUG_ON_PAGE(!PageHead(page) && !is_zone_device_page(page), page);
+ 	if (flags & FOLL_TOUCH)
+-		touch_pmd(vma, addr, pmd);
++		touch_pmd(vma, addr, pmd, flags);
+ 	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
+ 		/*
+ 		 * We don't mlock() pte-mapped THPs. This way we can avoid
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 2d2ff5e8bf2b..c539941671b4 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3125,6 +3125,13 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
+ 	}
+ }
+ 
++static int hugetlb_vm_op_split(struct vm_area_struct *vma, unsigned long addr)
++{
++	if (addr & ~(huge_page_mask(hstate_vma(vma))))
++		return -EINVAL;
++	return 0;
++}
++
+ /*
+  * We cannot handle pagefaults against hugetlb pages at all.  They cause
+  * handle_mm_fault() to try to instantiate regular-sized pages in the
+@@ -3141,6 +3148,7 @@ const struct vm_operations_struct hugetlb_vm_ops = {
+ 	.fault = hugetlb_vm_op_fault,
+ 	.open = hugetlb_vm_op_open,
+ 	.close = hugetlb_vm_op_close,
++	.split = hugetlb_vm_op_split,
+ };
+ 
+ static pte_t make_huge_pte(struct vm_area_struct *vma, struct page *page,
+@@ -4617,7 +4625,9 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
+ 	pte_t *pte = NULL;
+ 
+ 	pgd = pgd_offset(mm, addr);
+-	p4d = p4d_offset(pgd, addr);
++	p4d = p4d_alloc(mm, pgd, addr);
++	if (!p4d)
++		return NULL;
+ 	pud = pud_alloc(mm, p4d, addr);
+ 	if (pud) {
+ 		if (sz == PUD_SIZE) {
+diff --git a/mm/madvise.c b/mm/madvise.c
+index 375cf32087e4..751e97aa2210 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -276,15 +276,14 @@ static long madvise_willneed(struct vm_area_struct *vma,
+ {
+ 	struct file *file = vma->vm_file;
+ 
++	*prev = vma;
+ #ifdef CONFIG_SWAP
+ 	if (!file) {
+-		*prev = vma;
+ 		force_swapin_readahead(vma, start, end);
+ 		return 0;
+ 	}
+ 
+ 	if (shmem_mapping(file->f_mapping)) {
+-		*prev = vma;
+ 		force_shm_swapin_readahead(vma, start, end,
+ 					file->f_mapping);
+ 		return 0;
+@@ -299,7 +298,6 @@ static long madvise_willneed(struct vm_area_struct *vma,
+ 		return 0;
+ 	}
+ 
+-	*prev = vma;
+ 	start = ((start - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
+ 	if (end > vma->vm_end)
+ 		end = vma->vm_end;
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 661f046ad318..53f7c919b916 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6044,7 +6044,7 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
+ 	memcg_check_events(memcg, page);
+ 
+ 	if (!mem_cgroup_is_root(memcg))
+-		css_put(&memcg->css);
++		css_put_many(&memcg->css, nr_entries);
+ }
+ 
+ /**
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 680506faceae..476e810cf100 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2540,9 +2540,11 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	struct vm_area_struct *new;
+ 	int err;
+ 
+-	if (is_vm_hugetlb_page(vma) && (addr &
+-					~(huge_page_mask(hstate_vma(vma)))))
+-		return -EINVAL;
++	if (vma->vm_ops && vma->vm_ops->split) {
++		err = vma->vm_ops->split(vma, addr);
++		if (err)
++			return err;
++	}
+ 
+ 	new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
+ 	if (!new)
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index dee0f75c3013..18c5b356b505 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -532,7 +532,6 @@ static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm)
+ 	 */
+ 	set_bit(MMF_UNSTABLE, &mm->flags);
+ 
+-	tlb_gather_mmu(&tlb, mm, 0, -1);
+ 	for (vma = mm->mmap ; vma; vma = vma->vm_next) {
+ 		if (!can_madv_dontneed_vma(vma))
+ 			continue;
+@@ -547,11 +546,13 @@ static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm)
+ 		 * we do not want to block exit_mmap by keeping mm ref
+ 		 * count elevated without a good reason.
+ 		 */
+-		if (vma_is_anonymous(vma) || !(vma->vm_flags & VM_SHARED))
++		if (vma_is_anonymous(vma) || !(vma->vm_flags & VM_SHARED)) {
++			tlb_gather_mmu(&tlb, mm, vma->vm_start, vma->vm_end);
+ 			unmap_page_range(&tlb, vma, vma->vm_start, vma->vm_end,
+ 					 NULL);
++			tlb_finish_mmu(&tlb, vma->vm_start, vma->vm_end);
++		}
+ 	}
+-	tlb_finish_mmu(&tlb, 0, -1);
+ 	pr_info("oom_reaper: reaped process %d (%s), now anon-rss:%lukB, file-rss:%lukB, shmem-rss:%lukB\n",
+ 			task_pid_nr(tsk), tsk->comm,
+ 			K(get_mm_counter(mm, MM_ANONPAGES)),
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 82a6270c9743..d51c2087c498 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2487,10 +2487,6 @@ void drain_all_pages(struct zone *zone)
+ 	if (WARN_ON_ONCE(!mm_percpu_wq))
+ 		return;
+ 
+-	/* Workqueues cannot recurse */
+-	if (current->flags & PF_WQ_WORKER)
+-		return;
+-
+ 	/*
+ 	 * Do not drain if one is already in progress unless it's specific to
+ 	 * a zone. Such callers are primarily CMA and memory hotplug and need
+@@ -7591,11 +7587,18 @@ int alloc_contig_range(unsigned long start, unsigned long end,
+ 
+ 	/*
+ 	 * In case of -EBUSY, we'd like to know which page causes problem.
+-	 * So, just fall through. We will check it in test_pages_isolated().
++	 * So, just fall through. test_pages_isolated() has a tracepoint
++	 * which will report the busy page.
++	 *
++	 * It is possible that busy pages could become available before
++	 * the call to test_pages_isolated, and the range will actually be
++	 * allocated.  So, if we fall through be sure to clear ret so that
++	 * -EBUSY is not accidentally used or returned to caller.
+ 	 */
+ 	ret = __alloc_contig_migrate_range(&cc, start, end);
+ 	if (ret && ret != -EBUSY)
+ 		goto done;
++	ret =0;
+ 
+ 	/*
+ 	 * Pages from [start, end) are within a MAX_ORDER_NR_PAGES
+diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
+index 620e81169659..4ac095118717 100644
+--- a/security/apparmor/include/audit.h
++++ b/security/apparmor/include/audit.h
+@@ -121,17 +121,19 @@ struct apparmor_audit_data {
+ 		/* these entries require a custom callback fn */
+ 		struct {
+ 			struct aa_label *peer;
+-			struct {
+-				const char *target;
+-				kuid_t ouid;
+-			} fs;
++			union {
++				struct {
++					const char *target;
++					kuid_t ouid;
++				} fs;
++				int signal;
++			};
+ 		};
+ 		struct {
+ 			struct aa_profile *profile;
+ 			const char *ns;
+ 			long pos;
+ 		} iface;
+-		int signal;
+ 		struct {
+ 			int rlim;
+ 			unsigned long max;