diff --git a/.elts/config.yaml b/.elts/config.yaml
index 03fdce3..c9967f9 100644
--- a/.elts/config.yaml
+++ b/.elts/config.yaml
@@ -1,5 +1,5 @@
 upstream_repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
 upstream_base: 4.19.304
 base: 4.14.336
-upstream_version: 4.19.311
-version: 4.14.344
+upstream_version: 4.19.312
+version: 4.14.345
diff --git a/.elts/meta/4.14.345.yaml b/.elts/meta/4.14.345.yaml
new file mode 100644
index 0000000..d754d46
--- /dev/null
+++ b/.elts/meta/4.14.345.yaml
@@ -0,0 +1,559 @@
+30155e4316fd08d7ca77ca14772dc3fd32088ab7:
+  title: 'Documentation/hw-vuln: Update spectre doc'
+  mainline: 06cb31cc761823ef444ba4e1df11347342a6e745
+  upstream: 3e4f86cfda46ef6320f385b80496d3f65d5ed63d
+169885159d59ee3cb6482d4ec9799d11ee61477d:
+  title: 'x86/cpu: Support AMD Automatic IBRS'
+  mainline: e7862eda309ecfccc36bb5558d937ed3ace07f3f
+  upstream: a7268b3424863578814d99a1dd603f6bb5b9f977
+2c6281927b58e02df6ffda6f8f860207634d8616:
+  title: 'x86/pti: Don''t report XenPV as vulnerable'
+  mainline: 6cb2b08ff92460290979de4be91363e5d1b6cec1
+a50c4e98d9d3103cd8b418fdac2aff45d6a91cf6:
+  title: 'x86/bugs: Use sysfs_emit()'
+  mainline: 1d30800c0c0ae1d086ffad2bdf0ba4403370f132
+  upstream: 205bf06008b8ea128ae8f643c21fb32fe4165416
+b361dfb73f7cf65487d75cc4b7e755ddc22db3cf:
+  title: 'wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach'
+  mainline: 0f7352557a35ab7888bc7831411ec8a3cbe20d78
+  upstream: 202c503935042272e2f9e1bb549d5f69a8681169
+d780b7417a456b366c4ca6a8cfe0e439769e8656:
+  title: 'smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()'
+  mainline: 9c82169208dde516510aaba6bbd8b13976690c5d
+  upstream: b4cbf54183220cc35e19c21d970505c4eae0faa4
+003fe24b3f4ffda82e27f3301099888060f01c97:
+  title: 'smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()'
+  mainline: ac02f007d64eb2769d0bde742aac4d7a5fc6e8a5
+  upstream: 8ff12bd997f54f1075f2242a10bff2e3c1bbad02
+15e5a3ae7f084b993ef68e998a29f119de8e24ec:
+  title: 'ARM: dts: mmp2-brownstone: Don''t redeclare phandle references'
+  mainline: 5a56cf3e8738f5d31d8c024d0c62a4c2bfe76fb2
+  upstream: b8dd364515493630ea3a6ece252ba79533e00354
+59bd54acd4b8cf21883b7e3ed1d9f7556d0e524e:
+  title: 'arm: dts: marvell: Fix maxium->maxim typo in brownstone dts'
+  mainline: 831e0cd4f9ee15a4f02ae10b67e7fdc10eb2b4fc
+  upstream: d2285ff966088aa5e6ff1a85d40b23ea7b4d2cf9
+49486ded3cf00d844277c258f4c6170b7ba0792b:
+  title: 'media: xc4000: Fix atomicity violation in xc4000_get_frequency'
+  mainline: 36d503ad547d1c75758a6fcdbec2806f1b6aeb41
+  upstream: 72ddb259a4d09f8e0d06cb2abc9a3eedfcb4200e
+270a92c92373a65c649de646996a14f2523076c1:
+  title: 'KVM: Always flush async #PF workqueue when vCPU is being destroyed'
+  mainline: 3d75b8aa5c29058a512db29da7cbee8052724157
+  upstream: ab2c2f5d9576112ad22cfd3798071cb74693b1f5
+66476cee65989ef662adc023102b54206faa056a:
+  title: 'sparc64: NMI watchdog: fix return value of __setup handler'
+  mainline: 3ed7c61e49d65dacb96db798c0ab6fcd55a1f20f
+  upstream: 452529f9b6094f32d9143ef54af5bffd374a9c27
+2eb2a9ca28c54db784293209ef58babd54d359ed:
+  title: 'crypto: qat - fix double free during reset'
+  mainline: 01aed663e6c421aeafc9c330bda630976b50a764
+  upstream: 277035d2da928bb50ff5ba8723dc4f0284284223
+80509311946cbc5c9b71cb2730c5cb0cbc8ebd45:
+  title: 'crypto: qat - resolve race condition during AER recovery'
+  mainline: 7d42e097607c4d246d99225bf2b195b6167a210c
+  upstream: daba62d9eeddcc5b1081be7d348ca836c83c59d7
+e5e642ae8fb37cc06046bebf193cd4957d945c73:
+  title: 'fat: fix uninitialized field in nostale filehandles'
+  mainline: fde2497d2bc3a063d8af88b258dbadc86bd7b57c
+  upstream: 9840d1897e28f8733cc1e38f97e044f987dc0a63
+5109254ba7cb8452f154b8c5dbb4a7e1224a9f8b:
+  title: 'ubifs: Set page uptodate in the correct place'
+  mainline: 723012cab779eee8228376754e22c6594229bf8f
+  upstream: 4aa554832b9dc9e66249df75b8f447d87853e12e
+c05dbbe027edbe0f2cb9514f8d8084eb96fc2256:
+  title: 'ubi: Check for too small LEB size in VTBL code'
+  mainline: 68a24aba7c593eafa8fd00f2f76407b9b32b47a9
+  upstream: ff818a59ecdfb13a8eb4a38a87b869090dd1745c
+13e3ca30e708d8efed15b15f6d0cf232c071aa9c:
+  title: 'ubi: correct the calculation of fastmap size'
+  mainline: 7f174ae4f39e8475adcc09d26c5a43394689ad6c
+  upstream: 113d2c358fe9b9c2b307b4984ed41dfce6f78347
+0f8a1215c497c27c788e2c7399b1aaac9c205e75:
+  title: 'parisc: Do not hardcode registers in checksum functions'
+  mainline: 52b2d91752a82d9350981eb3b3ffc4b325c84ba9
+  upstream: 32248b37aa141fa9d9dccf24d67295de39d68e6f
+f221d4640d25832bbee599d5c24cda1a040125a1:
+  title: 'parisc: Fix ip_fast_csum'
+  mainline: a2abae8f0b638c31bb9799d9dd847306e0d005bd
+  upstream: 5cdd5e21c16369dd334e38b6c1aa6c2eaecaebdd
+b8cb20b9c4c197de9d905518f4227ed7dcaa7aaa:
+  title: 'parisc: Fix csum_ipv6_magic on 32-bit systems'
+  mainline: 4408ba75e4ba80c91fde7e10bccccf388f5c09be
+  upstream: 103616f04373ce99dc8fb601100163292c9d9700
+bff540549bd2b5c312c5dc43a094b685467a9fa6:
+  title: 'parisc: Fix csum_ipv6_magic on 64-bit systems'
+  mainline: 4b75b12d70506e31fc02356bbca60f8d5ca012d0
+  upstream: ee185ae2b97933193cf1e44e959a80690f835fb3
+6711300be2eb4c7d6f43ac023b5ec484166c79c2:
+  title: 'parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds'
+  mainline: 0568b6f0d863643db2edcc7be31165740c89fa82
+  upstream: 7d27b71af7262ec53ec49f2679fdb3509ee28098
+56a2eacb2e9155c55916bd4eab07d7c4204b683f:
+  title: 'PM: suspend: Set mem_sleep_current during kernel command line setup'
+  mainline: 9bc4ffd32ef8943f5c5a42c9637cfd04771d021b
+  upstream: 312ead3c0e23315596560e9cc1d6ebbee1282e40
+504cb476a9133b6c59bf54d9b267b1196544226e:
+  title: 'clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays'
+  mainline: a903cfd38d8dee7e754fb89fd1bebed99e28003d
+  upstream: 5533686e99b04994d7c4877dc0e4282adc9444a2
+9fcafc89b8ec3ad253f9ad9a67012141893aee44:
+  title: 'clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays'
+  mainline: e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96
+  upstream: 99740c4791dc8019b0d758c5389ca6d1c0604d95
+822a0ce90098854047b7088afd2dae656b90bdcb:
+  title: 'powerpc/fsl: Fix mfpmr build errors with newer binutils'
+  mainline: 5f491356b7149564ab22323ccce79c8d595bfd0c
+  upstream: 8f7f583ce3393580eb8a55942d05e3ab6eb161ba
+9598535c6526853f78a891421f12783174e05482:
+  title: 'USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB'
+  mainline: 3fb7bc4f3a98c48981318b87cf553c5f115fd5ca
+  upstream: fd3b0646012973dcef107f614300076c35aec30e
+8a13c955082f3d8ce5ea1badda9e72fcdb0908d9:
+  title: 'USB: serial: add device ID for VeriFone adapter'
+  mainline: cda704809797a8a86284f9df3eef5e62ec8a3175
+  upstream: 64d0643a8b7bed28f011bf1f942a4d6972d815ca
+24dc68b8236fd0ccb59be9dd9492e5bcfb89f3aa:
+  title: 'USB: serial: cp210x: add ID for MGP Instruments PDS100'
+  mainline: a0d9d868491a362d421521499d98308c8e3a0398
+  upstream: dea245d8c104a2977d79e2310b83fd5d9a39861f
+618c54ca2dd86b503e06c8df9ced140e53a48d99:
+  title: 'USB: serial: option: add MeiG Smart SLM320 product'
+  mainline: 46809c51565b83881aede6cdf3b0d25254966a41
+  upstream: 03c0edfa0533fbc9fd9ecd5350c5c3639e3171b1
+8436412b0d625fe55cd4ea391bf0cd606b7c748a:
+  title: 'USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M'
+  mainline: b1a8da9ff1395c4879b4bd41e55733d944f3d613
+  upstream: 99e7b5884bb1fa4703a03af0bb740eb797ed335c
+e28c7f715843eb54828e33d60ef14c0ebc8e3d47:
+  title: 'PM: sleep: wakeirq: fix wake irq warning in system suspend'
+  mainline: e7a7681c859643f3f2476b2a28a494877fd89442
+  upstream: 66ed532e73bdfdcdb4b49bf6e92db7758bd2ff21
+601d558db55ea0010315cbc4a4bb83e8eb7bf038:
+  title: 'mmc: tmio: avoid concurrent runs of mmc_request_done()'
+  mainline: e8d1b41e69d72c62865bebe8f441163ec00b3d44
+  upstream: c421a077bb1a4b0923792ee6fc9e1b246d5fa6d6
+0be0578f83ec594ad05ae6821a34de4b769c7db7:
+  title: 'fuse: don''t unhash root'
+  mainline: b1fe686a765e6c0d71811d825b5a1585a202b777
+  upstream: 0f8957f5077b29cda838be2f75ef6cd2668e6df4
+76c167a161ef90c6588ec0dda97ec68d8fd6e9a6:
+  title: 'PCI: Drop pci_device_remove() test of pci_dev->driver'
+  mainline: 097d9d414433315122f759ee6c2d8a7417a8ff0f
+  upstream: 064300ccb0e272adcedd96df96750d08c5a4d2f2
+1453f1042e621a4a7247c9069755473a0eefa1ba:
+  title: 'PCI/PM: Drain runtime-idle callbacks before driver removal'
+  mainline: 9d5286d4e7f68beab450deddbb6a32edd5ecf4bf
+  upstream: 9a87375bb586515c0af63d5dcdcd58ec4acf20a6
+050bbf8ca58f05c6f76244284ccb7942dfbb00c9:
+  title: 'Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""'
+  mainline: 3445139e3a594be77eff48bc17eff67cf983daed
+  upstream: 130e2ae1fdf361f3a5a9b21db10fe519c54ad470
+6ac966e0c64f616bf5ae8c9e3655827fafa2a288:
+  title: 'dm-raid: fix lockdep waring in "pers->hot_add_disk"'
+  mainline: 95009ae904b1e9dca8db6f649f2d7c18a6e42c75
+  upstream: da81cab62b4f48fc3800db68ed30f8dd94e78f92
+1c6f43992e92359208930b339fd57f04e157da73:
+  title: 'mmc: core: Fix switch on gp3 partition'
+  mainline: 4af59a8df5ea930038cd3355e822f5eedf4accc1
+  upstream: 14db3446d26511191088a941069bcdec97223728
+805bd3875b89fe0311ca2e530836ec10cb390798:
+  title: 'hwmon: (amc6821) add of_match table'
+  mainline: 3f003fda98a7a8d5f399057d92e6ed56b468657c
+  upstream: f6b084787b7d9bd4009e0d6d1f0cc79349f7efcd
+4c3c05340a8d2925c998e568db8c6199a08df5c4:
+  title: 'ext4: fix corruption during on-line resize'
+  mainline: a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc
+  upstream: 75cc31c2e7193b69f5d25650bda5bb42ed92f8a1
+4f84ef5651a0ae72ca8bc3f1529a9863a90862c7:
+  title: 'speakup: Fix 8bit characters from direct synth'
+  mainline: b6c8dafc9d86eb77e502bb018ec4105e8d2fbf78
+  upstream: 37f4f4f1ac2661c1cc7766a324d34b24f65e75e8
+49362eca812601c014d7006bd66b8b6484277d98:
+  title: 'kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1'
+  mainline: 75b5ab134bb5f657ef7979a59106dce0657e8d87
+  upstream: 39460da0515e5ef2afc67a184395daf8f97f74a1
+fbe0715512c3fca4b0d1c8e746f18bd2f24d042f:
+  title: 'vfio/platform: Disable virqfds on cleanup'
+  mainline: fcdc0d3d40bc26c105acf8467f7d9018970944ae
+  upstream: af47ec223f6d9d72d2ddd3fb31a7d1210eafd0bb
+94dcaef811b46fe6df7487a738e14e747c10e4f7:
+  title: 'soc: fsl: qbman: Always disable interrupts when taking cgr_lock'
+  mainline: 584c2a9184a33a40fceee838f856de3cffa19be3
+  upstream: b56a793f267679945d1fdb9a280013bd2d0ed7f9
+321e5b5b657ed28e3e12c00b1d1c7a1aed0080b6:
+  title: 'soc: fsl: qbman: Add helper for sanity checking cgr ops'
+  mainline: d0e17a4653cebc2c8a20251c837dd1fcec5014d9
+  upstream: 99fe1b21b5e5bf69d351adca3c594c46c5bf155b
+a8363db776a883cdbf0fd646f3133b3e3f110977:
+  title: 'soc: fsl: qbman: Add CGR update function'
+  mainline: 914f8b228ede709274b8c80514b352248ec9da00
+  upstream: e2bd2df406edd2dff1b105f9dea3c502ee5808c3
+e32c360971de834a38399f982b9d9c5993b6d5ef:
+  title: 'soc: fsl: qbman: Use raw spinlock for cgr_lock'
+  mainline: fbec4e7fed89b579f2483041fabf9650fb0dd6bc
+  upstream: 2b3fede8225133671ce837c0d284804aa3bc7a02
+6b39a518dba77c95d71e3d05bf2667602b3a206b:
+  title: 's390/zcrypt: fix reference counting on zcrypt card objects'
+  mainline: 50ed48c80fecbe17218afed4f8bed005c802976c
+  upstream: 7e500849fa558879a1cde43f80c7c048c2437058
+133f1b251a963f13a59296ffd812314b3895acd5:
+  title: 'drm/imx/ipuv3: do not return negative values from .get_modes()'
+  mainline: c2da9ada64962fcd2e6395ed9987b9874ea032d3
+  upstream: 749e6b3a2dfc9d393874e7a6cc7fed6eeda97ee0
+e08287742d6330d8946d74dbd16fa6ab32f584b9:
+  title: 'drm/vc4: hdmi: do not return negative values from .get_modes()'
+  mainline: abf493988e380f25242c1023275c68bd3579c9ce
+  upstream: 6206e70d5faa5a9e8a3250683ebee1637d3559fa
+cead81caaf4e893de661245723b033c776eba434:
+  title: 'memtest: use {READ,WRITE}_ONCE in memory scanning'
+  mainline: 82634d7e24271698e50a3ec811e5f50de790a65f
+  upstream: 6e7044f155f7756e4489d8ad928f3061eab4595b
+592973ee7e6a0af69d6689fa946f83544b0b7f32:
+  title: 'nilfs2: fix failure to detect DAT corruption in btree and direct mappings'
+  mainline: f2f26b4a84a0ef41791bd2d70861c8eac748f4ba
+  upstream: b67189690eb4b7ecc84ae16fa1e880e0123eaa35
+f54f17b7da72676032972ac38c70d5f958b93591:
+  title: 'nilfs2: use a more common logging style'
+  mainline: a1d0747a393a079631130d61faa2a61027d1c789
+  upstream: 5c8f85e9ff21ee1fc6d20fcd73a15877556c3bbe
+a3a1048f65cd381d4efdf6d4beb71eddb5d54ac5:
+  title: 'nilfs2: prevent kernel bug at submit_bh_wbc()'
+  mainline: 269cdf353b5bdd15f1a079671b0f889113865f20
+  upstream: 91e4c4595fae5e87069e44687ae879091783c183
+01877909cac69ce374567fddfb200298900be9d8:
+  title: 'ahci: asm1064: correct count of reported ports'
+  mainline: 9815e39617541ef52d0dfac4be274ad378c6dc09
+  upstream: ece903bf390e819c45fba8cf6a31c7487e24c505
+adc881c85ad12350f907e04d3a8c0d2242873b3a:
+  title: 'ahci: asm1064: asm1166: don''t limit reported ports'
+  mainline: 6cd8adc3e18960f6e59d797285ed34ef473cc896
+  upstream: d29630b79d4c48b31312fa3d735de63cbe97e6c5
+8e23affd6f90a54fc41e30143bf3fee824dd3f24:
+  title: 'comedi: comedi_test: Prevent timers rescheduling during deletion'
+  mainline: f53641a6e849034a44bf80f50245a75d7a376025
+  upstream: 4b6e87971dbea7d9231f670281723003f90429b2
+c125ac99931ed065edcf24f7ab4572e03840633e:
+  title: 'netfilter: nf_tables: disallow anonymous set with timeout flag'
+  mainline: 16603605b667b70da974bea8216c93e7db043bf1
+  upstream: e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9
+6579e677dcdff3b57c01dfd05076c5f602dddf3d:
+  title: 'netfilter: nf_tables: reject constant set with timeout'
+  mainline: 5f4fc4bd5cddb4770ab120ce44f02695c4505562
+  upstream: 9372a64fb8a9f8e9cc59a0c8fa2ab5a670384926
+92844cb2a29c9cb805badb5f0b47b1a7b064ae6e:
+  title: 'xfrm: Avoid clang fortify warning in copy_to_user_tmpl()'
+  mainline: 1a807e46aa93ebad1dfbed4f82dc3bf779423a6e
+  upstream: 79fa29ce641165aa5d934f55f2369aacfd7c35e4
+ee2aa965bc6fa84adcc53b1daef7bc40bfa0d890:
+  title: 'ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform'
+  mainline: d397b6e56151099cf3b1f7bfccb204a6a8591720
+  upstream: 341568ef8afd587d1e6edd1c4a2e6daec438ea34
+c549cae12cd0f345aff86d8b4ea4e4234476f23e:
+  title: 'USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command'
+  mainline: 014bcf41d946b36a8f0b8e9b5d9529efbb822f49
+  upstream: 9968c701cba7eda42e5f0052b040349d6222ae34
+0dcddb86a5d646529e4395f7206ae146d07be618:
+  title: 'usb: gadget: ncm: Fix handling of zero block length packets'
+  mainline: f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70
+  upstream: e2dbfea520e60d58e0c498ba41bde10452257779
+602634cfb4b83b8bb798fb91fe9fa8a0aef24c72:
+  title: 'usb: port: Don''t try to peer unused USB ports based on location'
+  mainline: 69c63350e573367f9c8594162288cffa8a26d0d1
+  upstream: 8697e9b39f57fdae216d1fa6947e196307516aac
+0b11f20185ce5eb0cba6d38542c33020592085f5:
+  title: 'tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled'
+  mainline: 74cb7e0355fae9641f825afa389d3fba3b617714
+  upstream: 206ef729592010631fd2fe721a94b4e71c61653e
+d594c0266f6a7959f1844a5b51786ddb695ed093:
+  title: 'vt: fix memory overlapping when deleting chars in the buffer'
+  mainline: 39cdb68c64d84e71a4a717000b6e5de208ee60cc
+  upstream: c8686c014b5e872ba7e334f33ca553f14446fc29
+fd783c9a2045ec6adb0d10a00d5529d0dd05d395:
+  title: 'mm/memory-failure: fix an incorrect use of tail pages'
+66bf9016921cd93d270fc6ebec98e69cb9f2e364:
+  title: 'mm/migrate: set swap entry values of THP tail pages properly.'
+85c54b93ba34a1150bffd0158f4ec43b1d17cf3f:
+  title: 'wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes'
+  mainline: 4f2bdb3c5e3189297e156b3ff84b140423d64685
+  upstream: ea9a0cfc07a7d3601cc680718d9cff0d6927a921
+2743401fbf05f96c405165f8176873a62c813768:
+  title: 'exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()'
+  mainline: 2aea94ac14d1e0a8ae9e34febebe208213ba72f7
+  upstream: 3a679f8a8c88de0b17b0bfde031238b40daf76ba
+8163976a83576149919cd26e021b99167cbe4731:
+  title: 'USB: cdc-wdm: Fix use after free in service_outstanding_interrupt().'
+  mainline: 5e5ff0b4b6bcb4d17b7a26ec8bcfc7dd4651684f
+2eb4d359ad399b7c830e00d52bcf30b776bf7bc8:
+  title: 'usb: cdc-wdm: close race between read and workqueue'
+  mainline: 339f83612f3a569b194680768b22bf113c26a29d
+  upstream: 5904411219601127ffdbd2d622bb5d67f9d8d16c
+690e1f475ec547a1809a949f1abf1ac6a24a9e35:
+  title: 'ALSA: sh: aica: Convert timers to use timer_setup()'
+5c3becdbf4d010b2460d46da9de7bbf274f82792:
+  title: 'ALSA: aica: Fix a long-time build breakage'
+  mainline: 534420c6ff87d3052540f1fd346e0adcff440819
+57ad2852b697ab931110d4443e42aa15420928cd:
+  title: 'ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs'
+  mainline: 051e0840ffa8ab25554d6b14b62c9ab9e4901457
+  upstream: eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2
+9b033ffdc4492f9882d1e3d8416f3c9a3b1c281e:
+  title: 'fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion'
+  mainline: 961ebd120565cb60cebe21cb634fbc456022db4a
+  upstream: 10ca82aff58434e122c7c757cf0497c335f993f3
+271b5f628523048373853e7d726edc4ab6b2dafa:
+  title: 'printk: Update @console_may_schedule in console_trylock_spinning()'
+  mainline: 8076972468584d4a21dab9aa50e388b3ea9ad8c7
+  upstream: 45f99d441067035dbb3f2a0d9713abe61ea721c5
+b2de2c514c647d19070e8f2fad629356367749fa:
+  title: 'btrfs: add define for oldest generation'
+8e0244b75adcff266630f97bdedb589988c1605d:
+  title: 'btrfs: allocate btrfs_ioctl_defrag_range_args on stack'
+  mainline: c853a5783ebe123847886d432354931874367292
+  upstream: 022ed023c8c0bed09a21e9617056723df948544c
+c598f19d1ee74a8b8820210cc4563253e60d7f6a:
+  title: 'Revert "loop: Check for overflow while configuring loop"'
+7d51a15acdfba9db409c1fea20682dba5e4c533d:
+  title: 'loop: Call loop_config_discard() only after new config is applied'
+  mainline: 7c5014b0987a30e4989c90633c198aced454c0ec
+  upstream: 944e9628259117a2f21d9c7ce5d7fbb305cc6ba6
+d1bcca1f152951849067da419020d041495285d3:
+  title: 'perf/core: Fix reentry problem in perf_output_read_group()'
+  mainline: 6b959ba22d34ca793ffdb15b5715457c78e38b1a
+  upstream: a2039c87d30177f0fd349ab000e6af25a0d48de8
+4cb71f760e2735758614a3798d255aa93862d577:
+  title: 'efivarfs: Request at most 512 bytes for variable names'
+  mainline: f45812cc23fb74bef62d4eb8a69fe7218f4b9f2a
+  upstream: a7bd7dbaa2ddcf8c5ed5d96df240f1442447d252
+5ef535b7348ea1372234b51a6c806617275b8968:
+  title: 'powerpc: xor_vmx: Add ''-mhard-float'' to CFLAGS'
+  mainline: 35f20786c481d5ced9283ff42de5c69b65e5ed13
+  upstream: 9b021c7ffbbf7569b074c3f6cafa377b8c29a2e3
+d249d755055ea72ae93f908e4f009672bb4a367b:
+  title: 'usb: dwc2: host: Fix hibernation flow'
+  mainline: 3c7b9856a82227db01a20171d2e24c7ce305d59b
+  upstream: 8c93d233285e234b84bc34c9de317ccf3ae00aec
+3e18f9aae5c9f4ee7c82f727c7db4bdc66055af9:
+  title: 'usb: dwc2: host: Fix ISOC flow in DDMA mode'
+  mainline: b258e42688501cadb1a6dd658d6f015df9f32d8f
+  upstream: dca1dc1e99e09e7b8eaccb55d6aecb87d9cb8ecd
+933c295f1bf97ef659d06b2fa268f948de50ffc9:
+  title: 'usb: udc: remove warning when queue disabled ep'
+  mainline: 2a587a035214fa1b5ef598aea0b81848c5b72e5e
+  upstream: 2b002c308e184feeaeb72987bca3f1b11e5f70b8
+e31a16fe832d4016c83230cc8bd7f67493e1c9a7:
+  title: 'scsi: qla2xxx: Fix command flush on cable pull'
+  mainline: a27d4d0e7de305def8a5098a614053be208d1aa1
+  upstream: b73377124f56d2fec154737c2f8d2e839c237d5a
+909ca3e7e6fb1ae6130e1a7d473acc1c8bbc9ffa:
+  title: 'x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled'
+  mainline: fd470a8beed88440b160d690344fbae05a0b9b1b
+  upstream: bb8cc9c34361714dd232700b3d5f1373055de610
+03119f856df4a8f68fbc6c3d2dfc5b42634c5287:
+  title: 'scsi: lpfc: Correct size for wqe for memset()'
+  mainline: 28d41991182c210ec1654f8af2e140ef4cc73f20
+  upstream: 5df0d994c23a43f4c0f2a7fdf6b62e106d08e53e
+f354bb2f646ba9eb13094f3a58a9fcb2495cdaf8:
+  title: 'USB: core: Fix deadlock in usb_deauthorize_interface()'
+  mainline: 80ba43e9f799cbdd83842fc27db667289b3150f5
+  upstream: 8cbdd324b41528994027128207fae8100dff094f
+746dafa5f8bd92d019409cd1e3991b6b23ed9808:
+  title: 'nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet'
+  mainline: d24b03535e5eb82e025219c2f632b485409c898f
+  upstream: 11387b2effbb55f58dc2111ef4b4b896f2756240
+f113056cc53497bafb4a5a1ae59fcb8da95409df:
+  title: 'mptcp: add sk_stop_timer_sync helper'
+  mainline: 08b81d873126b413cda511b1ea1cbb0e99938bbd
+  upstream: 9c382bc16fa8f7499b0663398437e125cf4f763b
+a15af438bc3f84cd18bd555ed93704f174afd28e:
+  title: 'tcp: properly terminate timers for kernel sockets'
+  mainline: 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada
+  upstream: 93f0133b9d589cc6e865f254ad9be3e9d8133f50
+0d619c44f46a548f37d0af8526b1e2141888415c:
+  title: 'Bluetooth: hci_event: set the conn encrypted before conn establishes'
+  mainline: c569242cd49287d53b73a94233db40097d838535
+  upstream: 96caf943a0f384f347d0d32afa8a3e94837fe012
+bddbc4e6e85deec70cfd5e4d06553687ce2031e2:
+  title: 'Bluetooth: Fix TOCTOU in HCI debugfs implementation'
+  mainline: 7835fcfd132eb88b87e8eb901f88436f63ab60f7
+  upstream: 466488b14a87dc97d8a3bf5e65a30bff032847c1
+2828c51f974e201fb04d01231d502059b21dee7d:
+  title: 'netfilter: nf_tables: disallow timeout for anonymous sets'
+  mainline: e26d3009efda338f19016df4175f354a9bd0a4ab
+  upstream: 116b0e8e4673a5faa8a739a19b467010c4d3058c
+0c4e907602df65b88f9bed57d6bc5039b7172e8c:
+  title: 'Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."'
+  mainline: c567f2948f57bdc03ed03403ae0234085f376b7d
+  upstream: b66762945d3289d472cedfca81dd98f9d8efe3b7
+ce55bbe3422d77c1733e562b2481ae5d5609e4de:
+  title: 'mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations'
+  mainline: 803de9000f334b771afacb6ff3e78622916668b0
+  upstream: c82a659cc8bb7a7f8a8348fc7f203c412ae3636f
+ca0de57e9c48d85f650f98c4a515cbfb61213a7e:
+  title: 'net: stmmac: Fix issues when number of Queues >= 4'
+  mainline: e8df7e8c233a18d2704e37ecff47583b494789d3
+77222083054d1880d96617dc92433f13f7485340:
+  title: 'net: stmmac: fix rx queue priority assignment'
+  mainline: b3da86d432b7cd65b025a11f68613e333d2483db
+  upstream: c5dd42e0c490416e45fac594694cbc0ada0ea0f9
+750226b1e9ada5f831c682b3970e6fb4c908de43:
+  title: 'net/sched: act_skbmod: prevent kernel-infoleak'
+  mainline: d313eb8b77557a6d5855f42d2234bd592c7b50dd
+  upstream: f190a4aa03cbd518bd9c62a66e1233984f5fd2ec
+b406df4814ddb671e6b276983496bfe1fbbb70d8:
+  title: 'selftests: reuseaddr_conflict: add missing new line at the end of the output'
+  mainline: 31974122cfdeaf56abc18d8ab740d580d9833e90
+  upstream: d6c0a37d412657cf2661996387340e8afeb82a63
+1c37416298197f52e10ae196eff4e11f07c11a96:
+  title: 'ipv6: Fix infinite recursion in fib6_dump_done().'
+  mainline: d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae
+  upstream: 9472d07cd095cbd3294ac54c42f304a38fbe9bfe
+4a254ec690b1730e4360c6c82a1e6a220f757bb1:
+  title: 'staging: mmal-vchiq: Avoid use of bool in structures'
+  mainline: 640e77466e69d9c28de227bc76881f5501f532ca
+  upstream: 11895fd09f5d37abbc60ac88f4897587997cfbf5
+cde080763f772971b9bab16de6a83a57bfa72941:
+  title: 'staging: mmal-vchiq: Allocate and free components as required'
+  mainline: 8c589e1794a31e9a381916b0280260ab601e4d6e
+  upstream: 48823cc0c75c3290d82b339f2135e54d6c20eaaa
+1fbb48548bf323fe8c3bb65573ac2b47a06fcc52:
+  title: 'staging: mmal-vchiq: Fix client_component for 64 bit kernel'
+  mainline: 22e64b486adc4785542f8002c3af4c895490f841
+  upstream: 60cb8c4ae9874e8b7906302306e85e3138cb19fc
+5e236ea4cd576ca487aaeb6cd4a43b825580f096:
+  title: 'staging: vc04_services: changen strncpy() to strscpy_pad()'
+  mainline: ef25725b7f8aaffd7756974d3246ec44fae0a5cf
+  upstream: 3a54069c1398266c7523f24db52391f7d54be13f
+5314097a03c077acf9974718386187c632ff87a6:
+  title: 'staging: vc04_services: fix information leak in create_component()'
+  mainline: f37e76abd614b68987abc8e5c22d986013349771
+  upstream: 4693868e40b1367d1def54e5ea750da2d288da67
+b38a90afb44d28ca6aed9ba7b0e3c83d0e2a0161:
+  title: 'init: open /initrd.image with O_LARGEFILE'
+  mainline: 4624b346cf67400ef46a31771011fb798dd2f999
+  upstream: 9f0dcca773117f0b240d1db97db27f0b8aac106a
+5d848e29b28655b7cdd56347f17871ebceaa35af:
+  title: 'ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw'
+  mainline: fc563aa900659a850e2ada4af26b9d7a3de6c591
+  upstream: a6f9bd4aee2c96d597b765af5f3a61a2b8d8e98c
+4519a94da38decdf42b41f68e360331ab9f44338:
+  title: 'ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit'
+  mainline: 52f80bb181a9a1530ade30bc18991900bbb9697f
+  upstream: 81e38e4e2c756c95267c758bf683b35ce0ca77b1
+401b18b386e1e23ebabb0d02ea19464d756a368c:
+  title: 'ata: sata_mv: Fix PCI device ID table declaration compilation warning'
+  mainline: 3137b83a90646917c90951d66489db466b4ae106
+  upstream: b9bacf4b0e12ae9963774e4de9ddc6631ba65343
+dbff4c3de9bcdaf9692cd0174ee96b8dbd60bba2:
+  title: 'ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone'
+  mainline: 1576f263ee2147dc395531476881058609ad3d38
+  upstream: 5fd82952faaabaaefd7e594fce9b19d4b4e754f9
+cdf0bc842607a3cb79b4fee6470e73df396effdb:
+  title: 'wifi: ath9k: fix LNA selection in ath_ant_try_scan()'
+  mainline: d6b27eb997ef9a2aa51633b3111bc4a04748e6d3
+  upstream: 95f1acd1e998a48197d33720e33161750e459c23
+cab49d428499a8d81c7923b4c2bd011e71ea6326:
+  title: 'VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()'
+  mainline: 19b070fefd0d024af3daa7329cbc0d00de5302ec
+  upstream: e87bb99d2df6512d8ee37a5d63d2ca9a39a8c051
+7960ca05581467d75f635a849f0e367514b19448:
+  title: 'arm64: dts: rockchip: fix rk3399 hdmi ports node'
+  mainline: f051b6ace7ffcc48d6d1017191f167c0a85799f6
+  upstream: 23c6f9f6619a699c196cfc1e5a57becdfe4a0b9a
+9febcc825310e72385e81d69e9b967b3b4e7205a:
+  title: 'tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()'
+  mainline: f85450f134f0b4ca7e042dc3dc89155656a2299d
+  upstream: c4f135f454deb2ff4b7a5ec53577aaa776e2fac9
+c75868bec680efa61415ec3897135a7d596c384f:
+  title: 'btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()'
+  mainline: 7411055db5ce64f836aaffd422396af0075fdc99
+  upstream: bebd9e0ff90034875c5dfe4bd514fd7055fc7a89
+1b9e5cdca908d0c426ba76b2c277c8c20dca49dd:
+  title: 'btrfs: export: handle invalid inode or root reference in btrfs_get_parent()'
+  mainline: 26b66d1d366a375745755ca7365f67110bbf6bd5
+  upstream: 8b11774810aadeda80d4eb54f648eaf88f369d22
+c3e4fbedaa6d065b319e72de153e2be8d8414596:
+  title: 'btrfs: send: handle path ref underflow in header iterate_inode_ref()'
+  mainline: 3c6ee34c6f9cd12802326da26631232a61743501
+  upstream: be2b6bcc936ae17f42fff6494106a5660b35d8d3
+18ac75f7eb293f56efde10cc65fa7eb6d1350bc9:
+  title: 'Bluetooth: btintel: Fix null ptr deref in btintel_read_version'
+  mainline: b79e040910101b020931ba0c9a6b77e81ab7f645
+  upstream: ec2049fb2b8be3e108fe2ef1f1040f91e72c9990
+c6d084381d756d922236737ce0569fd76b904a62:
+  title: 'Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails'
+  mainline: bc4996184d56cfaf56d3811ac2680c8a0e2af56e
+  upstream: 004402ec227732308871a6127f0b967cf2a293cd
+385733c04408bec0083e9f768a094db74dc058d2:
+  title: 'sysv: don''t call sb_bread() with pointers_lock held'
+  mainline: f123dc86388cb669c3d6322702dc441abc35c31e
+  upstream: 13b33feb2ebddc2b1aa607f553566b18a4af1d76
+cf30a0518a5944e7af7c38a04af145c8e5e975e8:
+  title: 'scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()'
+  mainline: 2ae917d4bcab80ab304b774d492e2fcd6c52c06b
+  upstream: edf82aa7e9eb864a09229392054d131b34a5c9e8
+be099afe08c0439e72c1b37f2896d7942b318bdf:
+  title: 'isofs: handle CDs with bad root inode but good Joliet root directory'
+  mainline: 4243bf80c79211a8ca2795401add9c4a3b1d37ca
+  upstream: b02e6ba55997926c961a95cdaf9de91f75b0b5c3
+95bfe2806bd05c524d8534070c038b8feaae436a:
+  title: 'media: sta2x11: fix irq handler cast'
+  mainline: 3de49ae81c3a0f83a554ecbce4c08e019f30168e
+  upstream: 347b2e635e8b2beaa076b0bc110be9c6ea50aec1
+84b6065e346863ebad34cba5284ff8eddcf4cb4a:
+  title: 'SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int'
+  mainline: 2c35f43b5a4b9cdfaa6fdd946f5a212615dac8eb
+  upstream: 56199ebbcbbcc36658c2212b854b37dff8419e52
+53510903f234a0aea0f80bd7d3bcccf520fc07c9:
+  title: 'block: prevent division by zero in blk_rq_stat_sum()'
+  mainline: 93f52fbeaf4b676b21acfe42a5152620e6770d02
+  upstream: 6a55dab4ac956deb23690eedd74e70b892a378e7
+2929cf2f94cfec0fb6afbcdd27ec2bfb6fae1a59:
+  title: 'tools: iio: replace seekdir() in iio_generic_buffer'
+  mainline: 4e6500bfa053dc133021f9c144261b77b0ba7dc8
+  upstream: 4a886ce3c846032ed8d9bf18f525f12dcb5de614
+b550cc1a3828e39bb76a2c0d8218b57dc8f71f0d:
+  title: 'usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined'
+  mainline: 12f371e2b6cb4b79c788f1f073992e115f4ca918
+  upstream: f90519f1d6a0c4d86bcd401f34bda11486fa4284
+781096a3f8ab4b70c9b75f8c0d3e5f694e16d843:
+  title: 'fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2'
+  mainline: bc87bb342f106a0402186bcb588fcbe945dced4b
+  upstream: 3affd4cceebd560aa13c280fe0ad46a38e46eb73
+ebe31b54cbaf1029c6ecd6f8e59d6bb59b59280a:
+  title: 'fbmon: prevent division by zero in fb_videomode_from_videomode()'
+  mainline: c2d953276b8b27459baed1277a4fdd5dd9bd4126
+  upstream: 1fb52bc1de55e9e0bdf71fe078efd4da0889710f
+d7d6dfa21578d006e6023f9eddc4029774e6a6d6:
+  title: 'tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc'
+  mainline: 67c37756898a5a6b2941a13ae7260c89b54e0d88
+  upstream: 7d303dee473ba3529d75b63491e9963342107bed
+6419be48607d845c7b94621da5405191a0805754:
+  title: 'virtio: reenable config if freezing device failed'
+  mainline: 310227f42882c52356b523e2f4e11690eebcd2ab
+  upstream: 5908fb34c0cf62c0f25f916d50d00582b053e077
+e917dc0ff33859792cb7328fc84068471824639b:
+  title: 'x86/mm/pat: fix VM_PAT handling in COW mappings'
+  mainline: 04c35ab3bdae7fefbd7c7a7355f29fa03a035221
+  upstream: f18681daaec9665a15c5e7e0f591aad5d0ac622b
+9be9972d568f71227eb0d8b300af769013f27b42:
+  title: 'Bluetooth: btintel: Fixe build regression'
+  mainline: 6e62ebfb49eb65bdcbfc5797db55e0ce7f79c3dd
+  upstream: 81a3ce3efd82e0790a6151c3dad6c02570d48816
+84edf3cb66dffa4c868347741aa8ac43073ffcf1:
+  title: 'VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()'
+  mainline: e606e4b71798cc1df20e987dde2468e9527bd376
+  upstream: cc065e1b11a270ebd2b18bbe61f0d6cc8efaa15d
+edb8d9b7e0dce5410776f9d4298d04b1a01c2a86:
+  title: 'Revert "ext4: fix to check return value of freeze_bdev() in ext4_shutdown()"'
+b26791b0c721cd39ea18bcf50cf570a3888af085:
+  title: 'ext4: fix to check return value of freeze_bdev() in ext4_shutdown()'
+  mainline: c4d13222afd8a64bf11bc7ec68645496ee8b54b9
+5a1a8ad6c941914dc628dd636be10c60e817b5c3:
+  title: 'netfilter: nftables: exthdr: fix 4-byte stack OOB write'
+  mainline: fd94d9dadee58e09b49075240fe83423eb1dcd36
+842f01e7df81db42b75be7d590626a9602e495ec:
+  title: 'Revert "net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()"'
+79f3640f21c02761bfdbbda2d2b271fa40da724d:
+  title: 'net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()'
+  mainline: 01a564bab4876007ce35f312e16797dfe40e4823
diff --git a/.elts/upstream/4.19.312.yaml b/.elts/upstream/4.19.312.yaml
new file mode 100644
index 0000000..919fa05
--- /dev/null
+++ b/.elts/upstream/4.19.312.yaml
@@ -0,0 +1,680 @@
+3e4f86cfda46ef6320f385b80496d3f65d5ed63d:
+  title: 'Documentation/hw-vuln: Update spectre doc'
+  mainline: 06cb31cc761823ef444ba4e1df11347342a6e745
+  backport: 30155e4316fd08d7ca77ca14772dc3fd32088ab7
+a7268b3424863578814d99a1dd603f6bb5b9f977:
+  title: 'x86/cpu: Support AMD Automatic IBRS'
+  mainline: e7862eda309ecfccc36bb5558d937ed3ace07f3f
+  backport: 169885159d59ee3cb6482d4ec9799d11ee61477d
+205bf06008b8ea128ae8f643c21fb32fe4165416:
+  title: 'x86/bugs: Use sysfs_emit()'
+  mainline: 1d30800c0c0ae1d086ffad2bdf0ba4403370f132
+  backport: a50c4e98d9d3103cd8b418fdac2aff45d6a91cf6
+72467abd24b11b7e7e63d29f64905278cebd8563:
+  title: 'timer/trace: Replace deprecated vsprintf pointer extension %pf by %ps'
+  mainline: 6849cbb0f9a8dbc1ba56e9abc6955613103e01e3
+  skipped: not needed on 4.14
+bbb5b1c060d73ca96ccc8cceaa81f5e1a96e8fa4:
+  title: 'timer/trace: Improve timer tracing'
+  mainline: f28d3d5346e97e60c81f933ac89ccf015430e5cf
+  skipped: not needed
+adeb6cdf9033071c8ff14235ee0ebc37081b77c9:
+  title: 'timers: Prepare support for PREEMPT_RT'
+  mainline: 030dcdd197d77374879bb5603d091eee7d8aba80
+  skipped: not needed
+26e9278a773c95b25376c95406fbf81d969c1e74:
+  title: 'timers: Update kernel-doc for various functions'
+  mainline: 14f043f1340bf30bc60af127bff39f55889fef26
+  skipped: not needed
+f0b422a04f823faec0aa7d5b6e9cdbffbbe1e7bd:
+  title: 'timers: Use del_timer_sync() even on UP'
+  mainline: 168f6b6ffbeec0b9333f3582e4cf637300858db5
+  skipped: not needed
+48a8a53939604aaab44c0699851f201f80db877d:
+  title: 'timers: Rename del_timer_sync() to timer_delete_sync()'
+  mainline: 9b13df3fb64ee95e2397585404e442afee2c7d4f
+  skipped: not needed
+202c503935042272e2f9e1bb549d5f69a8681169:
+  title: 'wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach'
+  mainline: 0f7352557a35ab7888bc7831411ec8a3cbe20d78
+  backport: b361dfb73f7cf65487d75cc4b7e755ddc22db3cf
+b4cbf54183220cc35e19c21d970505c4eae0faa4:
+  title: 'smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()'
+  mainline: 9c82169208dde516510aaba6bbd8b13976690c5d
+  backport: d780b7417a456b366c4ca6a8cfe0e439769e8656
+8ff12bd997f54f1075f2242a10bff2e3c1bbad02:
+  title: 'smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()'
+  mainline: ac02f007d64eb2769d0bde742aac4d7a5fc6e8a5
+  backport: 003fe24b3f4ffda82e27f3301099888060f01c97
+b8dd364515493630ea3a6ece252ba79533e00354:
+  title: 'ARM: dts: mmp2-brownstone: Don''t redeclare phandle references'
+  mainline: 5a56cf3e8738f5d31d8c024d0c62a4c2bfe76fb2
+  backport: 15e5a3ae7f084b993ef68e998a29f119de8e24ec
+d2285ff966088aa5e6ff1a85d40b23ea7b4d2cf9:
+  title: 'arm: dts: marvell: Fix maxium->maxim typo in brownstone dts'
+  mainline: 831e0cd4f9ee15a4f02ae10b67e7fdc10eb2b4fc
+  backport: 59bd54acd4b8cf21883b7e3ed1d9f7556d0e524e
+72ddb259a4d09f8e0d06cb2abc9a3eedfcb4200e:
+  title: 'media: xc4000: Fix atomicity violation in xc4000_get_frequency'
+  mainline: 36d503ad547d1c75758a6fcdbec2806f1b6aeb41
+  backport: 49486ded3cf00d844277c258f4c6170b7ba0792b
+ab2c2f5d9576112ad22cfd3798071cb74693b1f5:
+  title: 'KVM: Always flush async #PF workqueue when vCPU is being destroyed'
+  mainline: 3d75b8aa5c29058a512db29da7cbee8052724157
+  backport: 270a92c92373a65c649de646996a14f2523076c1
+452529f9b6094f32d9143ef54af5bffd374a9c27:
+  title: 'sparc64: NMI watchdog: fix return value of __setup handler'
+  mainline: 3ed7c61e49d65dacb96db798c0ab6fcd55a1f20f
+  backport: 66476cee65989ef662adc023102b54206faa056a
+f9f20f3f7a9ab575f288024035cfced67ac5145f:
+  title: 'sparc: vDSO: fix return value of __setup handler'
+  mainline: 5378f00c935bebb846b1fdb0e79cb76c137c56b5
+  skipped: fixes patch not in branch
+277035d2da928bb50ff5ba8723dc4f0284284223:
+  title: 'crypto: qat - fix double free during reset'
+  mainline: 01aed663e6c421aeafc9c330bda630976b50a764
+  backport: 2eb2a9ca28c54db784293209ef58babd54d359ed
+daba62d9eeddcc5b1081be7d348ca836c83c59d7:
+  title: 'crypto: qat - resolve race condition during AER recovery'
+  mainline: 7d42e097607c4d246d99225bf2b195b6167a210c
+  backport: 80509311946cbc5c9b71cb2730c5cb0cbc8ebd45
+9840d1897e28f8733cc1e38f97e044f987dc0a63:
+  title: 'fat: fix uninitialized field in nostale filehandles'
+  mainline: fde2497d2bc3a063d8af88b258dbadc86bd7b57c
+  backport: e5e642ae8fb37cc06046bebf193cd4957d945c73
+4aa554832b9dc9e66249df75b8f447d87853e12e:
+  title: 'ubifs: Set page uptodate in the correct place'
+  mainline: 723012cab779eee8228376754e22c6594229bf8f
+  backport: 5109254ba7cb8452f154b8c5dbb4a7e1224a9f8b
+ff818a59ecdfb13a8eb4a38a87b869090dd1745c:
+  title: 'ubi: Check for too small LEB size in VTBL code'
+  mainline: 68a24aba7c593eafa8fd00f2f76407b9b32b47a9
+  backport: c05dbbe027edbe0f2cb9514f8d8084eb96fc2256
+113d2c358fe9b9c2b307b4984ed41dfce6f78347:
+  title: 'ubi: correct the calculation of fastmap size'
+  mainline: 7f174ae4f39e8475adcc09d26c5a43394689ad6c
+  backport: 13e3ca30e708d8efed15b15f6d0cf232c071aa9c
+32248b37aa141fa9d9dccf24d67295de39d68e6f:
+  title: 'parisc: Do not hardcode registers in checksum functions'
+  mainline: 52b2d91752a82d9350981eb3b3ffc4b325c84ba9
+  backport: 0f8a1215c497c27c788e2c7399b1aaac9c205e75
+5cdd5e21c16369dd334e38b6c1aa6c2eaecaebdd:
+  title: 'parisc: Fix ip_fast_csum'
+  mainline: a2abae8f0b638c31bb9799d9dd847306e0d005bd
+  backport: f221d4640d25832bbee599d5c24cda1a040125a1
+103616f04373ce99dc8fb601100163292c9d9700:
+  title: 'parisc: Fix csum_ipv6_magic on 32-bit systems'
+  mainline: 4408ba75e4ba80c91fde7e10bccccf388f5c09be
+  backport: b8cb20b9c4c197de9d905518f4227ed7dcaa7aaa
+ee185ae2b97933193cf1e44e959a80690f835fb3:
+  title: 'parisc: Fix csum_ipv6_magic on 64-bit systems'
+  mainline: 4b75b12d70506e31fc02356bbca60f8d5ca012d0
+  backport: bff540549bd2b5c312c5dc43a094b685467a9fa6
+7d27b71af7262ec53ec49f2679fdb3509ee28098:
+  title: 'parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds'
+  mainline: 0568b6f0d863643db2edcc7be31165740c89fa82
+  backport: 6711300be2eb4c7d6f43ac023b5ec484166c79c2
+312ead3c0e23315596560e9cc1d6ebbee1282e40:
+  title: 'PM: suspend: Set mem_sleep_current during kernel command line setup'
+  mainline: 9bc4ffd32ef8943f5c5a42c9637cfd04771d021b
+  backport: 56a2eacb2e9155c55916bd4eab07d7c4204b683f
+e117c6e2d1617520f5f7d7f6f6b395f01d8b5a27:
+  title: 'clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays'
+  mainline: 1040ef5ed95d6fd2628bad387d78a61633e09429
+  skipped: fixes patch not in branch
+5533686e99b04994d7c4877dc0e4282adc9444a2:
+  title: 'clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays'
+  mainline: a903cfd38d8dee7e754fb89fd1bebed99e28003d
+  backport: 504cb476a9133b6c59bf54d9b267b1196544226e
+99740c4791dc8019b0d758c5389ca6d1c0604d95:
+  title: 'clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays'
+  mainline: e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96
+  backport: 9fcafc89b8ec3ad253f9ad9a67012141893aee44
+8f7f583ce3393580eb8a55942d05e3ab6eb161ba:
+  title: 'powerpc/fsl: Fix mfpmr build errors with newer binutils'
+  mainline: 5f491356b7149564ab22323ccce79c8d595bfd0c
+  backport: 822a0ce90098854047b7088afd2dae656b90bdcb
+fd3b0646012973dcef107f614300076c35aec30e:
+  title: 'USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB'
+  mainline: 3fb7bc4f3a98c48981318b87cf553c5f115fd5ca
+  backport: 9598535c6526853f78a891421f12783174e05482
+64d0643a8b7bed28f011bf1f942a4d6972d815ca:
+  title: 'USB: serial: add device ID for VeriFone adapter'
+  mainline: cda704809797a8a86284f9df3eef5e62ec8a3175
+  backport: 8a13c955082f3d8ce5ea1badda9e72fcdb0908d9
+dea245d8c104a2977d79e2310b83fd5d9a39861f:
+  title: 'USB: serial: cp210x: add ID for MGP Instruments PDS100'
+  mainline: a0d9d868491a362d421521499d98308c8e3a0398
+  backport: 24dc68b8236fd0ccb59be9dd9492e5bcfb89f3aa
+03c0edfa0533fbc9fd9ecd5350c5c3639e3171b1:
+  title: 'USB: serial: option: add MeiG Smart SLM320 product'
+  mainline: 46809c51565b83881aede6cdf3b0d25254966a41
+  backport: 618c54ca2dd86b503e06c8df9ced140e53a48d99
+99e7b5884bb1fa4703a03af0bb740eb797ed335c:
+  title: 'USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M'
+  mainline: b1a8da9ff1395c4879b4bd41e55733d944f3d613
+  backport: 8436412b0d625fe55cd4ea391bf0cd606b7c748a
+66ed532e73bdfdcdb4b49bf6e92db7758bd2ff21:
+  title: 'PM: sleep: wakeirq: fix wake irq warning in system suspend'
+  mainline: e7a7681c859643f3f2476b2a28a494877fd89442
+  backport: e28c7f715843eb54828e33d60ef14c0ebc8e3d47
+c421a077bb1a4b0923792ee6fc9e1b246d5fa6d6:
+  title: 'mmc: tmio: avoid concurrent runs of mmc_request_done()'
+  mainline: e8d1b41e69d72c62865bebe8f441163ec00b3d44
+  backport: 601d558db55ea0010315cbc4a4bb83e8eb7bf038
+0f8957f5077b29cda838be2f75ef6cd2668e6df4:
+  title: 'fuse: don''t unhash root'
+  mainline: b1fe686a765e6c0d71811d825b5a1585a202b777
+  backport: 0be0578f83ec594ad05ae6821a34de4b769c7db7
+064300ccb0e272adcedd96df96750d08c5a4d2f2:
+  title: 'PCI: Drop pci_device_remove() test of pci_dev->driver'
+  mainline: 097d9d414433315122f759ee6c2d8a7417a8ff0f
+  backport: 76c167a161ef90c6588ec0dda97ec68d8fd6e9a6
+9a87375bb586515c0af63d5dcdcd58ec4acf20a6:
+  title: 'PCI/PM: Drain runtime-idle callbacks before driver removal'
+  mainline: 9d5286d4e7f68beab450deddbb6a32edd5ecf4bf
+  backport: 1453f1042e621a4a7247c9069755473a0eefa1ba
+130e2ae1fdf361f3a5a9b21db10fe519c54ad470:
+  title: 'Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""'
+  mainline: 3445139e3a594be77eff48bc17eff67cf983daed
+  backport: 050bbf8ca58f05c6f76244284ccb7942dfbb00c9
+da81cab62b4f48fc3800db68ed30f8dd94e78f92:
+  title: 'dm-raid: fix lockdep waring in "pers->hot_add_disk"'
+  mainline: 95009ae904b1e9dca8db6f649f2d7c18a6e42c75
+  backport: 6ac966e0c64f616bf5ae8c9e3655827fafa2a288
+14db3446d26511191088a941069bcdec97223728:
+  title: 'mmc: core: Fix switch on gp3 partition'
+  mainline: 4af59a8df5ea930038cd3355e822f5eedf4accc1
+  backport: 1c6f43992e92359208930b339fd57f04e157da73
+f6b084787b7d9bd4009e0d6d1f0cc79349f7efcd:
+  title: 'hwmon: (amc6821) add of_match table'
+  mainline: 3f003fda98a7a8d5f399057d92e6ed56b468657c
+  backport: 805bd3875b89fe0311ca2e530836ec10cb390798
+75cc31c2e7193b69f5d25650bda5bb42ed92f8a1:
+  title: 'ext4: fix corruption during on-line resize'
+  mainline: a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc
+  backport: 4c3c05340a8d2925c998e568db8c6199a08df5c4
+4e4715eb2845ed6d03de905142c36b7e772efffc:
+  title: 'slimbus: core: Remove usage of the deprecated ida_simple_xx() API'
+  mainline: 89ffa4cccec54467446f141a79b9e36893079fb8
+  skipped: fixes patch not in branch
+37f4f4f1ac2661c1cc7766a324d34b24f65e75e8:
+  title: 'speakup: Fix 8bit characters from direct synth'
+  mainline: b6c8dafc9d86eb77e502bb018ec4105e8d2fbf78
+  backport: 4f84ef5651a0ae72ca8bc3f1529a9863a90862c7
+39460da0515e5ef2afc67a184395daf8f97f74a1:
+  title: 'kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1'
+  mainline: 75b5ab134bb5f657ef7979a59106dce0657e8d87
+  backport: 49362eca812601c014d7006bd66b8b6484277d98
+af47ec223f6d9d72d2ddd3fb31a7d1210eafd0bb:
+  title: 'vfio/platform: Disable virqfds on cleanup'
+  mainline: fcdc0d3d40bc26c105acf8467f7d9018970944ae
+  backport: fbe0715512c3fca4b0d1c8e746f18bd2f24d042f
+b56a793f267679945d1fdb9a280013bd2d0ed7f9:
+  title: 'soc: fsl: qbman: Always disable interrupts when taking cgr_lock'
+  mainline: 584c2a9184a33a40fceee838f856de3cffa19be3
+  backport: 94dcaef811b46fe6df7487a738e14e747c10e4f7
+99fe1b21b5e5bf69d351adca3c594c46c5bf155b:
+  title: 'soc: fsl: qbman: Add helper for sanity checking cgr ops'
+  mainline: d0e17a4653cebc2c8a20251c837dd1fcec5014d9
+  backport: 321e5b5b657ed28e3e12c00b1d1c7a1aed0080b6
+e2bd2df406edd2dff1b105f9dea3c502ee5808c3:
+  title: 'soc: fsl: qbman: Add CGR update function'
+  mainline: 914f8b228ede709274b8c80514b352248ec9da00
+  backport: a8363db776a883cdbf0fd646f3133b3e3f110977
+2b3fede8225133671ce837c0d284804aa3bc7a02:
+  title: 'soc: fsl: qbman: Use raw spinlock for cgr_lock'
+  mainline: fbec4e7fed89b579f2483041fabf9650fb0dd6bc
+  backport: e32c360971de834a38399f982b9d9c5993b6d5ef
+7e500849fa558879a1cde43f80c7c048c2437058:
+  title: 's390/zcrypt: fix reference counting on zcrypt card objects'
+  mainline: 50ed48c80fecbe17218afed4f8bed005c802976c
+  backport: 6b39a518dba77c95d71e3d05bf2667602b3a206b
+749e6b3a2dfc9d393874e7a6cc7fed6eeda97ee0:
+  title: 'drm/imx/ipuv3: do not return negative values from .get_modes()'
+  mainline: c2da9ada64962fcd2e6395ed9987b9874ea032d3
+  backport: 133f1b251a963f13a59296ffd812314b3895acd5
+6206e70d5faa5a9e8a3250683ebee1637d3559fa:
+  title: 'drm/vc4: hdmi: do not return negative values from .get_modes()'
+  mainline: abf493988e380f25242c1023275c68bd3579c9ce
+  backport: e08287742d6330d8946d74dbd16fa6ab32f584b9
+6e7044f155f7756e4489d8ad928f3061eab4595b:
+  title: 'memtest: use {READ,WRITE}_ONCE in memory scanning'
+  mainline: 82634d7e24271698e50a3ec811e5f50de790a65f
+  backport: cead81caaf4e893de661245723b033c776eba434
+b67189690eb4b7ecc84ae16fa1e880e0123eaa35:
+  title: 'nilfs2: fix failure to detect DAT corruption in btree and direct mappings'
+  mainline: f2f26b4a84a0ef41791bd2d70861c8eac748f4ba
+  backport: 592973ee7e6a0af69d6689fa946f83544b0b7f32
+5c8f85e9ff21ee1fc6d20fcd73a15877556c3bbe:
+  title: 'nilfs2: use a more common logging style'
+  mainline: a1d0747a393a079631130d61faa2a61027d1c789
+  backport: f54f17b7da72676032972ac38c70d5f958b93591
+91e4c4595fae5e87069e44687ae879091783c183:
+  title: 'nilfs2: prevent kernel bug at submit_bh_wbc()'
+  mainline: 269cdf353b5bdd15f1a079671b0f889113865f20
+  backport: a3a1048f65cd381d4efdf6d4beb71eddb5d54ac5
+e4d581a5afa0d94dfae46e9cc9d729db11d1a7b2:
+  title: 'x86/CPU/AMD: Update the Zenbleed microcode revisions'
+  mainline: 5c84b051bd4e777cf37aaff983277e58c99618d5
+  skipped: fixes patch not in branch
+ece903bf390e819c45fba8cf6a31c7487e24c505:
+  title: 'ahci: asm1064: correct count of reported ports'
+  mainline: 9815e39617541ef52d0dfac4be274ad378c6dc09
+  backport: 01877909cac69ce374567fddfb200298900be9d8
+d29630b79d4c48b31312fa3d735de63cbe97e6c5:
+  title: 'ahci: asm1064: asm1166: don''t limit reported ports'
+  mainline: 6cd8adc3e18960f6e59d797285ed34ef473cc896
+  backport: adc881c85ad12350f907e04d3a8c0d2242873b3a
+4b6e87971dbea7d9231f670281723003f90429b2:
+  title: 'comedi: comedi_test: Prevent timers rescheduling during deletion'
+  mainline: f53641a6e849034a44bf80f50245a75d7a376025
+  backport: 8e23affd6f90a54fc41e30143bf3fee824dd3f24
+e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9:
+  title: 'netfilter: nf_tables: disallow anonymous set with timeout flag'
+  mainline: 16603605b667b70da974bea8216c93e7db043bf1
+  backport: c125ac99931ed065edcf24f7ab4572e03840633e
+9372a64fb8a9f8e9cc59a0c8fa2ab5a670384926:
+  title: 'netfilter: nf_tables: reject constant set with timeout'
+  mainline: 5f4fc4bd5cddb4770ab120ce44f02695c4505562
+  backport: 6579e677dcdff3b57c01dfd05076c5f602dddf3d
+79fa29ce641165aa5d934f55f2369aacfd7c35e4:
+  title: 'xfrm: Avoid clang fortify warning in copy_to_user_tmpl()'
+  mainline: 1a807e46aa93ebad1dfbed4f82dc3bf779423a6e
+  backport: 92844cb2a29c9cb805badb5f0b47b1a7b064ae6e
+341568ef8afd587d1e6edd1c4a2e6daec438ea34:
+  title: 'ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform'
+  mainline: d397b6e56151099cf3b1f7bfccb204a6a8591720
+  backport: ee2aa965bc6fa84adcc53b1daef7bc40bfa0d890
+9968c701cba7eda42e5f0052b040349d6222ae34:
+  title: 'USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command'
+  mainline: 014bcf41d946b36a8f0b8e9b5d9529efbb822f49
+  backport: c549cae12cd0f345aff86d8b4ea4e4234476f23e
+e2dbfea520e60d58e0c498ba41bde10452257779:
+  title: 'usb: gadget: ncm: Fix handling of zero block length packets'
+  mainline: f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70
+  backport: 0dcddb86a5d646529e4395f7206ae146d07be618
+8697e9b39f57fdae216d1fa6947e196307516aac:
+  title: 'usb: port: Don''t try to peer unused USB ports based on location'
+  mainline: 69c63350e573367f9c8594162288cffa8a26d0d1
+  backport: 602634cfb4b83b8bb798fb91fe9fa8a0aef24c72
+206ef729592010631fd2fe721a94b4e71c61653e:
+  title: 'tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled'
+  mainline: 74cb7e0355fae9641f825afa389d3fba3b617714
+  backport: 0b11f20185ce5eb0cba6d38542c33020592085f5
+fc7dfe3d123f00e720be80b920da287810a1f37d:
+  title: 'vt: fix unicode buffer corruption when deleting characters'
+  mainline: 1581dafaf0d34bc9c428a794a22110d7046d186d
+  skipped: bug introduced in d8ae7242718738ee1bf9bfdd632d2a4b150fdd26
+c8686c014b5e872ba7e334f33ca553f14446fc29:
+  title: 'vt: fix memory overlapping when deleting chars in the buffer'
+  mainline: 39cdb68c64d84e71a4a717000b6e5de208ee60cc
+  backport: d594c0266f6a7959f1844a5b51786ddb695ed093
+27f83f1cacba82afa4c9697e3ec3abb15e92ec82:
+  title: 'mm/memory-failure: fix an incorrect use of tail pages'
+9e92cefdaa7537515dc0ff6cc73d46fa31b062fc:
+  title: 'mm/migrate: set swap entry values of THP tail pages properly.'
+ea9a0cfc07a7d3601cc680718d9cff0d6927a921:
+  title: 'wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes'
+  mainline: 4f2bdb3c5e3189297e156b3ff84b140423d64685
+  backport: 85c54b93ba34a1150bffd0158f4ec43b1d17cf3f
+3a679f8a8c88de0b17b0bfde031238b40daf76ba:
+  title: 'exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()'
+  mainline: 2aea94ac14d1e0a8ae9e34febebe208213ba72f7
+  backport: 2743401fbf05f96c405165f8176873a62c813768
+5904411219601127ffdbd2d622bb5d67f9d8d16c:
+  title: 'usb: cdc-wdm: close race between read and workqueue'
+  mainline: 339f83612f3a569b194680768b22bf113c26a29d
+  backport: 2eb4d359ad399b7c830e00d52bcf30b776bf7bc8
+eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2:
+  title: 'ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs'
+  mainline: 051e0840ffa8ab25554d6b14b62c9ab9e4901457
+  backport: 57ad2852b697ab931110d4443e42aa15420928cd
+10ca82aff58434e122c7c757cf0497c335f993f3:
+  title: 'fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion'
+  mainline: 961ebd120565cb60cebe21cb634fbc456022db4a
+  backport: 9b033ffdc4492f9882d1e3d8416f3c9a3b1c281e
+45f99d441067035dbb3f2a0d9713abe61ea721c5:
+  title: 'printk: Update @console_may_schedule in console_trylock_spinning()'
+  mainline: 8076972468584d4a21dab9aa50e388b3ea9ad8c7
+  backport: 271b5f628523048373853e7d726edc4ab6b2dafa
+022ed023c8c0bed09a21e9617056723df948544c:
+  title: 'btrfs: allocate btrfs_ioctl_defrag_range_args on stack'
+  mainline: c853a5783ebe123847886d432354931874367292
+  backport: 8e0244b75adcff266630f97bdedb589988c1605d
+6bdf4e6dfb60cbb6121ccf027d97ed2ec97c0bcb:
+  title: 'Revert "loop: Check for overflow while configuring loop"'
+944e9628259117a2f21d9c7ce5d7fbb305cc6ba6:
+  title: 'loop: Call loop_config_discard() only after new config is applied'
+  mainline: 7c5014b0987a30e4989c90633c198aced454c0ec
+  backport: 7d51a15acdfba9db409c1fea20682dba5e4c533d
+f92a3b0d003b9f7eb1f452598966a08802183f47:
+  title: 'loop: Remove sector_t truncation checks'
+  mainline: 083a6a50783ef54256eec3499e6575237e0e3d53
+  skipped: this is later reverted in 4.19
+bf6bec6f4679ccc713c69fa343b7b82879b0755b:
+  title: 'loop: Factor out setting loop device size'
+  mainline: 5795b6f5607f7e4db62ddea144727780cb351a9b
+  skipped: commit did not cherry-pick cleanly
+e6189dfedef6b39a868f4f238f3940e2848ee793:
+  title: 'loop: Refactor loop_set_status() size calculation'
+  mainline: b0bd158dd630bd47640e0e418c062cda1e0da5ad
+  skipped: commit did not cherry-pick cleanly
+a1ae8bb62f254930686a9a81641bac18582b1051:
+  title: 'loop: properly observe rotational flag of underlying device'
+  mainline: 56a85fd8376ef32458efb6ea97a820754e12f6bb
+  skipped: (unknown reason)
+a2039c87d30177f0fd349ab000e6af25a0d48de8:
+  title: 'perf/core: Fix reentry problem in perf_output_read_group()'
+  mainline: 6b959ba22d34ca793ffdb15b5715457c78e38b1a
+  backport: d1bcca1f152951849067da419020d041495285d3
+a7bd7dbaa2ddcf8c5ed5d96df240f1442447d252:
+  title: 'efivarfs: Request at most 512 bytes for variable names'
+  mainline: f45812cc23fb74bef62d4eb8a69fe7218f4b9f2a
+  backport: 4cb71f760e2735758614a3798d255aa93862d577
+9b021c7ffbbf7569b074c3f6cafa377b8c29a2e3:
+  title: 'powerpc: xor_vmx: Add ''-mhard-float'' to CFLAGS'
+  mainline: 35f20786c481d5ced9283ff42de5c69b65e5ed13
+  backport: 5ef535b7348ea1372234b51a6c806617275b8968
+6db027841deee469962c68ed8b515046be6203fd:
+  title: 'loop: Factor out configuring loop from status'
+  mainline: 0c3796c244598122a5d59d56f30d19390096817f
+  skipped: commit did not cherry-pick cleanly
+a217715338fd48f72114725aa7a40e484a781ca7:
+  title: 'loop: Check for overflow while configuring loop'
+  mainline: c490a0b5a4f36da3918181a8acdc6991d967c5f3
+  skipped: commit did not cherry-pick cleanly
+832580af82ace363205039a8e7c4ef04552ccc1a:
+  title: 'loop: loop_set_status_from_info() check before assignment'
+  mainline: 9f6ad5d533d1c71e51bdd06a5712c4fbc8768dfa
+  skipped: commit did not cherry-pick cleanly
+3b16163f6160d40c4d62614b7646992cf3ed3b28:
+  title: 'usb: dwc2: host: Fix remote wakeup from hibernation'
+  mainline: bae2bc73a59c200db53b6c15fb26bb758e2c6108
+  skipped: fixes patch not in branch
+8c93d233285e234b84bc34c9de317ccf3ae00aec:
+  title: 'usb: dwc2: host: Fix hibernation flow'
+  mainline: 3c7b9856a82227db01a20171d2e24c7ce305d59b
+  backport: d249d755055ea72ae93f908e4f009672bb4a367b
+dca1dc1e99e09e7b8eaccb55d6aecb87d9cb8ecd:
+  title: 'usb: dwc2: host: Fix ISOC flow in DDMA mode'
+  mainline: b258e42688501cadb1a6dd658d6f015df9f32d8f
+  backport: 3e18f9aae5c9f4ee7c82f727c7db4bdc66055af9
+d32e8f2ffe813e69755e40633cf0b4ec0d1489c4:
+  title: 'usb: dwc2: gadget: LPM flow fix'
+  mainline: 5d69a3b54e5a630c90d82a4c2bdce3d53dc78710
+  skipped: fixes patch not in branch
+2b002c308e184feeaeb72987bca3f1b11e5f70b8:
+  title: 'usb: udc: remove warning when queue disabled ep'
+  mainline: 2a587a035214fa1b5ef598aea0b81848c5b72e5e
+  backport: 933c295f1bf97ef659d06b2fa268f948de50ffc9
+b73377124f56d2fec154737c2f8d2e839c237d5a:
+  title: 'scsi: qla2xxx: Fix command flush on cable pull'
+  mainline: a27d4d0e7de305def8a5098a614053be208d1aa1
+  backport: e31a16fe832d4016c83230cc8bd7f67493e1c9a7
+bb8cc9c34361714dd232700b3d5f1373055de610:
+  title: 'x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled'
+  mainline: fd470a8beed88440b160d690344fbae05a0b9b1b
+  backport: 909ca3e7e6fb1ae6130e1a7d473acc1c8bbc9ffa
+5df0d994c23a43f4c0f2a7fdf6b62e106d08e53e:
+  title: 'scsi: lpfc: Correct size for wqe for memset()'
+  mainline: 28d41991182c210ec1654f8af2e140ef4cc73f20
+  backport: 03119f856df4a8f68fbc6c3d2dfc5b42634c5287
+8cbdd324b41528994027128207fae8100dff094f:
+  title: 'USB: core: Fix deadlock in usb_deauthorize_interface()'
+  mainline: 80ba43e9f799cbdd83842fc27db667289b3150f5
+  backport: f354bb2f646ba9eb13094f3a58a9fcb2495cdaf8
+11387b2effbb55f58dc2111ef4b4b896f2756240:
+  title: 'nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet'
+  mainline: d24b03535e5eb82e025219c2f632b485409c898f
+  backport: 746dafa5f8bd92d019409cd1e3991b6b23ed9808
+9c382bc16fa8f7499b0663398437e125cf4f763b:
+  title: 'mptcp: add sk_stop_timer_sync helper'
+  mainline: 08b81d873126b413cda511b1ea1cbb0e99938bbd
+  backport: f113056cc53497bafb4a5a1ae59fcb8da95409df
+93f0133b9d589cc6e865f254ad9be3e9d8133f50:
+  title: 'tcp: properly terminate timers for kernel sockets'
+  mainline: 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada
+  backport: a15af438bc3f84cd18bd555ed93704f174afd28e
+60cc92f8d4231eda8fcb89153a55a93bfbc0ddde:
+  title: 'r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d'
+  mainline: 5d872c9f46bd2ea3524af3c2420a364a13667135
+  skipped: fixes patch not in branch
+96caf943a0f384f347d0d32afa8a3e94837fe012:
+  title: 'Bluetooth: hci_event: set the conn encrypted before conn establishes'
+  mainline: c569242cd49287d53b73a94233db40097d838535
+  backport: 0d619c44f46a548f37d0af8526b1e2141888415c
+466488b14a87dc97d8a3bf5e65a30bff032847c1:
+  title: 'Bluetooth: Fix TOCTOU in HCI debugfs implementation'
+  mainline: 7835fcfd132eb88b87e8eb901f88436f63ab60f7
+  backport: bddbc4e6e85deec70cfd5e4d06553687ce2031e2
+116b0e8e4673a5faa8a739a19b467010c4d3058c:
+  title: 'netfilter: nf_tables: disallow timeout for anonymous sets'
+  mainline: e26d3009efda338f19016df4175f354a9bd0a4ab
+  backport: 2828c51f974e201fb04d01231d502059b21dee7d
+d275de8ea7be3a453629fddae41d4156762e814c:
+  title: 'net/rds: fix possible cp null dereference'
+  mainline: 62fc3357e079a07a22465b9b6ef71bb6ea75ee4b
+  skipped: fixes patch not in branch
+b66762945d3289d472cedfca81dd98f9d8efe3b7:
+  title: 'Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."'
+  mainline: c567f2948f57bdc03ed03403ae0234085f376b7d
+  backport: 0c4e907602df65b88f9bed57d6bc5039b7172e8c
+c82a659cc8bb7a7f8a8348fc7f203c412ae3636f:
+  title: 'mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations'
+  mainline: 803de9000f334b771afacb6ff3e78622916668b0
+  backport: ce55bbe3422d77c1733e562b2481ae5d5609e4de
+69d1fe14a680042ec913f22196b58e2c8ff1b007:
+  title: 'netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()'
+  mainline: 24225011d81b471acc0e1e315b7d9905459a6304
+  skipped: fixes patch not in branch
+f190a4aa03cbd518bd9c62a66e1233984f5fd2ec:
+  title: 'net/sched: act_skbmod: prevent kernel-infoleak'
+  mainline: d313eb8b77557a6d5855f42d2234bd592c7b50dd
+  backport: 750226b1e9ada5f831c682b3970e6fb4c908de43
+c5dd42e0c490416e45fac594694cbc0ada0ea0f9:
+  title: 'net: stmmac: fix rx queue priority assignment'
+  mainline: b3da86d432b7cd65b025a11f68613e333d2483db
+  backport: 77222083054d1880d96617dc92433f13f7485340
+d6c0a37d412657cf2661996387340e8afeb82a63:
+  title: 'selftests: reuseaddr_conflict: add missing new line at the end of the output'
+  mainline: 31974122cfdeaf56abc18d8ab740d580d9833e90
+  backport: b406df4814ddb671e6b276983496bfe1fbbb70d8
+9472d07cd095cbd3294ac54c42f304a38fbe9bfe:
+  title: 'ipv6: Fix infinite recursion in fib6_dump_done().'
+  mainline: d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae
+  backport: 1c37416298197f52e10ae196eff4e11f07c11a96
+cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d:
+  title: 'i40e: fix vf may be used uninitialized in this function warning'
+  mainline: f37c4eac99c258111d414d31b740437e1925b8e8
+  skipped: fixes patch not in branch
+11895fd09f5d37abbc60ac88f4897587997cfbf5:
+  title: 'staging: mmal-vchiq: Avoid use of bool in structures'
+  mainline: 640e77466e69d9c28de227bc76881f5501f532ca
+  backport: 4a254ec690b1730e4360c6c82a1e6a220f757bb1
+48823cc0c75c3290d82b339f2135e54d6c20eaaa:
+  title: 'staging: mmal-vchiq: Allocate and free components as required'
+  mainline: 8c589e1794a31e9a381916b0280260ab601e4d6e
+  backport: cde080763f772971b9bab16de6a83a57bfa72941
+60cb8c4ae9874e8b7906302306e85e3138cb19fc:
+  title: 'staging: mmal-vchiq: Fix client_component for 64 bit kernel'
+  mainline: 22e64b486adc4785542f8002c3af4c895490f841
+  backport: 1fbb48548bf323fe8c3bb65573ac2b47a06fcc52
+3a54069c1398266c7523f24db52391f7d54be13f:
+  title: 'staging: vc04_services: changen strncpy() to strscpy_pad()'
+  mainline: ef25725b7f8aaffd7756974d3246ec44fae0a5cf
+  backport: 5e236ea4cd576ca487aaeb6cd4a43b825580f096
+4693868e40b1367d1def54e5ea750da2d288da67:
+  title: 'staging: vc04_services: fix information leak in create_component()'
+  mainline: f37e76abd614b68987abc8e5c22d986013349771
+  backport: 5314097a03c077acf9974718386187c632ff87a6
+a65f5dbf3249b9ca9c05a843d2a5bddad0b9adf6:
+  title: 'initramfs: factor out a helper to populate the initrd image'
+  mainline: 7c184ecd262fe64fe8cf4e099e0f7cefe88d88b2
+  skipped: not needed
+c2f18e9a7619e194e564cd159e830efe7ce7545f:
+  title: 'fs: add a vfs_fchown helper'
+  mainline: c04011fe8cbd80af1be6e12b53193bf3846750d7
+  skipped: not needed
+b78a72266577fa7be6d482b3a49d020c1e10e966:
+  title: 'fs: add a vfs_fchmod helper'
+  mainline: 9e96c8c0e94eea2f69a9705f5d0f51928ea26c17
+  skipped: not needed
+246d6635dc5b326af3ca10212d7339712244ac36:
+  title: 'initramfs: switch initramfs unpacking to struct file based APIs'
+  mainline: bf6419e4d5440c6d414a320506c5488857a5b001
+  skipped: not needed
+9f0dcca773117f0b240d1db97db27f0b8aac106a:
+  title: 'init: open /initrd.image with O_LARGEFILE'
+  mainline: 4624b346cf67400ef46a31771011fb798dd2f999
+  backport: b38a90afb44d28ca6aed9ba7b0e3c83d0e2a0161
+cb6f9da80526a7874bf97fd2a83b95ea415d6ac6:
+  title: 'erspan: Add type I version 0 support.'
+  mainline: f989d546a2d5a9f001f6f8be49d98c10ab9b1897
+  skipped: is a new feature
+06a939f72a24a7d8251f84cf4c042df86c6666ac:
+  title: 'erspan: make sure erspan_base_hdr is present in skb->head'
+  mainline: 17af420545a750f763025149fa7b833a4fc8b8f0
+  skipped: fixes patch not in branch
+a6f9bd4aee2c96d597b765af5f3a61a2b8d8e98c:
+  title: 'ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw'
+  mainline: fc563aa900659a850e2ada4af26b9d7a3de6c591
+  backport: 5d848e29b28655b7cdd56347f17871ebceaa35af
+81e38e4e2c756c95267c758bf683b35ce0ca77b1:
+  title: 'ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit'
+  mainline: 52f80bb181a9a1530ade30bc18991900bbb9697f
+  backport: 4519a94da38decdf42b41f68e360331ab9f44338
+b9bacf4b0e12ae9963774e4de9ddc6631ba65343:
+  title: 'ata: sata_mv: Fix PCI device ID table declaration compilation warning'
+  mainline: 3137b83a90646917c90951d66489db466b4ae106
+  backport: 401b18b386e1e23ebabb0d02ea19464d756a368c
+5fd82952faaabaaefd7e594fce9b19d4b4e754f9:
+  title: 'ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone'
+  mainline: 1576f263ee2147dc395531476881058609ad3d38
+  backport: dbff4c3de9bcdaf9692cd0174ee96b8dbd60bba2
+95f1acd1e998a48197d33720e33161750e459c23:
+  title: 'wifi: ath9k: fix LNA selection in ath_ant_try_scan()'
+  mainline: d6b27eb997ef9a2aa51633b3111bc4a04748e6d3
+  backport: cdf0bc842607a3cb79b4fee6470e73df396effdb
+e87bb99d2df6512d8ee37a5d63d2ca9a39a8c051:
+  title: 'VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()'
+  mainline: 19b070fefd0d024af3daa7329cbc0d00de5302ec
+  backport: cab49d428499a8d81c7923b4c2bd011e71ea6326
+23c6f9f6619a699c196cfc1e5a57becdfe4a0b9a:
+  title: 'arm64: dts: rockchip: fix rk3399 hdmi ports node'
+  mainline: f051b6ace7ffcc48d6d1017191f167c0a85799f6
+  backport: 7960ca05581467d75f635a849f0e367514b19448
+c4f135f454deb2ff4b7a5ec53577aaa776e2fac9:
+  title: 'tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()'
+  mainline: f85450f134f0b4ca7e042dc3dc89155656a2299d
+  backport: 9febcc825310e72385e81d69e9b967b3b4e7205a
+bebd9e0ff90034875c5dfe4bd514fd7055fc7a89:
+  title: 'btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()'
+  mainline: 7411055db5ce64f836aaffd422396af0075fdc99
+  backport: c75868bec680efa61415ec3897135a7d596c384f
+8b11774810aadeda80d4eb54f648eaf88f369d22:
+  title: 'btrfs: export: handle invalid inode or root reference in btrfs_get_parent()'
+  mainline: 26b66d1d366a375745755ca7365f67110bbf6bd5
+  backport: 1b9e5cdca908d0c426ba76b2c277c8c20dca49dd
+be2b6bcc936ae17f42fff6494106a5660b35d8d3:
+  title: 'btrfs: send: handle path ref underflow in header iterate_inode_ref()'
+  mainline: 3c6ee34c6f9cd12802326da26631232a61743501
+  backport: c3e4fbedaa6d065b319e72de153e2be8d8414596
+ec2049fb2b8be3e108fe2ef1f1040f91e72c9990:
+  title: 'Bluetooth: btintel: Fix null ptr deref in btintel_read_version'
+  mainline: b79e040910101b020931ba0c9a6b77e81ab7f645
+  backport: 18ac75f7eb293f56efde10cc65fa7eb6d1350bc9
+004402ec227732308871a6127f0b967cf2a293cd:
+  title: 'Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails'
+  mainline: bc4996184d56cfaf56d3811ac2680c8a0e2af56e
+  backport: c6d084381d756d922236737ce0569fd76b904a62
+13b33feb2ebddc2b1aa607f553566b18a4af1d76:
+  title: 'sysv: don''t call sb_bread() with pointers_lock held'
+  mainline: f123dc86388cb669c3d6322702dc441abc35c31e
+  backport: 385733c04408bec0083e9f768a094db74dc058d2
+edf82aa7e9eb864a09229392054d131b34a5c9e8:
+  title: 'scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()'
+  mainline: 2ae917d4bcab80ab304b774d492e2fcd6c52c06b
+  backport: cf30a0518a5944e7af7c38a04af145c8e5e975e8
+b02e6ba55997926c961a95cdaf9de91f75b0b5c3:
+  title: 'isofs: handle CDs with bad root inode but good Joliet root directory'
+  mainline: 4243bf80c79211a8ca2795401add9c4a3b1d37ca
+  backport: be099afe08c0439e72c1b37f2896d7942b318bdf
+347b2e635e8b2beaa076b0bc110be9c6ea50aec1:
+  title: 'media: sta2x11: fix irq handler cast'
+  mainline: 3de49ae81c3a0f83a554ecbce4c08e019f30168e
+  backport: 95bfe2806bd05c524d8534070c038b8feaae436a
+34f0cabed648481fa21d50a551524115f9326257:
+  title: 'drm/amd/display: Fix nanosec stat overflow'
+  mainline: 14d68acfd04b39f34eea7bea65dda652e6db5bf6
+  skipped: fixes non-present a3e1737ed61c8b6ea078f477eee612e26f9d2561
+56199ebbcbbcc36658c2212b854b37dff8419e52:
+  title: 'SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int'
+  mainline: 2c35f43b5a4b9cdfaa6fdd946f5a212615dac8eb
+  backport: 84b6065e346863ebad34cba5284ff8eddcf4cb4a
+6a55dab4ac956deb23690eedd74e70b892a378e7:
+  title: 'block: prevent division by zero in blk_rq_stat_sum()'
+  mainline: 93f52fbeaf4b676b21acfe42a5152620e6770d02
+  backport: 53510903f234a0aea0f80bd7d3bcccf520fc07c9
+61f291137c04238f8347b1ae184c5b92fabdb3c0:
+  title: 'Input: allocate keycode for Display refresh rate toggle'
+  mainline: cfeb98b95fff25c442f78a6f616c627bc48a26b7
+  skipped: commit did not cherry-pick cleanly
+50e05164d41db0231f2d3273f89a24e2bb62149b:
+  title: 'ktest: force $buildonly = 1 for ''make_warnings_file'' test type'
+  mainline: 07283c1873a4d0eaa0e822536881bfdaea853910
+  skipped: commit did not cherry-pick cleanly
+4a886ce3c846032ed8d9bf18f525f12dcb5de614:
+  title: 'tools: iio: replace seekdir() in iio_generic_buffer'
+  mainline: 4e6500bfa053dc133021f9c144261b77b0ba7dc8
+  backport: 2929cf2f94cfec0fb6afbcdd27ec2bfb6fae1a59
+f90519f1d6a0c4d86bcd401f34bda11486fa4284:
+  title: 'usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined'
+  mainline: 12f371e2b6cb4b79c788f1f073992e115f4ca918
+  backport: b550cc1a3828e39bb76a2c0d8218b57dc8f71f0d
+3affd4cceebd560aa13c280fe0ad46a38e46eb73:
+  title: 'fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2'
+  mainline: bc87bb342f106a0402186bcb588fcbe945dced4b
+  backport: 781096a3f8ab4b70c9b75f8c0d3e5f694e16d843
+1fb52bc1de55e9e0bdf71fe078efd4da0889710f:
+  title: 'fbmon: prevent division by zero in fb_videomode_from_videomode()'
+  mainline: c2d953276b8b27459baed1277a4fdd5dd9bd4126
+  backport: ebe31b54cbaf1029c6ecd6f8e59d6bb59b59280a
+7d303dee473ba3529d75b63491e9963342107bed:
+  title: 'tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc'
+  mainline: 67c37756898a5a6b2941a13ae7260c89b54e0d88
+  backport: d7d6dfa21578d006e6023f9eddc4029774e6a6d6
+4d0adb19dc8aba90f2298560fd65871f1afbd2ca:
+  title: 'drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()'
+5908fb34c0cf62c0f25f916d50d00582b053e077:
+  title: 'virtio: reenable config if freezing device failed'
+  mainline: 310227f42882c52356b523e2f4e11690eebcd2ab
+  backport: 6419be48607d845c7b94621da5405191a0805754
+f18681daaec9665a15c5e7e0f591aad5d0ac622b:
+  title: 'x86/mm/pat: fix VM_PAT handling in COW mappings'
+  mainline: 04c35ab3bdae7fefbd7c7a7355f29fa03a035221
+  backport: e917dc0ff33859792cb7328fc84068471824639b
+81a3ce3efd82e0790a6151c3dad6c02570d48816:
+  title: 'Bluetooth: btintel: Fixe build regression'
+  mainline: 6e62ebfb49eb65bdcbfc5797db55e0ce7f79c3dd
+  backport: 9be9972d568f71227eb0d8b300af769013f27b42
+cc065e1b11a270ebd2b18bbe61f0d6cc8efaa15d:
+  title: 'VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()'
+  mainline: e606e4b71798cc1df20e987dde2468e9527bd376
+  backport: 84edf3cb66dffa4c868347741aa8ac43073ffcf1
+584661cc24d740bc0d68b605e7089d80a99bba9d:
+  title: 'erspan: Check IFLA_GRE_ERSPAN_VER is set.'
+  mainline: 51fa960d3b5163b1af22efdebcabfccc5d615ad6
+  skipped: commit did not cherry-pick cleanly
+cb2dd30f318974cc640f1b1929f501ea9cb94bd5:
+  title: 'ip_gre: do not report erspan version on GRE interface'
+  mainline: ee496694b9eea651ae1aa4c4667d886cdf74aa3b
+  skipped: commit did not cherry-pick cleanly
+931e5381cb30355332f20854f80a0a1f18f6f1f1:
+  title: 'initramfs: fix populate_initrd_image() section mismatch'
+  mainline: 4ada1e810038e9dbc20e40b524e05ee1a9d31f98
+  skipped: commit did not cherry-pick cleanly
+e6721ea845fcb93a764a92bd40f1afc0d6c69751:
+  title: 'amdkfd: use calloc instead of kzalloc to avoid integer overflow'
+  mainline: 3b0daecfeac0103aba8b293df07a0cbaf8b43f29
+  skipped: vulnerable code is not present
diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
index 0fba375..3056003 100644
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -484,11 +484,14 @@
 
    Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at
    boot, by setting the IBRS bit, and they're automatically protected against
-   Spectre v2 variant attacks, including cross-thread branch target injections
-   on SMT systems (STIBP). In other words, eIBRS enables STIBP too.
+   Spectre v2 variant attacks.
 
-   Legacy IBRS systems clear the IBRS bit on exit to userspace and
-   therefore explicitly enable STIBP for that
+   On Intel's enhanced IBRS systems, this includes cross-thread branch target
+   injections on SMT systems (STIBP). In other words, Intel eIBRS enables
+   STIBP, too.
+
+   AMD Automatic IBRS does not protect userspace, and Legacy IBRS systems clear
+   the IBRS bit on exit to userspace, therefore both explicitly enable STIBP.
 
    The retpoline mitigation is turned on by default on vulnerable
    CPUs. It can be forced on or off by the administrator
@@ -622,9 +625,10 @@
                 retpoline,generic       Retpolines
                 retpoline,lfence        LFENCE; indirect branch
                 retpoline,amd           alias for retpoline,lfence
-                eibrs                   enhanced IBRS
-                eibrs,retpoline         enhanced IBRS + Retpolines
-                eibrs,lfence            enhanced IBRS + LFENCE
+                eibrs                   Enhanced/Auto IBRS
+                eibrs,retpoline         Enhanced/Auto IBRS + Retpolines
+                eibrs,lfence            Enhanced/Auto IBRS + LFENCE
+                ibrs                    use IBRS to protect kernel
 
 		Not specifying this option is equivalent to
 		spectre_v2=auto.
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 0b0638a..1127a06 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4248,9 +4248,9 @@
 			retpoline,generic - Retpolines
 			retpoline,lfence  - LFENCE; indirect branch
 			retpoline,amd     - alias for retpoline,lfence
-			eibrs		  - enhanced IBRS
-			eibrs,retpoline   - enhanced IBRS + Retpolines
-			eibrs,lfence      - enhanced IBRS + LFENCE
+			eibrs		  - Enhanced/Auto IBRS
+			eibrs,retpoline   - Enhanced/Auto IBRS + Retpolines
+			eibrs,lfence      - Enhanced/Auto IBRS + LFENCE
 			ibrs		  - use IBRS to protect kernel
 
 			Not specifying this option is equivalent to
diff --git a/Makefile b/Makefile
index 8077880..a75486f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 14
-SUBLEVEL = 344
+SUBLEVEL = 345
 EXTRAVERSION = -openela
 NAME = Petit Gorille
 
diff --git a/arch/arm/boot/dts/mmp2-brownstone.dts b/arch/arm/boot/dts/mmp2-brownstone.dts
index 350208c..f12d5aa 100644
--- a/arch/arm/boot/dts/mmp2-brownstone.dts
+++ b/arch/arm/boot/dts/mmp2-brownstone.dts
@@ -21,176 +21,174 @@
 	memory {
 		reg = <0x00000000 0x08000000>;
 	};
+};
 
-	soc {
-		apb@d4000000 {
-			uart3: uart@d4018000 {
-				status = "okay";
-			};
-			twsi1: i2c@d4011000 {
-				status = "okay";
-				pmic: max8925@3c {
-					compatible = "maxium,max8925";
-					reg = <0x3c>;
-					interrupts = <1>;
-					interrupt-parent = <&intcmux4>;
-					interrupt-controller;
-					#interrupt-cells = <1>;
-					maxim,tsc-irq = <0>;
+&uart3 {
+	status = "okay";
+};
 
-					regulators {
-						SDV1 {
-							regulator-min-microvolt = <637500>;
-							regulator-max-microvolt = <1425000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						SDV2 {
-							regulator-min-microvolt = <650000>;
-							regulator-max-microvolt = <2225000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						SDV3 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO1 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO2 {
-							regulator-min-microvolt = <650000>;
-							regulator-max-microvolt = <2250000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO3 {
-							regulator-min-microvolt = <650000>;
-							regulator-max-microvolt = <2250000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO4 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO5 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO6 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO7 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO8 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO9 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO10 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-						};
-						LDO11 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO12 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO13 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO14 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO15 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO16 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO17 {
-							regulator-min-microvolt = <650000>;
-							regulator-max-microvolt = <2250000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO18 {
-							regulator-min-microvolt = <650000>;
-							regulator-max-microvolt = <2250000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO19 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO20 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-					};
-					backlight {
-						maxim,max8925-dual-string = <0>;
-					};
-					charger {
-						batt-detect = <0>;
-						topoff-threshold = <1>;
-						fast-charge = <7>;
-						no-temp-support = <0>;
-						no-insert-detect = <0>;
-					};
-				};
+&twsi1 {
+	status = "okay";
+	pmic: max8925@3c {
+		compatible = "maxim,max8925";
+		reg = <0x3c>;
+		interrupts = <1>;
+		interrupt-parent = <&intcmux4>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		maxim,tsc-irq = <0>;
+
+		regulators {
+			SDV1 {
+				regulator-min-microvolt = <637500>;
+				regulator-max-microvolt = <1425000>;
+				regulator-boot-on;
+				regulator-always-on;
 			};
-			rtc: rtc@d4010000 {
-				status = "okay";
+			SDV2 {
+				regulator-min-microvolt = <650000>;
+				regulator-max-microvolt = <2225000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			SDV3 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO1 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO2 {
+				regulator-min-microvolt = <650000>;
+				regulator-max-microvolt = <2250000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO3 {
+				regulator-min-microvolt = <650000>;
+				regulator-max-microvolt = <2250000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO4 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO5 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO6 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO7 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO8 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO9 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO10 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+			};
+			LDO11 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO12 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO13 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO14 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO15 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO16 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO17 {
+				regulator-min-microvolt = <650000>;
+				regulator-max-microvolt = <2250000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO18 {
+				regulator-min-microvolt = <650000>;
+				regulator-max-microvolt = <2250000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO19 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO20 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
 			};
 		};
+		backlight {
+			maxim,max8925-dual-string = <0>;
+		};
+		charger {
+			batt-detect = <0>;
+			topoff-threshold = <1>;
+			fast-charge = <7>;
+			no-temp-support = <0>;
+			no-insert-detect = <0>;
+		};
 	};
 };
+
+&rtc {
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index 029d457..c20e4a9 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -1603,16 +1603,20 @@
 	hdmi: hdmi@ff940000 {
 		compatible = "rockchip,rk3399-dw-hdmi";
 		reg = <0x0 0xff940000 0x0 0x20000>;
+		reg-io-width = <4>;
 		interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH 0>;
 		clocks = <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_SFR>, <&cru PLL_VPLL>, <&cru PCLK_VIO_GRF>;
 		clock-names = "iahb", "isfr", "vpll", "grf";
 		power-domains = <&power RK3399_PD_HDCP>;
-		reg-io-width = <4>;
 		rockchip,grf = <&grf>;
 		status = "disabled";
 
 		ports {
-			hdmi_in: port {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hdmi_in: port@0 {
+				reg = <0>;
 				#address-cells = <1>;
 				#size-cells = <0>;
 
@@ -1625,6 +1629,10 @@
 					remote-endpoint = <&vopl_out_hdmi>;
 				};
 			};
+
+			hdmi_out: port@1 {
+				reg = <1>;
+			};
 		};
 	};
 
diff --git a/arch/parisc/include/asm/checksum.h b/arch/parisc/include/asm/checksum.h
index 3cbf1f1..ef34e8f 100644
--- a/arch/parisc/include/asm/checksum.h
+++ b/arch/parisc/include/asm/checksum.h
@@ -42,31 +42,32 @@
 static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
 {
 	unsigned int sum;
+	unsigned long t0, t1, t2;
 
 	__asm__ __volatile__ (
 "	ldws,ma		4(%1), %0\n"
 "	addib,<=	-4, %2, 2f\n"
 "\n"
-"	ldws		4(%1), %%r20\n"
-"	ldws		8(%1), %%r21\n"
-"	add		%0, %%r20, %0\n"
-"	ldws,ma		12(%1), %%r19\n"
-"	addc		%0, %%r21, %0\n"
-"	addc		%0, %%r19, %0\n"
-"1:	ldws,ma		4(%1), %%r19\n"
-"	addib,<		0, %2, 1b\n"
-"	addc		%0, %%r19, %0\n"
+"	ldws		4(%1), %4\n"
+"	ldws		8(%1), %5\n"
+"	add		%0, %4, %0\n"
+"	ldws,ma		12(%1), %3\n"
+"	addc		%0, %5, %0\n"
+"	addc		%0, %3, %0\n"
+"1:	ldws,ma		4(%1), %3\n"
+"	addib,>		-1, %2, 1b\n"
+"	addc		%0, %3, %0\n"
 "\n"
-"	extru		%0, 31, 16, %%r20\n"
-"	extru		%0, 15, 16, %%r21\n"
-"	addc		%%r20, %%r21, %0\n"
-"	extru		%0, 15, 16, %%r21\n"
-"	add		%0, %%r21, %0\n"
+"	extru		%0, 31, 16, %4\n"
+"	extru		%0, 15, 16, %5\n"
+"	addc		%4, %5, %0\n"
+"	extru		%0, 15, 16, %5\n"
+"	add		%0, %5, %0\n"
 "	subi		-1, %0, %0\n"
 "2:\n"
-	: "=r" (sum), "=r" (iph), "=r" (ihl)
+	: "=r" (sum), "=r" (iph), "=r" (ihl), "=r" (t0), "=r" (t1), "=r" (t2)
 	: "1" (iph), "2" (ihl)
-	: "r19", "r20", "r21", "memory");
+	: "memory");
 
 	return (__force __sum16)sum;
 }
@@ -126,6 +127,10 @@
 					  __u32 len, __u8 proto,
 					  __wsum sum)
 {
+	unsigned long t0, t1, t2, t3;
+
+	len += proto;	/* add 16-bit proto + len */
+
 	__asm__ __volatile__ (
 
 #if BITS_PER_LONG > 32
@@ -136,20 +141,20 @@
 	** Try to keep 4 registers with "live" values ahead of the ALU.
 	*/
 
-"	ldd,ma		8(%1), %%r19\n"	/* get 1st saddr word */
-"	ldd,ma		8(%2), %%r20\n"	/* get 1st daddr word */
-"	add		%8, %3, %3\n"/* add 16-bit proto + len */
-"	add		%%r19, %0, %0\n"
-"	ldd,ma		8(%1), %%r21\n"	/* 2cd saddr */
-"	ldd,ma		8(%2), %%r22\n"	/* 2cd daddr */
-"	add,dc		%%r20, %0, %0\n"
-"	add,dc		%%r21, %0, %0\n"
-"	add,dc		%%r22, %0, %0\n"
+"	depdi		0, 31, 32, %0\n"/* clear upper half of incoming checksum */
+"	ldd,ma		8(%1), %4\n"	/* get 1st saddr word */
+"	ldd,ma		8(%2), %5\n"	/* get 1st daddr word */
+"	add		%4, %0, %0\n"
+"	ldd,ma		8(%1), %6\n"	/* 2nd saddr */
+"	ldd,ma		8(%2), %7\n"	/* 2nd daddr */
+"	add,dc		%5, %0, %0\n"
+"	add,dc		%6, %0, %0\n"
+"	add,dc		%7, %0, %0\n"
 "	add,dc		%3, %0, %0\n"  /* fold in proto+len | carry bit */
-"	extrd,u		%0, 31, 32, %%r19\n"	/* copy upper half down */
-"	depdi		0, 31, 32, %0\n"	/* clear upper half */
-"	add		%%r19, %0, %0\n"	/* fold into 32-bits */
-"	addc		0, %0, %0\n"		/* add carry */
+"	extrd,u		%0, 31, 32, %4\n"/* copy upper half down */
+"	depdi		0, 31, 32, %0\n"/* clear upper half */
+"	add,dc		%4, %0, %0\n"	/* fold into 32-bits, plus carry */
+"	addc		0, %0, %0\n"	/* add final carry */
 
 #else
 
@@ -158,30 +163,30 @@
 	** Insn stream is serialized on the carry bit here too.
 	** result from the previous operation (eg r0 + x)
 	*/
-
-"	ldw,ma		4(%1), %%r19\n"	/* get 1st saddr word */
-"	ldw,ma		4(%2), %%r20\n"	/* get 1st daddr word */
-"	add		%8, %3, %3\n"	/* add 16-bit proto + len */
-"	add		%%r19, %0, %0\n"
-"	ldw,ma		4(%1), %%r21\n"	/* 2cd saddr */
-"	addc		%%r20, %0, %0\n"
-"	ldw,ma		4(%2), %%r22\n"	/* 2cd daddr */
-"	addc		%%r21, %0, %0\n"
-"	ldw,ma		4(%1), %%r19\n"	/* 3rd saddr */
-"	addc		%%r22, %0, %0\n"
-"	ldw,ma		4(%2), %%r20\n"	/* 3rd daddr */
-"	addc		%%r19, %0, %0\n"
-"	ldw,ma		4(%1), %%r21\n"	/* 4th saddr */
-"	addc		%%r20, %0, %0\n"
-"	ldw,ma		4(%2), %%r22\n"	/* 4th daddr */
-"	addc		%%r21, %0, %0\n"
-"	addc		%%r22, %0, %0\n"
-"	addc		%3, %0, %0\n"	/* fold in proto+len, catch carry */
+"	ldw,ma		4(%1), %4\n"	/* get 1st saddr word */
+"	ldw,ma		4(%2), %5\n"	/* get 1st daddr word */
+"	add		%4, %0, %0\n"
+"	ldw,ma		4(%1), %6\n"	/* 2nd saddr */
+"	addc		%5, %0, %0\n"
+"	ldw,ma		4(%2), %7\n"	/* 2nd daddr */
+"	addc		%6, %0, %0\n"
+"	ldw,ma		4(%1), %4\n"	/* 3rd saddr */
+"	addc		%7, %0, %0\n"
+"	ldw,ma		4(%2), %5\n"	/* 3rd daddr */
+"	addc		%4, %0, %0\n"
+"	ldw,ma		4(%1), %6\n"	/* 4th saddr */
+"	addc		%5, %0, %0\n"
+"	ldw,ma		4(%2), %7\n"	/* 4th daddr */
+"	addc		%6, %0, %0\n"
+"	addc		%7, %0, %0\n"
+"	addc		%3, %0, %0\n"	/* fold in proto+len */
+"	addc		0, %0, %0\n"	/* add carry */
 
 #endif
-	: "=r" (sum), "=r" (saddr), "=r" (daddr), "=r" (len)
-	: "0" (sum), "1" (saddr), "2" (daddr), "3" (len), "r" (proto)
-	: "r19", "r20", "r21", "r22", "memory");
+	: "=r" (sum), "=r" (saddr), "=r" (daddr), "=r" (len),
+	  "=r" (t0), "=r" (t1), "=r" (t2), "=r" (t3)
+	: "0" (sum), "1" (saddr), "2" (daddr), "3" (len)
+	: "memory");
 	return csum_fold(sum);
 }
 
diff --git a/arch/powerpc/include/asm/reg_fsl_emb.h b/arch/powerpc/include/asm/reg_fsl_emb.h
index d7ccf93..3ee5744 100644
--- a/arch/powerpc/include/asm/reg_fsl_emb.h
+++ b/arch/powerpc/include/asm/reg_fsl_emb.h
@@ -10,9 +10,16 @@
 #ifndef __ASSEMBLY__
 /* Performance Monitor Registers */
 #define mfpmr(rn)	({unsigned int rval; \
-			asm volatile("mfpmr %0," __stringify(rn) \
+			asm volatile(".machine push; " \
+				     ".machine e300; " \
+				     "mfpmr %0," __stringify(rn) ";" \
+				     ".machine pop; " \
 				     : "=r" (rval)); rval;})
-#define mtpmr(rn, v)	asm volatile("mtpmr " __stringify(rn) ",%0" : : "r" (v))
+#define mtpmr(rn, v)	asm volatile(".machine push; " \
+				     ".machine e300; " \
+				     "mtpmr " __stringify(rn) ",%0; " \
+				     ".machine pop; " \
+				     : : "r" (v))
 #endif /* __ASSEMBLY__ */
 
 /* Freescale Book E Performance Monitor APU Registers */
diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index 41491eb..df61b9b 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile
@@ -43,6 +43,6 @@
 obj-$(CONFIG_FTR_FIXUP_SELFTEST) += feature-fixups-test.o
 
 obj-$(CONFIG_ALTIVEC)	+= xor_vmx.o xor_vmx_glue.o
-CFLAGS_xor_vmx.o += -maltivec $(call cc-option,-mabi=altivec)
+CFLAGS_xor_vmx.o += -mhard-float -maltivec $(call cc-option,-mabi=altivec)
 
 obj-$(CONFIG_PPC64) += $(obj64-y)
diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
index 048ad78..c28d933 100644
--- a/arch/sparc/kernel/nmi.c
+++ b/arch/sparc/kernel/nmi.c
@@ -272,7 +272,7 @@
 	if (!strncmp(str, "panic", 5))
 		panic_on_timeout = 1;
 
-	return 0;
+	return 1;
 }
 __setup("nmi_watchdog=", setup_nmi_watchdog);
 
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index c4308e1..8c299a0 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -368,6 +368,8 @@
 #define X86_FEATURE_ARCH_CAPABILITIES	(18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
 #define X86_FEATURE_SPEC_CTRL_SSBD	(18*32+31) /* "" Speculative Store Bypass Disable */
 
+#define X86_FEATURE_AUTOIBRS		(20*32+ 8) /* "" Automatic IBRS */
+
 /*
  * BUG word(s)
  */
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 7f1bb45..e9c2749 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -30,6 +30,7 @@
 #define _EFER_SVME		12 /* Enable virtualization */
 #define _EFER_LMSLE		13 /* Long Mode Segment Limit Enable */
 #define _EFER_FFXSR		14 /* Enable Fast FXSAVE/FXRSTOR */
+#define _EFER_AUTOIBRS		21 /* Enable Automatic IBRS */
 
 #define EFER_SCE		(1<<_EFER_SCE)
 #define EFER_LME		(1<<_EFER_LME)
@@ -38,6 +39,7 @@
 #define EFER_SVME		(1<<_EFER_SVME)
 #define EFER_LMSLE		(1<<_EFER_LMSLE)
 #define EFER_FFXSR		(1<<_EFER_FFXSR)
+#define EFER_AUTOIBRS		(1<<_EFER_AUTOIBRS)
 
 /* Intel MSRs. Some also available on other CPUs */
 
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index fc92812..af5dbce 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1151,19 +1151,21 @@
 	}
 
 	/*
-	 * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP
+	 * If no STIBP, Intel enhanced IBRS is enabled, or SMT impossible, STIBP
 	 * is not required.
 	 *
-	 * Enhanced IBRS also protects against cross-thread branch target
+	 * Intel's Enhanced IBRS also protects against cross-thread branch target
 	 * injection in user-mode as the IBRS bit remains always set which
 	 * implicitly enables cross-thread protections.  However, in legacy IBRS
 	 * mode, the IBRS bit is set only on kernel entry and cleared on return
-	 * to userspace. This disables the implicit cross-thread protection,
-	 * so allow for STIBP to be selected in that case.
+	 * to userspace.  AMD Automatic IBRS also does not protect userspace.
+	 * These modes therefore disable the implicit cross-thread protection,
+	 * so allow for STIBP to be selected in those cases.
 	 */
 	if (!boot_cpu_has(X86_FEATURE_STIBP) ||
 	    !smt_possible ||
-	    spectre_v2_in_eibrs_mode(spectre_v2_enabled))
+	    (spectre_v2_in_eibrs_mode(spectre_v2_enabled) &&
+	     !boot_cpu_has(X86_FEATURE_AUTOIBRS)))
 		return;
 
 	/*
@@ -1185,9 +1187,9 @@
 	[SPECTRE_V2_NONE]			= "Vulnerable",
 	[SPECTRE_V2_RETPOLINE]			= "Mitigation: Retpolines",
 	[SPECTRE_V2_LFENCE]			= "Mitigation: LFENCE",
-	[SPECTRE_V2_EIBRS]			= "Mitigation: Enhanced IBRS",
-	[SPECTRE_V2_EIBRS_LFENCE]		= "Mitigation: Enhanced IBRS + LFENCE",
-	[SPECTRE_V2_EIBRS_RETPOLINE]		= "Mitigation: Enhanced IBRS + Retpolines",
+	[SPECTRE_V2_EIBRS]			= "Mitigation: Enhanced / Automatic IBRS",
+	[SPECTRE_V2_EIBRS_LFENCE]		= "Mitigation: Enhanced / Automatic IBRS + LFENCE",
+	[SPECTRE_V2_EIBRS_RETPOLINE]		= "Mitigation: Enhanced / Automatic IBRS + Retpolines",
 	[SPECTRE_V2_IBRS]			= "Mitigation: IBRS",
 };
 
@@ -1256,7 +1258,7 @@
 	     cmd == SPECTRE_V2_CMD_EIBRS_LFENCE ||
 	     cmd == SPECTRE_V2_CMD_EIBRS_RETPOLINE) &&
 	    !boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
-		pr_err("%s selected but CPU doesn't have eIBRS. Switching to AUTO select\n",
+		pr_err("%s selected but CPU doesn't have Enhanced or Automatic IBRS. Switching to AUTO select\n",
 		       mitigation_options[i].option);
 		return SPECTRE_V2_CMD_AUTO;
 	}
@@ -1435,8 +1437,12 @@
 		pr_err(SPECTRE_V2_EIBRS_EBPF_MSG);
 
 	if (spectre_v2_in_ibrs_mode(mode)) {
-		x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
-		update_spec_ctrl(x86_spec_ctrl_base);
+		if (boot_cpu_has(X86_FEATURE_AUTOIBRS)) {
+			msr_set_bit(MSR_EFER, _EFER_AUTOIBRS);
+		} else {
+			x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
+			update_spec_ctrl(x86_spec_ctrl_base);
+		}
 	}
 
 	switch (mode) {
@@ -1520,8 +1526,8 @@
 	/*
 	 * Retpoline protects the kernel, but doesn't protect firmware.  IBRS
 	 * and Enhanced IBRS protect firmware too, so enable IBRS around
-	 * firmware calls only when IBRS / Enhanced IBRS aren't otherwise
-	 * enabled.
+	 * firmware calls only when IBRS / Enhanced / Automatic IBRS aren't
+	 * otherwise enabled.
 	 *
 	 * Use "mode" to check Enhanced IBRS instead of boot_cpu_has(), because
 	 * the user might select retpoline on the kernel command line and if
@@ -2131,69 +2137,69 @@
 static ssize_t l1tf_show_state(char *buf)
 {
 	if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO)
-		return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
+		return sysfs_emit(buf, "%s\n", L1TF_DEFAULT_MSG);
 
 	if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_EPT_DISABLED ||
 	    (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER &&
 	     sched_smt_active())) {
-		return sprintf(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
-			       l1tf_vmx_states[l1tf_vmx_mitigation]);
+		return sysfs_emit(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
+				  l1tf_vmx_states[l1tf_vmx_mitigation]);
 	}
 
-	return sprintf(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
-		       l1tf_vmx_states[l1tf_vmx_mitigation],
-		       sched_smt_active() ? "vulnerable" : "disabled");
+	return sysfs_emit(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
+			  l1tf_vmx_states[l1tf_vmx_mitigation],
+			  sched_smt_active() ? "vulnerable" : "disabled");
 }
 
 static ssize_t itlb_multihit_show_state(char *buf)
 {
 	if (itlb_multihit_kvm_mitigation)
-		return sprintf(buf, "KVM: Mitigation: Split huge pages\n");
+		return sysfs_emit(buf, "KVM: Mitigation: Split huge pages\n");
 	else
-		return sprintf(buf, "KVM: Vulnerable\n");
+		return sysfs_emit(buf, "KVM: Vulnerable\n");
 }
 #else
 static ssize_t l1tf_show_state(char *buf)
 {
-	return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
+	return sysfs_emit(buf, "%s\n", L1TF_DEFAULT_MSG);
 }
 
 static ssize_t itlb_multihit_show_state(char *buf)
 {
-	return sprintf(buf, "Processor vulnerable\n");
+	return sysfs_emit(buf, "Processor vulnerable\n");
 }
 #endif
 
 static ssize_t mds_show_state(char *buf)
 {
 	if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
-		return sprintf(buf, "%s; SMT Host state unknown\n",
-			       mds_strings[mds_mitigation]);
+		return sysfs_emit(buf, "%s; SMT Host state unknown\n",
+				  mds_strings[mds_mitigation]);
 	}
 
 	if (boot_cpu_has(X86_BUG_MSBDS_ONLY)) {
-		return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
-			       (mds_mitigation == MDS_MITIGATION_OFF ? "vulnerable" :
-			        sched_smt_active() ? "mitigated" : "disabled"));
+		return sysfs_emit(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
+				  (mds_mitigation == MDS_MITIGATION_OFF ? "vulnerable" :
+				   sched_smt_active() ? "mitigated" : "disabled"));
 	}
 
-	return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
-		       sched_smt_active() ? "vulnerable" : "disabled");
+	return sysfs_emit(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
+			  sched_smt_active() ? "vulnerable" : "disabled");
 }
 
 static ssize_t tsx_async_abort_show_state(char *buf)
 {
 	if ((taa_mitigation == TAA_MITIGATION_TSX_DISABLED) ||
 	    (taa_mitigation == TAA_MITIGATION_OFF))
-		return sprintf(buf, "%s\n", taa_strings[taa_mitigation]);
+		return sysfs_emit(buf, "%s\n", taa_strings[taa_mitigation]);
 
 	if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
-		return sprintf(buf, "%s; SMT Host state unknown\n",
-			       taa_strings[taa_mitigation]);
+		return sysfs_emit(buf, "%s; SMT Host state unknown\n",
+				  taa_strings[taa_mitigation]);
 	}
 
-	return sprintf(buf, "%s; SMT %s\n", taa_strings[taa_mitigation],
-		       sched_smt_active() ? "vulnerable" : "disabled");
+	return sysfs_emit(buf, "%s; SMT %s\n", taa_strings[taa_mitigation],
+			  sched_smt_active() ? "vulnerable" : "disabled");
 }
 
 static ssize_t mmio_stale_data_show_state(char *buf)
@@ -2215,7 +2221,8 @@
 
 static char *stibp_state(void)
 {
-	if (spectre_v2_in_eibrs_mode(spectre_v2_enabled))
+	if (spectre_v2_in_eibrs_mode(spectre_v2_enabled) &&
+	    !boot_cpu_has(X86_FEATURE_AUTOIBRS))
 		return "";
 
 	switch (spectre_v2_user_stibp) {
@@ -2261,33 +2268,33 @@
 static ssize_t spectre_v2_show_state(char *buf)
 {
 	if (spectre_v2_enabled == SPECTRE_V2_LFENCE)
-		return sprintf(buf, "Vulnerable: LFENCE\n");
+		return sysfs_emit(buf, "Vulnerable: LFENCE\n");
 
 	if (spectre_v2_enabled == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
-		return sprintf(buf, "Vulnerable: eIBRS with unprivileged eBPF\n");
+		return sysfs_emit(buf, "Vulnerable: eIBRS with unprivileged eBPF\n");
 
 	if (sched_smt_active() && unprivileged_ebpf_enabled() &&
 	    spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)
-		return sprintf(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n");
+		return sysfs_emit(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n");
 
-	return sprintf(buf, "%s%s%s%s%s%s%s\n",
-		       spectre_v2_strings[spectre_v2_enabled],
-		       ibpb_state(),
-		       boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
-		       stibp_state(),
-		       boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
-		       pbrsb_eibrs_state(),
-		       spectre_v2_module_string());
+	return sysfs_emit(buf, "%s%s%s%s%s%s%s\n",
+			  spectre_v2_strings[spectre_v2_enabled],
+			  ibpb_state(),
+			  boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
+			  stibp_state(),
+			  boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
+			  pbrsb_eibrs_state(),
+			  spectre_v2_module_string());
 }
 
 static ssize_t srbds_show_state(char *buf)
 {
-	return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]);
+	return sysfs_emit(buf, "%s\n", srbds_strings[srbds_mitigation]);
 }
 
 static ssize_t retbleed_show_state(char *buf)
 {
-	return sprintf(buf, "%s\n", retbleed_strings[retbleed_mitigation]);
+	return sysfs_emit(buf, "%s\n", retbleed_strings[retbleed_mitigation]);
 }
 
 static ssize_t gds_show_state(char *buf)
@@ -2299,23 +2306,26 @@
 			       char *buf, unsigned int bug)
 {
 	if (!boot_cpu_has_bug(bug))
-		return sprintf(buf, "Not affected\n");
+		return sysfs_emit(buf, "Not affected\n");
 
 	switch (bug) {
 	case X86_BUG_CPU_MELTDOWN:
 		if (boot_cpu_has(X86_FEATURE_PTI))
-			return sprintf(buf, "Mitigation: PTI\n");
+			return sysfs_emit(buf, "Mitigation: PTI\n");
+
+		if (hypervisor_is_type(X86_HYPER_XEN_PV))
+			return sysfs_emit(buf, "Unknown (XEN PV detected, hypervisor mitigation required)\n");
 
 		break;
 
 	case X86_BUG_SPECTRE_V1:
-		return sprintf(buf, "%s\n", spectre_v1_strings[spectre_v1_mitigation]);
+		return sysfs_emit(buf, "%s\n", spectre_v1_strings[spectre_v1_mitigation]);
 
 	case X86_BUG_SPECTRE_V2:
 		return spectre_v2_show_state(buf);
 
 	case X86_BUG_SPEC_STORE_BYPASS:
-		return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
+		return sysfs_emit(buf, "%s\n", ssb_strings[ssb_mode]);
 
 	case X86_BUG_L1TF:
 		if (boot_cpu_has(X86_FEATURE_L1TF_PTEINV))
@@ -2348,7 +2358,7 @@
 		break;
 	}
 
-	return sprintf(buf, "Vulnerable\n");
+	return sysfs_emit(buf, "Vulnerable\n");
 }
 
 ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 002233b..dfc53fe 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -976,7 +976,7 @@
 	VULNWL_AMD(0x12,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
 
 	/* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */
-	VULNWL_AMD(X86_FAMILY_ANY,	NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
+	VULNWL_AMD(X86_FAMILY_ANY,	NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_EIBRS_PBRSB),
 	{}
 };
 
@@ -1084,8 +1084,16 @@
 	   !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
 		setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
 
-	if (ia32_cap & ARCH_CAP_IBRS_ALL)
+	/*
+	 * AMD's AutoIBRS is equivalent to Intel's eIBRS - use the Intel feature
+	 * flag and protect from vendor-specific bugs via the whitelist.
+	 */
+	if ((ia32_cap & ARCH_CAP_IBRS_ALL) || cpu_has(c, X86_FEATURE_AUTOIBRS)) {
 		setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
+		if (!cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) &&
+		    !(ia32_cap & ARCH_CAP_PBRSB_NO))
+			setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB);
+	}
 
 	if (!cpu_matches(cpu_vuln_whitelist, NO_MDS) &&
 	    !(ia32_cap & ARCH_CAP_MDS_NO)) {
@@ -1147,11 +1155,6 @@
 			setup_force_cpu_bug(X86_BUG_RETBLEED);
 	}
 
-	if (cpu_has(c, X86_FEATURE_IBRS_ENHANCED) &&
-	    !cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) &&
-	    !(ia32_cap & ARCH_CAP_PBRSB_NO))
-		setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB);
-
 	/*
 	 * Check if CPU is vulnerable to GDS. If running in a virtual machine on
 	 * an affected processor, the VMM may have disabled the use of GATHER by
diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
index 50c537a..407fa1d 100644
--- a/arch/x86/mm/ident_map.c
+++ b/arch/x86/mm/ident_map.c
@@ -26,31 +26,18 @@
 	for (; addr < end; addr = next) {
 		pud_t *pud = pud_page + pud_index(addr);
 		pmd_t *pmd;
-		bool use_gbpage;
 
 		next = (addr & PUD_MASK) + PUD_SIZE;
 		if (next > end)
 			next = end;
 
-		/* if this is already a gbpage, this portion is already mapped */
-		if (pud_large(*pud))
-			continue;
-
-		/* Is using a gbpage allowed? */
-		use_gbpage = info->direct_gbpages;
-
-		/* Don't use gbpage if it maps more than the requested region. */
-		/* at the begining: */
-		use_gbpage &= ((addr & ~PUD_MASK) == 0);
-		/* ... or at the end: */
-		use_gbpage &= ((next & ~PUD_MASK) == 0);
-
-		/* Never overwrite existing mappings */
-		use_gbpage &= !pud_present(*pud);
-
-		if (use_gbpage) {
+		if (info->direct_gbpages) {
 			pud_t pudval;
 
+			if (pud_present(*pud))
+				continue;
+
+			addr &= PUD_MASK;
 			pudval = __pud((addr - info->offset) | info->page_flag);
 			set_pud(pud, pudval);
 			continue;
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 49aeb4e..2984ec1 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -33,6 +33,7 @@
 
 #include "pat_internal.h"
 #include "mm_internal.h"
+#include "../../mm/internal.h"	/* is_cow_mapping() */
 
 #undef pr_fmt
 #define pr_fmt(fmt) "" fmt
@@ -910,6 +911,38 @@
 		free_memtype(paddr, paddr + size);
 }
 
+static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr,
+		pgprot_t *pgprot)
+{
+	unsigned long prot;
+
+	VM_WARN_ON_ONCE(!(vma->vm_flags & VM_PAT));
+
+	/*
+	 * We need the starting PFN and cachemode used for track_pfn_remap()
+	 * that covered the whole VMA. For most mappings, we can obtain that
+	 * information from the page tables. For COW mappings, we might now
+	 * suddenly have anon folios mapped and follow_phys() will fail.
+	 *
+	 * Fallback to using vma->vm_pgoff, see remap_pfn_range_notrack(), to
+	 * detect the PFN. If we need the cachemode as well, we're out of luck
+	 * for now and have to fail fork().
+	 */
+	if (!follow_phys(vma, vma->vm_start, 0, &prot, paddr)) {
+		if (pgprot)
+			*pgprot = __pgprot(prot);
+		return 0;
+	}
+	if (is_cow_mapping(vma->vm_flags)) {
+		if (pgprot)
+			return -EINVAL;
+		*paddr = (resource_size_t)vma->vm_pgoff << PAGE_SHIFT;
+		return 0;
+	}
+	WARN_ON_ONCE(1);
+	return -EINVAL;
+}
+
 /*
  * track_pfn_copy is called when vma that is covering the pfnmap gets
  * copied through copy_page_range().
@@ -920,20 +953,13 @@
 int track_pfn_copy(struct vm_area_struct *vma)
 {
 	resource_size_t paddr;
-	unsigned long prot;
 	unsigned long vma_size = vma->vm_end - vma->vm_start;
 	pgprot_t pgprot;
 
 	if (vma->vm_flags & VM_PAT) {
-		/*
-		 * reserve the whole chunk covered by vma. We need the
-		 * starting address and protection from pte.
-		 */
-		if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
-			WARN_ON_ONCE(1);
+		if (get_pat_info(vma, &paddr, &pgprot))
 			return -EINVAL;
-		}
-		pgprot = __pgprot(prot);
+		/* reserve the whole chunk covered by vma. */
 		return reserve_pfn_range(paddr, vma_size, &pgprot, 1);
 	}
 
@@ -1008,7 +1034,6 @@
 		 unsigned long size)
 {
 	resource_size_t paddr;
-	unsigned long prot;
 
 	if (vma && !(vma->vm_flags & VM_PAT))
 		return;
@@ -1016,11 +1041,8 @@
 	/* free the chunk starting from pfn or the whole chunk */
 	paddr = (resource_size_t)pfn << PAGE_SHIFT;
 	if (!paddr && !size) {
-		if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
-			WARN_ON_ONCE(1);
+		if (get_pat_info(vma, &paddr, NULL))
 			return;
-		}
-
 		size = vma->vm_end - vma->vm_start;
 	}
 	free_pfn_range(paddr, size);
diff --git a/block/blk-stat.c b/block/blk-stat.c
index c52356d..6106ade 100644
--- a/block/blk-stat.c
+++ b/block/blk-stat.c
@@ -49,7 +49,7 @@
 {
 	blk_stat_flush_batch(src);
 
-	if (!src->nr_samples)
+	if (dst->nr_samples + src->nr_samples <= dst->nr_samples)
 		return;
 
 	dst->min = min(dst->min, src->min);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index c2e5ef7..5b810a29 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -605,11 +605,6 @@
 static void ahci_pci_save_initial_config(struct pci_dev *pdev,
 					 struct ahci_host_priv *hpriv)
 {
-	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && pdev->device == 0x1166) {
-		dev_info(&pdev->dev, "ASM1166 has only six ports\n");
-		hpriv->saved_port_map = 0x3f;
-	}
-
 	if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) {
 		dev_info(&pdev->dev, "JMB361 has only one port\n");
 		hpriv->force_port_map = 1;
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index c2dc8e5..99e59af 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -796,37 +796,6 @@
 	},
 };
 
-static const struct pci_device_id mv_pci_tbl[] = {
-	{ PCI_VDEVICE(MARVELL, 0x5040), chip_504x },
-	{ PCI_VDEVICE(MARVELL, 0x5041), chip_504x },
-	{ PCI_VDEVICE(MARVELL, 0x5080), chip_5080 },
-	{ PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
-	/* RocketRAID 1720/174x have different identifiers */
-	{ PCI_VDEVICE(TTI, 0x1720), chip_6042 },
-	{ PCI_VDEVICE(TTI, 0x1740), chip_6042 },
-	{ PCI_VDEVICE(TTI, 0x1742), chip_6042 },
-
-	{ PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
-	{ PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
-	{ PCI_VDEVICE(MARVELL, 0x6042), chip_6042 },
-	{ PCI_VDEVICE(MARVELL, 0x6080), chip_608x },
-	{ PCI_VDEVICE(MARVELL, 0x6081), chip_608x },
-
-	{ PCI_VDEVICE(ADAPTEC2, 0x0241), chip_604x },
-
-	/* Adaptec 1430SA */
-	{ PCI_VDEVICE(ADAPTEC2, 0x0243), chip_7042 },
-
-	/* Marvell 7042 support */
-	{ PCI_VDEVICE(MARVELL, 0x7042), chip_7042 },
-
-	/* Highpoint RocketRAID PCIe series */
-	{ PCI_VDEVICE(TTI, 0x2300), chip_7042 },
-	{ PCI_VDEVICE(TTI, 0x2310), chip_7042 },
-
-	{ }			/* terminate list */
-};
-
 static const struct mv_hw_ops mv5xxx_ops = {
 	.phy_errata		= mv5_phy_errata,
 	.enable_leds		= mv5_enable_leds,
@@ -4322,6 +4291,36 @@
 static int mv_pci_device_resume(struct pci_dev *pdev);
 #endif
 
+static const struct pci_device_id mv_pci_tbl[] = {
+	{ PCI_VDEVICE(MARVELL, 0x5040), chip_504x },
+	{ PCI_VDEVICE(MARVELL, 0x5041), chip_504x },
+	{ PCI_VDEVICE(MARVELL, 0x5080), chip_5080 },
+	{ PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
+	/* RocketRAID 1720/174x have different identifiers */
+	{ PCI_VDEVICE(TTI, 0x1720), chip_6042 },
+	{ PCI_VDEVICE(TTI, 0x1740), chip_6042 },
+	{ PCI_VDEVICE(TTI, 0x1742), chip_6042 },
+
+	{ PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
+	{ PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
+	{ PCI_VDEVICE(MARVELL, 0x6042), chip_6042 },
+	{ PCI_VDEVICE(MARVELL, 0x6080), chip_608x },
+	{ PCI_VDEVICE(MARVELL, 0x6081), chip_608x },
+
+	{ PCI_VDEVICE(ADAPTEC2, 0x0241), chip_604x },
+
+	/* Adaptec 1430SA */
+	{ PCI_VDEVICE(ADAPTEC2, 0x0243), chip_7042 },
+
+	/* Marvell 7042 support */
+	{ PCI_VDEVICE(MARVELL, 0x7042), chip_7042 },
+
+	/* Highpoint RocketRAID PCIe series */
+	{ PCI_VDEVICE(TTI, 0x2300), chip_7042 },
+	{ PCI_VDEVICE(TTI, 0x2310), chip_7042 },
+
+	{ }			/* terminate list */
+};
 
 static struct pci_driver mv_pci_driver = {
 	.name			= DRV_NAME,
@@ -4334,6 +4333,7 @@
 #endif
 
 };
+MODULE_DEVICE_TABLE(pci, mv_pci_tbl);
 
 /* move to PCI layer or libata core? */
 static int pci_go_64(struct pci_dev *pdev)
@@ -4536,7 +4536,6 @@
 MODULE_AUTHOR("Brett Russ");
 MODULE_DESCRIPTION("SCSI low-level driver for Marvell SATA controllers");
 MODULE_LICENSE("GPL v2");
-MODULE_DEVICE_TABLE(pci, mv_pci_tbl);
 MODULE_VERSION(DRV_VERSION);
 MODULE_ALIAS("platform:" DRV_NAME);
 
diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
index 0d74245..f217ac8 100644
--- a/drivers/ata/sata_sx4.c
+++ b/drivers/ata/sata_sx4.c
@@ -1020,8 +1020,7 @@
 
 	offset -= (idx * window_size);
 	idx++;
-	dist = ((long) (window_size - (offset + size))) >= 0 ? size :
-		(long) (window_size - offset);
+	dist = min(size, window_size - offset);
 	memcpy_fromio(psource, dimm_mmio + offset / 4, dist);
 
 	psource += dist;
@@ -1069,8 +1068,7 @@
 	readl(mmio + PDC_DIMM_WINDOW_CTLR);
 	offset -= (idx * window_size);
 	idx++;
-	dist = ((long)(s32)(window_size - (offset + size))) >= 0 ? size :
-		(long) (window_size - offset);
+	dist = min(size, window_size - offset);
 	memcpy_toio(dimm_mmio + offset / 4, psource, dist);
 	writel(0x01, mmio + PDC_GENERAL_CTLR);
 	readl(mmio + PDC_GENERAL_CTLR);
diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
index 5d6cff9..ddcbf15 100644
--- a/drivers/base/power/wakeirq.c
+++ b/drivers/base/power/wakeirq.c
@@ -369,8 +369,10 @@
 		return;
 
 	if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED &&
-	    wirq->status & WAKE_IRQ_DEDICATED_REVERSE)
+	    wirq->status & WAKE_IRQ_DEDICATED_REVERSE) {
 		enable_irq(wirq->irq);
+		wirq->status |= WAKE_IRQ_DEDICATED_ENABLED;
+	}
 }
 
 /**
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index c080a95..22b2a05 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1278,11 +1278,6 @@
 	info->lo_number = lo->lo_number;
 	info->lo_offset = lo->lo_offset;
 	info->lo_sizelimit = lo->lo_sizelimit;
-
-	/* loff_t vars have been assigned __u64 */
-	if (lo->lo_offset < 0 || lo->lo_sizelimit < 0)
-		return -EOVERFLOW;
-
 	info->lo_flags = lo->lo_flags;
 	memcpy(info->lo_file_name, lo->lo_file_name, LO_NAME_SIZE);
 	memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);
diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index d32e109..77923bb 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -360,7 +360,7 @@
 		return PTR_ERR(skb);
 	}
 
-	if (skb->len != sizeof(*ver)) {
+	if (!skb || skb->len != sizeof(*ver)) {
 		bt_dev_err(hdev, "Intel version event size mismatch");
 		kfree_skb(skb);
 		return -EILSEQ;
diff --git a/drivers/clk/qcom/mmcc-apq8084.c b/drivers/clk/qcom/mmcc-apq8084.c
index 30777f9..159c8cb 100644
--- a/drivers/clk/qcom/mmcc-apq8084.c
+++ b/drivers/clk/qcom/mmcc-apq8084.c
@@ -343,6 +343,7 @@
 	F(333430000, P_MMPLL1, 3.5, 0, 0),
 	F(400000000, P_MMPLL0, 2, 0, 0),
 	F(466800000, P_MMPLL1, 2.5, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 mmss_axi_clk_src = {
@@ -367,6 +368,7 @@
 	F(150000000, P_GPLL0, 4, 0, 0),
 	F(228570000, P_MMPLL0, 3.5, 0, 0),
 	F(320000000, P_MMPLL0, 2.5, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 ocmemnoc_clk_src = {
diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
index 715e7cd..34e8bc5 100644
--- a/drivers/clk/qcom/mmcc-msm8974.c
+++ b/drivers/clk/qcom/mmcc-msm8974.c
@@ -293,6 +293,7 @@
 	F(291750000, P_MMPLL1, 4, 0, 0),
 	F(400000000, P_MMPLL0, 2, 0, 0),
 	F(466800000, P_MMPLL1, 2.5, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 mmss_axi_clk_src = {
@@ -317,6 +318,7 @@
 	F(150000000, P_GPLL0, 4, 0, 0),
 	F(291750000, P_MMPLL1, 4, 0, 0),
 	F(400000000, P_MMPLL0, 2, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 ocmemnoc_clk_src = {
diff --git a/drivers/crypto/qat/qat_common/adf_aer.c b/drivers/crypto/qat/qat_common/adf_aer.c
index da8a2d3..b41c29a 100644
--- a/drivers/crypto/qat/qat_common/adf_aer.c
+++ b/drivers/crypto/qat/qat_common/adf_aer.c
@@ -139,18 +139,28 @@
 	if (adf_dev_init(accel_dev) || adf_dev_start(accel_dev)) {
 		/* The device hanged and we can't restart it so stop here */
 		dev_err(&GET_DEV(accel_dev), "Restart device failed\n");
-		kfree(reset_data);
+		if (reset_data->mode == ADF_DEV_RESET_ASYNC ||
+		    completion_done(&reset_data->compl))
+			kfree(reset_data);
 		WARN(1, "QAT: device restart failed. Device is unusable\n");
 		return;
 	}
 	adf_dev_restarted_notify(accel_dev);
 	clear_bit(ADF_STATUS_RESTARTING, &accel_dev->status);
 
-	/* The dev is back alive. Notify the caller if in sync mode */
-	if (reset_data->mode == ADF_DEV_RESET_SYNC)
-		complete(&reset_data->compl);
-	else
+	/*
+	 * The dev is back alive. Notify the caller if in sync mode
+	 *
+	 * If device restart will take a more time than expected,
+	 * the schedule_reset() function can timeout and exit. This can be
+	 * detected by calling the completion_done() function. In this case
+	 * the reset_data structure needs to be freed here.
+	 */
+	if (reset_data->mode == ADF_DEV_RESET_ASYNC ||
+	    completion_done(&reset_data->compl))
 		kfree(reset_data);
+	else
+		complete(&reset_data->compl);
 }
 
 static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev,
@@ -183,8 +193,9 @@
 			dev_err(&GET_DEV(accel_dev),
 				"Reset device timeout expired\n");
 			ret = -EFAULT;
+		} else {
+			kfree(reset_data);
 		}
-		kfree(reset_data);
 		return ret;
 	}
 	return 0;
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index e619ced..88c3f89 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -440,7 +440,7 @@
 		void *data, bool duplicates, struct list_head *head)
 {
 	const struct efivar_operations *ops;
-	unsigned long variable_name_size = 1024;
+	unsigned long variable_name_size = 512;
 	efi_char16_t *variable_name;
 	efi_status_t status;
 	efi_guid_t vendor_guid;
@@ -463,12 +463,13 @@
 	}
 
 	/*
-	 * Per EFI spec, the maximum storage allocated for both
-	 * the variable name and variable data is 1024 bytes.
+	 * A small set of old UEFI implementations reject sizes
+	 * above a certain threshold, the lowest seen in the wild
+	 * is 512.
 	 */
 
 	do {
-		variable_name_size = 1024;
+		variable_name_size = 512;
 
 		status = ops->get_next_variable(&variable_name_size,
 						variable_name,
@@ -512,9 +513,13 @@
 			break;
 		case EFI_NOT_FOUND:
 			break;
+		case EFI_BUFFER_TOO_SMALL:
+			pr_warn("efivars: Variable name size exceeds maximum (%lu > 512)\n",
+				variable_name_size);
+			status = EFI_NOT_FOUND;
+			break;
 		default:
-			printk(KERN_WARNING "efivars: get_next_variable: status=%lx\n",
-				status);
+			pr_warn("efivars: get_next_variable: status=%lx\n", status);
 			status = EFI_NOT_FOUND;
 			break;
 		}
diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
index 6420dec..8597532 100644
--- a/drivers/gpu/drm/imx/parallel-display.c
+++ b/drivers/gpu/drm/imx/parallel-display.c
@@ -72,14 +72,14 @@
 		int ret;
 
 		if (!mode)
-			return -EINVAL;
+			return 0;
 
 		ret = of_get_drm_display_mode(np, &imxpd->mode,
 					      &imxpd->bus_flags,
 					      OF_USE_NATIVE_MODE);
 		if (ret) {
 			drm_mode_destroy(connector->dev, mode);
-			return ret;
+			return 0;
 		}
 
 		drm_mode_copy(mode, &imxpd->mode);
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 3020ae7..44cfb7a 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -276,7 +276,7 @@
 	edid = drm_get_edid(connector, vc4->hdmi->ddc);
 	cec_s_phys_addr_from_edid(vc4->hdmi->cec_adap, edid);
 	if (!edid)
-		return -ENODEV;
+		return 0;
 
 	vc4_encoder->hdmi_monitor = drm_detect_hdmi_monitor(edid);
 
diff --git a/drivers/hwmon/amc6821.c b/drivers/hwmon/amc6821.c
index 46b4e35..b562337 100644
--- a/drivers/hwmon/amc6821.c
+++ b/drivers/hwmon/amc6821.c
@@ -1003,10 +1003,21 @@
 
 MODULE_DEVICE_TABLE(i2c, amc6821_id);
 
+static const struct of_device_id __maybe_unused amc6821_of_match[] = {
+	{
+		.compatible = "ti,amc6821",
+		.data = (void *)amc6821,
+	},
+	{ }
+};
+
+MODULE_DEVICE_TABLE(of, amc6821_of_match);
+
 static struct i2c_driver amc6821_driver = {
 	.class = I2C_CLASS_HWMON,
 	.driver = {
 		.name	= "amc6821",
+		.of_match_table = of_match_ptr(amc6821_of_match),
 	},
 	.probe = amc6821_probe,
 	.id_table = amc6821_id,
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 30a8d81..82eda2e 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -1206,7 +1206,11 @@
 		}
 		rmi_driver_set_input_params(rmi_dev, data->input);
 		data->input->phys = devm_kasprintf(dev, GFP_KERNEL,
-						"%s/input0", dev_name(dev));
+						   "%s/input0", dev_name(dev));
+		if (!data->input->phys) {
+			retval = -ENOMEM;
+			goto err;
+		}
 	}
 
 	retval = rmi_init_functions(data);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 54b99fc..3bb14f1 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3893,7 +3893,9 @@
 		 * Take this opportunity to check whether any failed
 		 * devices are reachable again.
 		 */
+		mddev_lock_nointr(mddev);
 		attempt_restore_of_faulty_devices(rs);
+		mddev_unlock(mddev);
 	}
 
 	mddev->ro = 0;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 6fca2df..d2ac3d1 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -44,6 +44,7 @@
  */
 
 #include <linux/blkdev.h>
+#include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/raid/pq.h>
 #include <linux/async_tx.h>
@@ -6308,7 +6309,18 @@
 			spin_unlock_irq(&conf->device_lock);
 			md_check_recovery(mddev);
 			spin_lock_irq(&conf->device_lock);
+
+			/*
+			 * Waiting on MD_SB_CHANGE_PENDING below may deadlock
+			 * seeing md_check_recovery() is needed to clear
+			 * the flag when using mdmon.
+			 */
+			continue;
 		}
+
+		wait_event_lock_irq(mddev->sb_wait,
+			!test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags),
+			conf->device_lock);
 	}
 	pr_debug("%d stripes handled\n", handled);
 
diff --git a/drivers/media/pci/sta2x11/sta2x11_vip.c b/drivers/media/pci/sta2x11/sta2x11_vip.c
index eb5a9ea..10154cd 100644
--- a/drivers/media/pci/sta2x11/sta2x11_vip.c
+++ b/drivers/media/pci/sta2x11/sta2x11_vip.c
@@ -765,7 +765,7 @@
 /**
  * vip_irq - interrupt routine
  * @irq: Number of interrupt ( not used, correct number is assumed )
- * @vip: local data structure containing all information
+ * @data: local data structure containing all information
  *
  * check for both frame interrupts set ( top and bottom ).
  * check FIFO overflow, but limit number of log messages after open.
@@ -775,8 +775,9 @@
  *
  * IRQ_HANDLED, interrupt done.
  */
-static irqreturn_t vip_irq(int irq, struct sta2x11_vip *vip)
+static irqreturn_t vip_irq(int irq, void *data)
 {
+	struct sta2x11_vip *vip = data;
 	unsigned int status;
 
 	status = reg_read(vip, DVP_ITS);
@@ -1057,9 +1058,7 @@
 
 	spin_lock_init(&vip->slock);
 
-	ret = request_irq(pdev->irq,
-			  (irq_handler_t) vip_irq,
-			  IRQF_SHARED, KBUILD_MODNAME, vip);
+	ret = request_irq(pdev->irq, vip_irq, IRQF_SHARED, KBUILD_MODNAME, vip);
 	if (ret) {
 		dev_err(&pdev->dev, "request_irq failed\n");
 		ret = -ENODEV;
diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
index 7130b9e..de69c9c 100644
--- a/drivers/media/tuners/xc4000.c
+++ b/drivers/media/tuners/xc4000.c
@@ -1524,10 +1524,10 @@
 {
 	struct xc4000_priv *priv = fe->tuner_priv;
 
+	mutex_lock(&priv->lock);
 	*freq = priv->freq_hz + priv->freq_offset;
 
 	if (debug) {
-		mutex_lock(&priv->lock);
 		if ((priv->cur_fw.type
 		     & (BASE | FM | DTV6 | DTV7 | DTV78 | DTV8)) == BASE) {
 			u16	snr = 0;
@@ -1538,8 +1538,8 @@
 				return 0;
 			}
 		}
-		mutex_unlock(&priv->lock);
 	}
+	mutex_unlock(&priv->lock);
 
 	dprintk(1, "%s()\n", __func__);
 
diff --git a/drivers/misc/vmw_vmci/vmci_datagram.c b/drivers/misc/vmw_vmci/vmci_datagram.c
index 8a4b6bb..129dd08 100644
--- a/drivers/misc/vmw_vmci/vmci_datagram.c
+++ b/drivers/misc/vmw_vmci/vmci_datagram.c
@@ -242,7 +242,8 @@
 
 			dg_info->in_dg_host_queue = true;
 			dg_info->entry = dst_entry;
-			memcpy(&dg_info->msg, dg, dg_size);
+			dg_info->msg = *dg;
+			memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size);
 
 			INIT_WORK(&dg_info->work, dg_delayed_dispatch);
 			schedule_work(&dg_info->work);
@@ -385,7 +386,8 @@
 
 		dg_info->in_dg_host_queue = false;
 		dg_info->entry = dst_entry;
-		memcpy(&dg_info->msg, dg, VMCI_DG_SIZE(dg));
+		dg_info->msg = *dg;
+		memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size);
 
 		INIT_WORK(&dg_info->work, dg_delayed_dispatch);
 		schedule_work(&dg_info->work);
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 71f4853..0e040f6 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -841,10 +841,11 @@
 static int mmc_blk_part_switch_pre(struct mmc_card *card,
 				   unsigned int part_type)
 {
-	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB;
+	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_MASK;
+	const unsigned int rpmb = EXT_CSD_PART_CONFIG_ACC_RPMB;
 	int ret = 0;
 
-	if ((part_type & mask) == mask) {
+	if ((part_type & mask) == rpmb) {
 		if (card->ext_csd.cmdq_en) {
 			ret = mmc_cmdq_disable(card);
 			if (ret)
@@ -859,10 +860,11 @@
 static int mmc_blk_part_switch_post(struct mmc_card *card,
 				    unsigned int part_type)
 {
-	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB;
+	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_MASK;
+	const unsigned int rpmb = EXT_CSD_PART_CONFIG_ACC_RPMB;
 	int ret = 0;
 
-	if ((part_type & mask) == mask) {
+	if ((part_type & mask) == rpmb) {
 		mmc_retune_unpause(card->host);
 		if (card->reenable_cmdq && !card->ext_csd.cmdq_en)
 			ret = mmc_cmdq_enable(card);
diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
index a09aad9..62a1c45 100644
--- a/drivers/mmc/host/tmio_mmc_core.c
+++ b/drivers/mmc/host/tmio_mmc_core.c
@@ -277,6 +277,8 @@
 	else
 		mrq->cmd->error = -ETIMEDOUT;
 
+	/* No new calls yet, but disallow concurrent tmio_mmc_done_work() */
+	host->mrq = ERR_PTR(-EBUSY);
 	host->cmd = NULL;
 	host->data = NULL;
 	host->force_pio = false;
diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
index 2882a57..124fd10 100644
--- a/drivers/mtd/ubi/fastmap.c
+++ b/drivers/mtd/ubi/fastmap.c
@@ -95,9 +95,10 @@
 		sizeof(struct ubi_fm_scan_pool) +
 		sizeof(struct ubi_fm_scan_pool) +
 		(ubi->peb_count * sizeof(struct ubi_fm_ec)) +
-		(sizeof(struct ubi_fm_eba) +
-		(ubi->peb_count * sizeof(__be32))) +
-		sizeof(struct ubi_fm_volhdr) * UBI_MAX_VOLUMES;
+		((sizeof(struct ubi_fm_eba) +
+		  sizeof(struct ubi_fm_volhdr)) *
+		 (UBI_MAX_VOLUMES + UBI_INT_VOL_COUNT)) +
+		(ubi->peb_count * sizeof(__be32));
 	return roundup(size, ubi->leb_size);
 }
 
diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index 7504f43..a1d1cd7 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -801,6 +801,12 @@
 	 * The number of supported volumes is limited by the eraseblock size
 	 * and by the UBI_MAX_VOLUMES constant.
 	 */
+
+	if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) {
+		ubi_err(ubi, "LEB size too small for a volume record");
+		return -EINVAL;
+	}
+
 	ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE;
 	if (ubi->vtbl_slots > UBI_MAX_VOLUMES)
 		ubi->vtbl_slots = UBI_MAX_VOLUMES;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index 9b12bb3..0580c7e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -83,17 +83,41 @@
 				     u32 prio, u32 queue)
 {
 	void __iomem *ioaddr = hw->pcsr;
-	u32 base_register;
-	u32 value;
+	u32 clear_mask = 0;
+	u32 ctrl2, ctrl3;
+	int i;
 
-	base_register = (queue < 4) ? GMAC_RXQ_CTRL2 : GMAC_RXQ_CTRL3;
+	ctrl2 = readl(ioaddr + GMAC_RXQ_CTRL2);
+	ctrl3 = readl(ioaddr + GMAC_RXQ_CTRL3);
 
-	value = readl(ioaddr + base_register);
+	/* The software must ensure that the same priority
+	 * is not mapped to multiple Rx queues
+	 */
+	for (i = 0; i < 4; i++)
+		clear_mask |= ((prio << GMAC_RXQCTRL_PSRQX_SHIFT(i)) &
+						GMAC_RXQCTRL_PSRQX_MASK(i));
 
-	value &= ~GMAC_RXQCTRL_PSRQX_MASK(queue);
-	value |= (prio << GMAC_RXQCTRL_PSRQX_SHIFT(queue)) &
+	ctrl2 &= ~clear_mask;
+	ctrl3 &= ~clear_mask;
+
+	/* First assign new priorities to a queue, then
+	 * clear them from others queues
+	 */
+	if (queue < 4) {
+		ctrl2 |= (prio << GMAC_RXQCTRL_PSRQX_SHIFT(queue)) &
 						GMAC_RXQCTRL_PSRQX_MASK(queue);
-	writel(value, ioaddr + base_register);
+
+		writel(ctrl2, ioaddr + GMAC_RXQ_CTRL2);
+		writel(ctrl3, ioaddr + GMAC_RXQ_CTRL3);
+	} else {
+		queue -= 4;
+
+		ctrl3 |= (prio << GMAC_RXQCTRL_PSRQX_SHIFT(queue)) &
+						GMAC_RXQCTRL_PSRQX_MASK(queue);
+
+		writel(ctrl3, ioaddr + GMAC_RXQ_CTRL3);
+		writel(ctrl2, ioaddr + GMAC_RXQ_CTRL2);
+	}
 }
 
 static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
@@ -104,6 +128,8 @@
 	u32 value;
 
 	base_register = (queue < 4) ? GMAC_TXQ_PRTY_MAP0 : GMAC_TXQ_PRTY_MAP1;
+	if (queue >= 4)
+		queue -= 4;
 
 	value = readl(ioaddr + base_register);
 
diff --git a/drivers/net/wireless/ath/ath9k/antenna.c b/drivers/net/wireless/ath/ath9k/antenna.c
index a366843..deac618 100644
--- a/drivers/net/wireless/ath/ath9k/antenna.c
+++ b/drivers/net/wireless/ath/ath9k/antenna.c
@@ -643,7 +643,7 @@
 				conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
 				conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
 			} else if (antcomb->rssi_sub >
-				   antcomb->rssi_lna1) {
+				   antcomb->rssi_lna2) {
 				/* set to A-B */
 				conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
 				conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 119fcb2..dde8c31 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -731,8 +731,7 @@
 	scan_request = cfg->scan_request;
 	cfg->scan_request = NULL;
 
-	if (timer_pending(&cfg->escan_timeout))
-		del_timer_sync(&cfg->escan_timeout);
+	del_timer_sync(&cfg->escan_timeout);
 
 	if (fw_abort) {
 		/* Do a scan abort to stop the driver's scan engine */
@@ -7184,5 +7183,6 @@
 	wiphy_unregister(cfg->wiphy);
 	kfree(cfg->ops);
 	wl_deinit_priv(cfg);
+	cancel_work_sync(&cfg->escan_timeout_work);
 	brcmf_free_wiphy(cfg->wiphy);
 }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index c764c2d..77f87da 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -440,15 +440,20 @@
 	struct pci_dev *pci_dev = to_pci_dev(dev);
 	struct pci_driver *drv = pci_dev->driver;
 
-	if (drv) {
-		if (drv->remove) {
-			pm_runtime_get_sync(dev);
-			drv->remove(pci_dev);
-			pm_runtime_put_noidle(dev);
-		}
-		pcibios_free_irq(pci_dev);
-		pci_dev->driver = NULL;
+	if (drv->remove) {
+		pm_runtime_get_sync(dev);
+		/*
+		 * If the driver provides a .runtime_idle() callback and it has
+		 * started to run already, it may continue to run in parallel
+		 * with the code below, so wait until all of the runtime PM
+		 * activity has completed.
+		 */
+		pm_runtime_barrier(dev);
+		drv->remove(pci_dev);
+		pm_runtime_put_noidle(dev);
 	}
+	pcibios_free_irq(pci_dev);
+	pci_dev->driver = NULL;
 
 	/* Undo the runtime PM settings in local_pci_probe() */
 	pm_runtime_put_sync(dev);
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 3743828..bcd9d6c 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -173,6 +173,7 @@
 {
 	if (!zq || !try_module_get(zq->queue->ap_dev.drv->driver.owner))
 		return NULL;
+	zcrypt_card_get(zc);
 	zcrypt_queue_get(zq);
 	get_device(&zq->queue->ap_dev.device);
 	atomic_add(weight, &zc->load);
@@ -192,6 +193,7 @@
 	atomic_sub(weight, &zq->load);
 	put_device(&zq->queue->ap_dev.device);
 	zcrypt_queue_put(zq);
+	zcrypt_card_put(zc);
 	module_put(mod);
 }
 
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 70733d7..d402000 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -601,8 +601,10 @@
 				/* Save the ELS cmd */
 				elsiocb->drvrTimeout = cmd;
 
-				lpfc_sli4_resume_rpi(ndlp,
-					lpfc_mbx_cmpl_resume_rpi, elsiocb);
+				if (lpfc_sli4_resume_rpi(ndlp,
+						lpfc_mbx_cmpl_resume_rpi,
+						elsiocb))
+					kfree(elsiocb);
 				goto out;
 			}
 		}
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index fa0d0d1..cd4e3cf 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1039,7 +1039,7 @@
 		nvmewqe = ctx_buf->iocbq;
 		wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
 		/* Initialize WQE */
-		memset(wqe, 0, sizeof(union lpfc_wqe));
+		memset(wqe, 0, sizeof(*wqe));
 		/* Word 7 */
 		bf_set(wqe_ct, &wqe->generic.wqe_com, SLI4_CT_RPI);
 		bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3);
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 4b431ca..2795ab0 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1015,6 +1015,16 @@
 		    "%s: sess %p logout completed\n",__func__, sess);
 	}
 
+	/* check for any straggling io left behind */
+	if (!(sess->flags & FCF_FCP2_DEVICE) &&
+	    qla2x00_eh_wait_for_pending_commands(sess->vha, sess->d_id.b24, 0, WAIT_TARGET)) {
+		ql_log(ql_log_warn, vha, 0x3027,
+		    "IO not return. Resetting.\n");
+		set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+		qla2xxx_wake_dpc(vha);
+		qla2x00_wait_for_chip_reset(vha);
+	}
+
 	if (sess->logo_ack_needed) {
 		sess->logo_ack_needed = 0;
 		qla24xx_async_notify_ack(vha, sess,
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index 06b6d7a..7783ed0 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -944,7 +944,7 @@
 	/* linked-list of CSCN handlers. */
 	struct list_head cgr_cbs;
 	/* list lock */
-	spinlock_t cgr_lock;
+	raw_spinlock_t cgr_lock;
 	struct work_struct congestion_work;
 	struct work_struct mr_work;
 	char irqname[MAX_IRQNAME];
@@ -1164,7 +1164,7 @@
 		/* if the given mask is NULL, assume all CGRs can be seen */
 		qman_cgrs_fill(&portal->cgrs[0]);
 	INIT_LIST_HEAD(&portal->cgr_cbs);
-	spin_lock_init(&portal->cgr_lock);
+	raw_spin_lock_init(&portal->cgr_lock);
 	INIT_WORK(&portal->congestion_work, qm_congestion_task);
 	INIT_WORK(&portal->mr_work, qm_mr_process_task);
 	portal->bits = 0;
@@ -1339,11 +1339,14 @@
 	union qm_mc_result *mcr;
 	struct qman_cgr *cgr;
 
-	spin_lock(&p->cgr_lock);
+	/*
+	 * FIXME: QM_MCR_TIMEOUT is 10ms, which is too long for a raw spinlock!
+	 */
+	raw_spin_lock_irq(&p->cgr_lock);
 	qm_mc_start(&p->p);
 	qm_mc_commit(&p->p, QM_MCC_VERB_QUERYCONGESTION);
 	if (!qm_mc_result_timeout(&p->p, &mcr)) {
-		spin_unlock(&p->cgr_lock);
+		raw_spin_unlock_irq(&p->cgr_lock);
 		dev_crit(p->config->dev, "QUERYCONGESTION timeout\n");
 		qman_p_irqsource_add(p, QM_PIRQ_CSCI);
 		return;
@@ -1359,7 +1362,7 @@
 	list_for_each_entry(cgr, &p->cgr_cbs, node)
 		if (cgr->cb && qman_cgrs_get(&c, cgr->cgrid))
 			cgr->cb(p, cgr, qman_cgrs_get(&rr, cgr->cgrid));
-	spin_unlock(&p->cgr_lock);
+	raw_spin_unlock_irq(&p->cgr_lock);
 	qman_p_irqsource_add(p, QM_PIRQ_CSCI);
 }
 
@@ -2316,7 +2319,7 @@
 	preempt_enable();
 
 	cgr->chan = p->config->channel;
-	spin_lock(&p->cgr_lock);
+	raw_spin_lock_irq(&p->cgr_lock);
 
 	if (opts) {
 		struct qm_mcc_initcgr local_opts = *opts;
@@ -2353,12 +2356,28 @@
 	    qman_cgrs_get(&p->cgrs[1], cgr->cgrid))
 		cgr->cb(p, cgr, 1);
 out:
-	spin_unlock(&p->cgr_lock);
+	raw_spin_unlock_irq(&p->cgr_lock);
 	put_affine_portal();
 	return ret;
 }
 EXPORT_SYMBOL(qman_create_cgr);
 
+static struct qman_portal *qman_cgr_get_affine_portal(struct qman_cgr *cgr)
+{
+	struct qman_portal *p = get_affine_portal();
+
+	if (cgr->chan != p->config->channel) {
+		/* attempt to delete from other portal than creator */
+		dev_err(p->config->dev, "CGR not owned by current portal");
+		dev_dbg(p->config->dev, " create 0x%x, delete 0x%x\n",
+			cgr->chan, p->config->channel);
+		put_affine_portal();
+		return NULL;
+	}
+
+	return p;
+}
+
 int qman_delete_cgr(struct qman_cgr *cgr)
 {
 	unsigned long irqflags;
@@ -2366,19 +2385,13 @@
 	struct qm_mcc_initcgr local_opts;
 	int ret = 0;
 	struct qman_cgr *i;
-	struct qman_portal *p = get_affine_portal();
+	struct qman_portal *p = qman_cgr_get_affine_portal(cgr);
 
-	if (cgr->chan != p->config->channel) {
-		/* attempt to delete from other portal than creator */
-		dev_err(p->config->dev, "CGR not owned by current portal");
-		dev_dbg(p->config->dev, " create 0x%x, delete 0x%x\n",
-			cgr->chan, p->config->channel);
+	if (!p)
+		return -EINVAL;
 
-		ret = -EINVAL;
-		goto put_portal;
-	}
 	memset(&local_opts, 0, sizeof(struct qm_mcc_initcgr));
-	spin_lock_irqsave(&p->cgr_lock, irqflags);
+	raw_spin_lock_irqsave(&p->cgr_lock, irqflags);
 	list_del(&cgr->node);
 	/*
 	 * If there are no other CGR objects for this CGRID in the list,
@@ -2403,8 +2416,7 @@
 		/* add back to the list */
 		list_add(&cgr->node, &p->cgr_cbs);
 release_lock:
-	spin_unlock_irqrestore(&p->cgr_lock, irqflags);
-put_portal:
+	raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags);
 	put_affine_portal();
 	return ret;
 }
@@ -2435,6 +2447,54 @@
 }
 EXPORT_SYMBOL(qman_delete_cgr_safe);
 
+static int qman_update_cgr(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts)
+{
+	int ret;
+	unsigned long irqflags;
+	struct qman_portal *p = qman_cgr_get_affine_portal(cgr);
+
+	if (!p)
+		return -EINVAL;
+
+	raw_spin_lock_irqsave(&p->cgr_lock, irqflags);
+	ret = qm_modify_cgr(cgr, 0, opts);
+	raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags);
+	put_affine_portal();
+	return ret;
+}
+
+struct update_cgr_params {
+	struct qman_cgr *cgr;
+	struct qm_mcc_initcgr *opts;
+	int ret;
+};
+
+static void qman_update_cgr_smp_call(void *p)
+{
+	struct update_cgr_params *params = p;
+
+	params->ret = qman_update_cgr(params->cgr, params->opts);
+}
+
+int qman_update_cgr_safe(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts)
+{
+	struct update_cgr_params params = {
+		.cgr = cgr,
+		.opts = opts,
+	};
+
+	preempt_disable();
+	if (qman_cgr_cpus[cgr->cgrid] != smp_processor_id())
+		smp_call_function_single(qman_cgr_cpus[cgr->cgrid],
+					 qman_update_cgr_smp_call, &params,
+					 true);
+	else
+		params.ret = qman_update_cgr(cgr, opts);
+	preempt_enable();
+	return params.ret;
+}
+EXPORT_SYMBOL(qman_update_cgr_safe);
+
 /* Cleanup FQs */
 
 static int _qm_mr_consume_and_match_verb(struct qm_portal *p, int v)
diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
index ccfd642..5ea9a8a 100644
--- a/drivers/staging/comedi/drivers/comedi_test.c
+++ b/drivers/staging/comedi/drivers/comedi_test.c
@@ -95,6 +95,8 @@
 	struct timer_list ao_timer;	/* timer for AO commands */
 	u64 ao_last_scan_time;		/* time of previous AO scan in usec */
 	unsigned int ao_scan_period;	/* AO scan period in usec */
+	bool ai_timer_enable:1;		/* should AI timer be running? */
+	bool ao_timer_enable:1;		/* should AO timer be running? */
 	unsigned short ao_loopbacks[N_CHANS];
 };
 
@@ -244,8 +246,12 @@
 			time_increment = devpriv->ai_convert_time - now;
 		else
 			time_increment = 1;
-		mod_timer(&devpriv->ai_timer,
-			  jiffies + usecs_to_jiffies(time_increment));
+		spin_lock(&dev->spinlock);
+		if (devpriv->ai_timer_enable) {
+			mod_timer(&devpriv->ai_timer,
+				  jiffies + usecs_to_jiffies(time_increment));
+		}
+		spin_unlock(&dev->spinlock);
 	}
 
 overrun:
@@ -401,9 +407,12 @@
 	 * Seem to need an extra jiffy here, otherwise timer expires slightly
 	 * early!
 	 */
+	spin_lock_bh(&dev->spinlock);
+	devpriv->ai_timer_enable = true;
 	devpriv->ai_timer.expires =
 		jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1;
 	add_timer(&devpriv->ai_timer);
+	spin_unlock_bh(&dev->spinlock);
 	return 0;
 }
 
@@ -412,6 +421,9 @@
 {
 	struct waveform_private *devpriv = dev->private;
 
+	spin_lock_bh(&dev->spinlock);
+	devpriv->ai_timer_enable = false;
+	spin_unlock_bh(&dev->spinlock);
 	if (in_softirq()) {
 		/* Assume we were called from the timer routine itself. */
 		del_timer(&devpriv->ai_timer);
@@ -503,8 +515,12 @@
 		unsigned int time_inc = devpriv->ao_last_scan_time +
 					devpriv->ao_scan_period - now;
 
-		mod_timer(&devpriv->ao_timer,
-			  jiffies + usecs_to_jiffies(time_inc));
+		spin_lock(&dev->spinlock);
+		if (devpriv->ao_timer_enable) {
+			mod_timer(&devpriv->ao_timer,
+				  jiffies + usecs_to_jiffies(time_inc));
+		}
+		spin_unlock(&dev->spinlock);
 	}
 
 underrun:
@@ -525,9 +541,12 @@
 	async->inttrig = NULL;
 
 	devpriv->ao_last_scan_time = ktime_to_us(ktime_get());
+	spin_lock_bh(&dev->spinlock);
+	devpriv->ao_timer_enable = true;
 	devpriv->ao_timer.expires =
 		jiffies + usecs_to_jiffies(devpriv->ao_scan_period);
 	add_timer(&devpriv->ao_timer);
+	spin_unlock_bh(&dev->spinlock);
 
 	return 1;
 }
@@ -612,6 +631,9 @@
 	struct waveform_private *devpriv = dev->private;
 
 	s->async->inttrig = NULL;
+	spin_lock_bh(&dev->spinlock);
+	devpriv->ao_timer_enable = false;
+	spin_unlock_bh(&dev->spinlock);
 	if (in_softirq()) {
 		/* Assume we were called from the timer routine itself. */
 		del_timer(&devpriv->ao_timer);
diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c
index a1ca68c..4baab65 100644
--- a/drivers/staging/speakup/synth.c
+++ b/drivers/staging/speakup/synth.c
@@ -191,8 +191,10 @@
 	wake_up_process(speakup_task);
 }
 
-void synth_write(const char *buf, size_t count)
+void synth_write(const char *_buf, size_t count)
 {
+	const unsigned char *buf = (const unsigned char *) _buf;
+
 	while (count--)
 		synth_buffer_add(*buf++);
 	synth_start();
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index b3176f4..72177b4 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -35,8 +35,11 @@
 #define USE_VCHIQ_ARM
 #include "interface/vchi/vchi.h"
 
-/* maximum number of components supported */
-#define VCHIQ_MMAL_MAX_COMPONENTS 4
+/*
+ * maximum number of components supported.
+ * This matches the maximum permitted by default on the VPU
+ */
+#define VCHIQ_MMAL_MAX_COMPONENTS 64
 
 /*#define FULL_MSG_DUMP 1*/
 
@@ -174,8 +177,6 @@
 	/* mapping table between context handles and mmal_msg_contexts */
 	struct vchiq_mmal_context_map context_map;
 
-	/* component to use next */
-	int component_idx;
 	struct vchiq_mmal_component component[VCHIQ_MMAL_MAX_COMPONENTS];
 };
 
@@ -1043,9 +1044,9 @@
 		goto release_msg;
 
 	if (rmsg->u.port_info_get_reply.port.is_enabled == 0)
-		port->enabled = false;
+		port->enabled = 0;
 	else
-		port->enabled = true;
+		port->enabled = 1;
 
 	/* copy the values out of the message */
 	port->handle = rmsg->u.port_info_get_reply.port_handle;
@@ -1117,9 +1118,10 @@
 
 	/* build component create message */
 	m.h.type = MMAL_MSG_TYPE_COMPONENT_CREATE;
-	m.u.component_create.client_component = (u32)(unsigned long)component;
-	strncpy(m.u.component_create.name, name,
-		sizeof(m.u.component_create.name));
+	m.u.component_create.client_component = component->client_component;
+	strscpy_pad(m.u.component_create.name, name,
+		    sizeof(m.u.component_create.name));
+	m.u.component_create.pid = 0;
 
 	ret = send_synchronous_mmal_msg(instance, &m,
 					sizeof(m.u.component_create),
@@ -1482,7 +1484,7 @@
 	if (!port->enabled)
 		return 0;
 
-	port->enabled = false;
+	port->enabled = 0;
 
 	ret = port_action_port(instance, port,
 			       MMAL_MSG_PORT_ACTION_TYPE_DISABLE);
@@ -1537,7 +1539,7 @@
 	if (ret)
 		goto done;
 
-	port->enabled = true;
+	port->enabled = 1;
 
 	if (port->buffer_cb) {
 		/* send buffer headers to videocore */
@@ -1703,7 +1705,7 @@
 			pr_err("failed disconnecting src port\n");
 			goto release_unlock;
 		}
-		src->connected->enabled = false;
+		src->connected->enabled = 0;
 		src->connected = NULL;
 	}
 
@@ -1789,17 +1791,29 @@
 {
 	int ret;
 	int idx;		/* port index */
-	struct vchiq_mmal_component *component;
+	struct vchiq_mmal_component *component = NULL;
 
 	if (mutex_lock_interruptible(&instance->vchiq_mutex))
 		return -EINTR;
 
-	if (instance->component_idx == VCHIQ_MMAL_MAX_COMPONENTS) {
+	for (idx = 0; idx < VCHIQ_MMAL_MAX_COMPONENTS; idx++) {
+		if (!instance->component[idx].in_use) {
+			component = &instance->component[idx];
+			component->in_use = 1;
+			break;
+		}
+	}
+
+	if (!component) {
 		ret = -EINVAL;	/* todo is this correct error? */
 		goto unlock;
 	}
 
-	component = &instance->component[instance->component_idx];
+	/* We need a handle to reference back to our component structure.
+	 * Use the array index in instance->component rather than rolling
+	 * another IDR.
+	 */
+	component->client_component = idx;
 
 	ret = create_component(instance, component, name);
 	if (ret < 0)
@@ -1848,8 +1862,6 @@
 			goto release_component;
 	}
 
-	instance->component_idx++;
-
 	*component_out = component;
 
 	mutex_unlock(&instance->vchiq_mutex);
@@ -1859,6 +1871,8 @@
 release_component:
 	destroy_component(instance, component);
 unlock:
+	if (component)
+		component->in_use = 0;
 	mutex_unlock(&instance->vchiq_mutex);
 
 	return ret;
@@ -1880,6 +1894,8 @@
 
 	ret = destroy_component(instance, component);
 
+	component->in_use = 0;
+
 	mutex_unlock(&instance->vchiq_mutex);
 
 	return ret;
@@ -1928,7 +1944,7 @@
 
 	ret = disable_component(instance, component);
 	if (ret == 0)
-		component->enabled = false;
+		component->enabled = 0;
 
 	mutex_unlock(&instance->vchiq_mutex);
 
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
index 63db053..083f6d4 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
@@ -58,7 +58,7 @@
 		unsigned long length, u32 mmal_flags, s64 dts, s64 pts);
 
 struct vchiq_mmal_port {
-	bool enabled;
+	u32 enabled:1;
 	u32 handle;
 	u32 type; /* port type, cached to use on port info set */
 	u32 index; /* port index, cached to use on port info set */
@@ -93,7 +93,8 @@
 };
 
 struct vchiq_mmal_component {
-	bool enabled;
+	u32 in_use:1;
+	u32 enabled:1;
 	u32 handle;  /* VideoCore handle for component */
 	u32 inputs;  /* Number of input ports */
 	u32 outputs; /* Number of output ports */
@@ -102,6 +103,7 @@
 	struct vchiq_mmal_port input[MAX_PORT_COUNT]; /* input ports */
 	struct vchiq_mmal_port output[MAX_PORT_COUNT]; /* output ports */
 	struct vchiq_mmal_port clock[MAX_PORT_COUNT]; /* clock ports */
+	u32 client_component;	/* Used to ref back to client struct */
 };
 
 int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance);
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 97f6860..a60d4b5 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2449,6 +2449,9 @@
 	struct gsm_mux *gsm;
 	int ret;
 
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
 	if (tty->ops->write == NULL)
 		return -EINVAL;
 
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index a24a1ef..be3a013 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1759,9 +1759,12 @@
 		       UARTCTRL);
 
 	lpuart32_serial_setbrg(sport, baud);
-	lpuart32_write(&sport->port, modem, UARTMODIR);
-	lpuart32_write(&sport->port, ctrl, UARTCTRL);
+	/* disable CTS before enabling UARTCTRL_TE to avoid pending idle preamble */
+	lpuart32_write(&sport->port, modem & ~UARTMODIR_TXCTSE, UARTMODIR);
 	/* restore control register */
+	lpuart32_write(&sport->port, ctrl, UARTCTRL);
+	/* re-enable the CTS if needed */
+	lpuart32_write(&sport->port, modem, UARTMODIR);
 
 	spin_unlock_irqrestore(&sport->port.lock, flags);
 }
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 2b84ec2..aab98a4 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -543,7 +543,7 @@
 {
 	unsigned short *p = (unsigned short *) vc->vc_pos;
 
-	scr_memcpyw(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2);
+	scr_memmovew(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2);
 	scr_memsetw(p + vc->vc_cols - vc->vc_x - nr, vc->vc_video_erase_char,
 			nr * 2);
 	vc->vc_need_wrap = 0;
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index d807186..6900f76 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -457,18 +457,32 @@
 static int service_outstanding_interrupt(struct wdm_device *desc)
 {
 	int rv = 0;
+	int used;
 
 	/* submit read urb only if the device is waiting for it */
 	if (!desc->resp_count || !--desc->resp_count)
 		goto out;
 
-	set_bit(WDM_RESPONDING, &desc->flags);
+	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+		rv = -ENODEV;
+		goto out;
+	}
+	if (test_bit(WDM_RESETTING, &desc->flags)) {
+		rv = -EIO;
+		goto out;
+	}
+
+	used = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+	if (used)
+		goto out;
+
 	spin_unlock_irq(&desc->iuspin);
 	rv = usb_submit_urb(desc->response, GFP_KERNEL);
 	spin_lock_irq(&desc->iuspin);
 	if (rv) {
-		dev_err(&desc->intf->dev,
-			"usb_submit_urb failed with result %d\n", rv);
+		if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+			dev_err(&desc->intf->dev,
+				"usb_submit_urb failed with result %d\n", rv);
 
 		/* make sure the next notification trigger a submit */
 		clear_bit(WDM_RESPONDING, &desc->flags);
@@ -1008,8 +1022,8 @@
 	wake_up_all(&desc->wait);
 	mutex_lock(&desc->rlock);
 	mutex_lock(&desc->wlock);
-	kill_urbs(desc);
 	cancel_work_sync(&desc->rxwork);
+	kill_urbs(desc);
 	mutex_unlock(&desc->wlock);
 	mutex_unlock(&desc->rlock);
 
diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
index 53c1f6e..2fc10939 100644
--- a/drivers/usb/core/port.c
+++ b/drivers/usb/core/port.c
@@ -407,7 +407,7 @@
 	struct usb_hub *peer_hub = usb_hub_to_struct_hub(peer_hdev);
 	struct usb_device *hdev = to_usb_device(port_dev->dev.parent->parent);
 
-	if (!peer_hub)
+	if (!peer_hub || port_dev->connect_type == USB_PORT_NOT_USED)
 		return 0;
 
 	hcd = bus_to_hcd(hdev->bus);
@@ -418,7 +418,8 @@
 
 	for (port1 = 1; port1 <= peer_hdev->maxchild; port1++) {
 		peer = peer_hub->ports[port1 - 1];
-		if (peer && peer->location == port_dev->location) {
+		if (peer && peer->connect_type != USB_PORT_NOT_USED &&
+		    peer->location == port_dev->location) {
 			link_peers_report(port_dev, peer);
 			return 1; /* done */
 		}
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index 15c1986..d3eac2d 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -1046,14 +1046,24 @@
 {
 	struct usb_interface *intf = to_usb_interface(dev);
 	bool val;
+	struct kernfs_node *kn;
 
 	if (strtobool(buf, &val) != 0)
 		return -EINVAL;
 
-	if (val)
+	if (val) {
 		usb_authorize_interface(intf);
-	else
-		usb_deauthorize_interface(intf);
+	} else {
+		/*
+		 * Prevent deadlock if another process is concurrently
+		 * trying to unregister intf.
+		 */
+		kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
+		if (kn) {
+			usb_deauthorize_interface(intf);
+			sysfs_unbreak_active_protection(kn);
+		}
+	}
 
 	return count;
 }
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 09fd97a..2f1fb3a 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -659,15 +659,27 @@
  * struct dwc2_hregs_backup - Holds host registers state before
  * entering partial power down
  * @hcfg:		Backup of HCFG register
+ * @hflbaddr:		Backup of HFLBADDR register
  * @haintmsk:		Backup of HAINTMSK register
+ * @hcchar:		Backup of HCCHAR register
+ * @hcsplt:		Backup of HCSPLT register
  * @hcintmsk:		Backup of HCINTMSK register
- * @hptr0:		Backup of HPTR0 register
+ * @hctsiz:		Backup of HCTSIZ register
+ * @hdma:		Backup of HCDMA register
+ * @hcdmab:		Backup of HCDMAB register
+ * @hprt0:		Backup of HPTR0 register
  * @hfir:		Backup of HFIR register
  */
 struct dwc2_hregs_backup {
 	u32 hcfg;
+	u32 hflbaddr;
 	u32 haintmsk;
+	u32 hcchar[MAX_EPS_CHANNELS];
+	u32 hcsplt[MAX_EPS_CHANNELS];
 	u32 hcintmsk[MAX_EPS_CHANNELS];
+	u32 hctsiz[MAX_EPS_CHANNELS];
+	u32 hcidma[MAX_EPS_CHANNELS];
+	u32 hcidmab[MAX_EPS_CHANNELS];
 	u32 hprt0;
 	u32 hfir;
 	bool valid;
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 6d20603..f3ca2d1 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -2903,8 +2903,11 @@
 			hsotg->available_host_channels--;
 		}
 		qh = list_entry(qh_ptr, struct dwc2_qh, qh_list_entry);
-		if (dwc2_assign_and_init_hc(hsotg, qh))
+		if (dwc2_assign_and_init_hc(hsotg, qh)) {
+			if (hsotg->params.uframe_sched)
+				hsotg->available_host_channels++;
 			break;
+		}
 
 		/*
 		 * Move the QH from the periodic ready schedule to the
@@ -2937,8 +2940,11 @@
 			hsotg->available_host_channels--;
 		}
 
-		if (dwc2_assign_and_init_hc(hsotg, qh))
+		if (dwc2_assign_and_init_hc(hsotg, qh)) {
+			if (hsotg->params.uframe_sched)
+				hsotg->available_host_channels++;
 			break;
+		}
 
 		/*
 		 * Move the QH from the non-periodic inactive schedule to the
@@ -4342,6 +4348,8 @@
 			 urb->actual_length);
 
 	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		if (!hsotg->params.dma_desc_enable)
+			urb->start_frame = qtd->qh->start_active_frame;
 		urb->error_count = dwc2_hcd_urb_get_error_count(qtd->urb);
 		for (i = 0; i < urb->number_of_packets; ++i) {
 			urb->iso_frame_desc[i].actual_length =
@@ -5475,9 +5483,16 @@
 	/* Backup Host regs */
 	hr = &hsotg->hr_backup;
 	hr->hcfg = dwc2_readl(hsotg->regs + HCFG);
+	hr->hflbaddr = dwc2_readl(hsotg->regs + HFLBADDR);
 	hr->haintmsk = dwc2_readl(hsotg->regs + HAINTMSK);
-	for (i = 0; i < hsotg->params.host_channels; ++i)
+	for (i = 0; i < hsotg->params.host_channels; ++i) {
+		hr->hcchar[i] = dwc2_readl(hsotg->regs + HCCHAR(i));
+		hr->hcsplt[i] = dwc2_readl(hsotg->regs + HCSPLT(i));
 		hr->hcintmsk[i] = dwc2_readl(hsotg->regs + HCINTMSK(i));
+		hr->hctsiz[i] = dwc2_readl(hsotg->regs + HCTSIZ(i));
+		hr->hcidma[i] = dwc2_readl(hsotg->regs + HCDMA(i));
+		hr->hcidmab[i] = dwc2_readl(hsotg->regs + HCDMAB(i));
+	}
 
 	hr->hprt0 = dwc2_read_hprt0(hsotg);
 	hr->hfir = dwc2_readl(hsotg->regs + HFIR);
@@ -5510,10 +5525,17 @@
 	hr->valid = false;
 
 	dwc2_writel(hr->hcfg, hsotg->regs + HCFG);
+	dwc2_writel(hr->hflbaddr, hsotg->regs + HFLBADDR);
 	dwc2_writel(hr->haintmsk, hsotg->regs + HAINTMSK);
 
-	for (i = 0; i < hsotg->params.host_channels; ++i)
+	for (i = 0; i < hsotg->params.host_channels; ++i) {
+		dwc2_writel(hr->hcchar[i], hsotg->regs + HCCHAR(i));
+		dwc2_writel(hr->hcsplt[i], hsotg->regs + HCSPLT(i));
 		dwc2_writel(hr->hcintmsk[i], hsotg->regs + HCINTMSK(i));
+		dwc2_writel(hr->hctsiz[i], hsotg->regs + HCTSIZ(i));
+		dwc2_writel(hr->hcidma[i], hsotg->regs + HCDMA(i));
+		dwc2_writel(hr->hcidmab[i], hsotg->regs + HCDMAB(i));
+	}
 
 	dwc2_writel(hr->hprt0, hsotg->regs + HPRT0);
 	dwc2_writel(hr->hfir, hsotg->regs + HFIR);
diff --git a/drivers/usb/dwc2/hcd_ddma.c b/drivers/usb/dwc2/hcd_ddma.c
index b8bdf54..4a4b6a5 100644
--- a/drivers/usb/dwc2/hcd_ddma.c
+++ b/drivers/usb/dwc2/hcd_ddma.c
@@ -587,7 +587,7 @@
 	idx = qh->td_last;
 	inc = qh->host_interval;
 	hsotg->frame_number = dwc2_hcd_get_frame_number(hsotg);
-	cur_idx = dwc2_frame_list_idx(hsotg->frame_number);
+	cur_idx = idx;
 	next_idx = dwc2_desclist_idx_inc(qh->td_last, inc, qh->dev_speed);
 
 	/*
@@ -894,6 +894,8 @@
 {
 	struct dwc2_dma_desc *dma_desc;
 	struct dwc2_hcd_iso_packet_desc *frame_desc;
+	u16 frame_desc_idx;
+	struct urb *usb_urb = qtd->urb->priv;
 	u16 remain = 0;
 	int rc = 0;
 
@@ -906,8 +908,11 @@
 				DMA_FROM_DEVICE);
 
 	dma_desc = &qh->desc_list[idx];
+	frame_desc_idx = (idx - qtd->isoc_td_first) & (usb_urb->number_of_packets - 1);
 
-	frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index_last];
+	frame_desc = &qtd->urb->iso_descs[frame_desc_idx];
+	if (idx == qtd->isoc_td_first)
+		usb_urb->start_frame = dwc2_hcd_get_frame_number(hsotg);
 	dma_desc->buf = (u32)(qtd->urb->dma + frame_desc->offset);
 	if (chan->ep_is_in)
 		remain = (dma_desc->status & HOST_DMA_ISOC_NBYTES_MASK) >>
@@ -928,7 +933,7 @@
 		frame_desc->status = 0;
 	}
 
-	if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
+	if (++qtd->isoc_frame_index == usb_urb->number_of_packets) {
 		/*
 		 * urb->status is not used for isoc transfers here. The
 		 * individual frame_desc status are used instead.
@@ -1033,11 +1038,11 @@
 				return;
 			idx = dwc2_desclist_idx_inc(idx, qh->host_interval,
 						    chan->speed);
-			if (!rc)
+			if (rc == 0)
 				continue;
 
-			if (rc == DWC2_CMPL_DONE)
-				break;
+			if (rc == DWC2_CMPL_DONE || rc == DWC2_CMPL_STOP)
+				goto stop_scan;
 
 			/* rc == DWC2_CMPL_STOP */
 
diff --git a/drivers/usb/dwc2/hw.h b/drivers/usb/dwc2/hw.h
index 4592012..ae3ea49 100644
--- a/drivers/usb/dwc2/hw.h
+++ b/drivers/usb/dwc2/hw.h
@@ -690,7 +690,7 @@
 #define TXSTS_QTOP_TOKEN_MASK		(0x3 << 25)
 #define TXSTS_QTOP_TOKEN_SHIFT		25
 #define TXSTS_QTOP_TERMINATE		BIT(24)
-#define TXSTS_QSPCAVAIL_MASK		(0xff << 16)
+#define TXSTS_QSPCAVAIL_MASK		(0x7f << 16)
 #define TXSTS_QSPCAVAIL_SHIFT		16
 #define TXSTS_FSPCAVAIL_MASK		(0xffff << 0)
 #define TXSTS_FSPCAVAIL_SHIFT		0
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index e9ccb7c..316a58f 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1346,7 +1346,7 @@
 	if (to_process == 1 &&
 	    (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) {
 		to_process--;
-	} else if (to_process > 0) {
+	} else if ((to_process > 0) && (block_len != 0)) {
 		ntb_ptr = (unsigned char *)(ntb_ptr + block_len);
 		goto parse_ntb;
 	}
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index aa8b089..3f68e85 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -272,7 +272,9 @@
 {
 	int ret = 0;
 
-	if (WARN_ON_ONCE(!ep->enabled && ep->address)) {
+	if (!ep->enabled && ep->address) {
+		pr_debug("USB gadget: queue request to disabled ep 0x%x (%s)\n",
+				 ep->address, ep->name);
 		ret = -ESHUTDOWN;
 		goto out;
 	}
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index df8ae89..5f898d6 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -584,6 +584,7 @@
 		finish_request(sl811, ep, urb, urbstat);
 }
 
+#ifdef QUIRK2
 static inline u8 checkdone(struct sl811 *sl811)
 {
 	u8	ctl;
@@ -615,6 +616,7 @@
 #endif
 	return irqstat;
 }
+#endif
 
 static irqreturn_t sl811h_irq(struct usb_hcd *hcd)
 {
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 4158432..15bfeb0 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -60,6 +60,8 @@
 	{ USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
 	{ USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
 	{ USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
+	{ USB_DEVICE(0x04BF, 0x1301) }, /* TDK Corporation NC0110013M - Network Controller */
+	{ USB_DEVICE(0x04BF, 0x1303) }, /* TDK Corporation MM0110113M - i3 Micro Module */
 	{ USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */
 	{ USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
 	{ USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
@@ -148,6 +150,7 @@
 	{ USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
 	{ USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */
 	{ USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+	{ USB_DEVICE(0x10C4, 0x863C) }, /* MGP Instruments PDS100 */
 	{ USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
 	{ USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
 	{ USB_DEVICE(0x10C4, 0x87ED) }, /* IMST USB-Stick for Smart Meter */
@@ -181,6 +184,7 @@
 	{ USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */
 	{ USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */
 	{ USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */
+	{ USB_DEVICE(0x11CA, 0x0212) }, /* Verifone USB to Printer (UART, CP2102) */
 	{ USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */
 	{ USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */
 	{ USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 59271e4..8bdf8fc 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1050,6 +1050,8 @@
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	/* GMC devices */
+	{ USB_DEVICE(GMC_VID, GMC_Z216C_PID) },
 	{ }					/* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 9a0f9fc..b2aec11 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1599,3 +1599,9 @@
 #define UBLOX_VID			0x1546
 #define UBLOX_C099F9P_ZED_PID		0x0502
 #define UBLOX_C099F9P_ODIN_PID		0x0503
+
+/*
+ * GMC devices
+ */
+#define GMC_VID				0x1cd7
+#define GMC_Z216C_PID			0x0217 /* GMC Z216C Adapter IR-USB */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 8744d91..b5c38ab 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -616,6 +616,11 @@
 /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */
 #define LUAT_PRODUCT_AIR720U			0x4e00
 
+/* MeiG Smart Technology products */
+#define MEIGSMART_VENDOR_ID			0x2dee
+/* MeiG Smart SLM320 based on UNISOC UIS8910 */
+#define MEIGSMART_PRODUCT_SLM320		0x4d41
+
 /* Device flags */
 
 /* Highest interface number which can be used with NCTRL() and RSVD() */
@@ -2284,6 +2289,7 @@
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) },
 	{ } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/storage/isd200.c b/drivers/usb/storage/isd200.c
index 6a7720e..671104b 100644
--- a/drivers/usb/storage/isd200.c
+++ b/drivers/usb/storage/isd200.c
@@ -1117,7 +1117,7 @@
 static int isd200_get_inquiry_data( struct us_data *us )
 {
 	struct isd200_info *info = (struct isd200_info *)us->extra;
-	int retStatus = ISD200_GOOD;
+	int retStatus;
 	u16 *id = info->id;
 
 	usb_stor_dbg(us, "Entering isd200_get_inquiry_data\n");
@@ -1149,6 +1149,13 @@
 				isd200_fix_driveid(id);
 				isd200_dump_driveid(us, id);
 
+				/* Prevent division by 0 in isd200_scsi_to_ata() */
+				if (id[ATA_ID_HEADS] == 0 || id[ATA_ID_SECTORS] == 0) {
+					usb_stor_dbg(us, "   Invalid ATA Identify data\n");
+					retStatus = ISD200_ERROR;
+					goto Done;
+				}
+
 				memset(&info->InquiryData, 0, sizeof(info->InquiryData));
 
 				/* Standard IDE interface only supports disks */
@@ -1214,6 +1221,7 @@
 		}
 	}
 
+ Done:
 	usb_stor_dbg(us, "Leaving isd200_get_inquiry_data %08X\n", retStatus);
 
 	return(retStatus);
@@ -1493,22 +1501,27 @@
 
 static int isd200_Initialization(struct us_data *us)
 {
+	int rc = 0;
+
 	usb_stor_dbg(us, "ISD200 Initialization...\n");
 
 	/* Initialize ISD200 info struct */
 
-	if (isd200_init_info(us) == ISD200_ERROR) {
+	if (isd200_init_info(us) < 0) {
 		usb_stor_dbg(us, "ERROR Initializing ISD200 Info struct\n");
+		rc = -ENOMEM;
 	} else {
 		/* Get device specific data */
 
-		if (isd200_get_inquiry_data(us) != ISD200_GOOD)
+		if (isd200_get_inquiry_data(us) != ISD200_GOOD) {
 			usb_stor_dbg(us, "ISD200 Initialization Failure\n");
-		else
+			rc = -EINVAL;
+		} else {
 			usb_stor_dbg(us, "ISD200 Initialization complete\n");
+		}
 	}
 
-	return 0;
+	return rc;
 }
 
 
diff --git a/drivers/vfio/platform/vfio_platform_irq.c b/drivers/vfio/platform/vfio_platform_irq.c
index 46d4750..c53a9b4 100644
--- a/drivers/vfio/platform/vfio_platform_irq.c
+++ b/drivers/vfio/platform/vfio_platform_irq.c
@@ -329,8 +329,11 @@
 {
 	int i;
 
-	for (i = 0; i < vdev->num_irqs; i++)
+	for (i = 0; i < vdev->num_irqs; i++) {
+		vfio_virqfd_disable(&vdev->irqs[i].mask);
+		vfio_virqfd_disable(&vdev->irqs[i].unmask);
 		vfio_set_trigger(vdev, i, -1, NULL);
+	}
 
 	vdev->num_irqs = 0;
 	kfree(vdev->irqs);
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 3d3ba97..51f484e 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -1453,7 +1453,7 @@
 int fb_videomode_from_videomode(const struct videomode *vm,
 				struct fb_videomode *fbmode)
 {
-	unsigned int htotal, vtotal;
+	unsigned int htotal, vtotal, total;
 
 	fbmode->xres = vm->hactive;
 	fbmode->left_margin = vm->hback_porch;
@@ -1486,8 +1486,9 @@
 	vtotal = vm->vactive + vm->vfront_porch + vm->vback_porch +
 		 vm->vsync_len;
 	/* prevent division by zero */
-	if (htotal && vtotal) {
-		fbmode->refresh = vm->pixelclock / (htotal * vtotal);
+	total = htotal * vtotal;
+	if (total) {
+		fbmode->refresh = vm->pixelclock / total;
 	/* a mode must have htotal and vtotal != 0 or it is invalid */
 	} else {
 		fbmode->refresh = 0;
diff --git a/drivers/video/fbdev/via/accel.c b/drivers/video/fbdev/via/accel.c
index eb3615c..f542b01 100644
--- a/drivers/video/fbdev/via/accel.c
+++ b/drivers/video/fbdev/via/accel.c
@@ -129,7 +129,7 @@
 
 	if (op != VIA_BITBLT_FILL) {
 		tmp = src_mem ? 0 : src_addr;
-		if (dst_addr & 0xE0000007) {
+		if (tmp & 0xE0000007) {
 			printk(KERN_WARNING "hw_bitblt_1: Unsupported source "
 				"address %X\n", tmp);
 			return -EINVAL;
@@ -274,7 +274,7 @@
 		writel(tmp, engine + 0x18);
 
 		tmp = src_mem ? 0 : src_addr;
-		if (dst_addr & 0xE0000007) {
+		if (tmp & 0xE0000007) {
 			printk(KERN_WARNING "hw_bitblt_2: Unsupported source "
 				"address %X\n", tmp);
 			return -EINVAL;
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 679c6ad..ee6541d 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -364,13 +364,19 @@
 int virtio_device_freeze(struct virtio_device *dev)
 {
 	struct virtio_driver *drv = drv_to_virtio(dev->dev.driver);
+	int ret;
 
 	virtio_config_disable(dev);
 
 	dev->failed = dev->config->get_status(dev) & VIRTIO_CONFIG_S_FAILED;
 
-	if (drv && drv->freeze)
-		return drv->freeze(dev);
+	if (drv && drv->freeze) {
+		ret = drv->freeze(dev);
+		if (ret) {
+			virtio_config_enable(dev);
+			return ret;
+		}
+	}
 
 	return 0;
 }
diff --git a/fs/aio.c b/fs/aio.c
index 816f144..2f17281 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -558,8 +558,8 @@
 
 void kiocb_set_cancel_fn(struct kiocb *iocb, kiocb_cancel_fn *cancel)
 {
-	struct aio_kiocb *req = container_of(iocb, struct aio_kiocb, common);
-	struct kioctx *ctx = req->ki_ctx;
+	struct aio_kiocb *req;
+	struct kioctx *ctx;
 	unsigned long flags;
 
 	/*
@@ -569,6 +569,9 @@
 	if (!(iocb->ki_flags & IOCB_AIO_RW))
 		return;
 
+	req = container_of(iocb, struct aio_kiocb, common);
+	ctx = req->ki_ctx;
+
 	spin_lock_irqsave(&ctx->ctx_lock, flags);
 
 	if (!req->ki_list.next)
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 19a668e..dce566e 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -65,6 +65,8 @@
 
 #define BTRFS_MAX_LEVEL 8
 
+#define BTRFS_OLDEST_GENERATION	0ULL
+
 #define BTRFS_COMPAT_EXTENT_TREE_V0
 
 /*
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 5909d75..74ce617 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -181,8 +181,15 @@
 	ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
 	if (ret < 0)
 		goto fail;
+	if (ret == 0) {
+		/*
+		 * Key with offset of -1 found, there would have to exist an
+		 * inode with such number or a root with such id.
+		 */
+		ret = -EUCLEAN;
+		goto fail;
+	}
 
-	BUG_ON(ret == 0); /* Key with offset of -1 found */
 	if (path->slots[0] == 0) {
 		ret = -ENOENT;
 		goto fail;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 61ab4bc..79fd651 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2638,7 +2638,7 @@
 {
 	struct inode *inode = file_inode(file);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
-	struct btrfs_ioctl_defrag_range_args *range;
+	struct btrfs_ioctl_defrag_range_args range = {0};
 	int ret;
 
 	ret = mnt_want_write_file(file);
@@ -2664,37 +2664,28 @@
 			goto out;
 		}
 
-		range = kzalloc(sizeof(*range), GFP_KERNEL);
-		if (!range) {
-			ret = -ENOMEM;
-			goto out;
-		}
-
 		if (argp) {
-			if (copy_from_user(range, argp,
-					   sizeof(*range))) {
+			if (copy_from_user(&range, argp, sizeof(range))) {
 				ret = -EFAULT;
-				kfree(range);
 				goto out;
 			}
-			if (range->flags & ~BTRFS_DEFRAG_RANGE_FLAGS_SUPP) {
+			if (range.flags & ~BTRFS_DEFRAG_RANGE_FLAGS_SUPP) {
 				ret = -EOPNOTSUPP;
 				goto out;
 			}
 			/* compression requires us to start the IO */
-			if ((range->flags & BTRFS_DEFRAG_RANGE_COMPRESS)) {
-				range->flags |= BTRFS_DEFRAG_RANGE_START_IO;
-				range->extent_thresh = (u32)-1;
+			if ((range.flags & BTRFS_DEFRAG_RANGE_COMPRESS)) {
+				range.flags |= BTRFS_DEFRAG_RANGE_START_IO;
+				range.extent_thresh = (u32)-1;
 			}
 		} else {
 			/* the rest are all set to zero by kzalloc */
-			range->len = (u64)-1;
+			range.len = (u64)-1;
 		}
 		ret = btrfs_defrag_file(file_inode(file), file,
-					range, 0, 0);
+					&range, BTRFS_OLDEST_GENERATION, 0);
 		if (ret > 0)
 			ret = 0;
-		kfree(range);
 		break;
 	default:
 		ret = -EINVAL;
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index fa9797f..b8a697f0 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -965,7 +965,15 @@
 					ret = PTR_ERR(start);
 					goto out;
 				}
-				BUG_ON(start < p->buf);
+				if (unlikely(start < p->buf)) {
+					btrfs_err(root->fs_info,
+			"send: path ref buffer underflow for key (%llu %u %llu)",
+						  found_key->objectid,
+						  found_key->type,
+						  found_key->offset);
+					ret = -EINVAL;
+					goto out;
+				}
 			}
 			p->start = start;
 		} else {
diff --git a/fs/btrfs/tree-defrag.c b/fs/btrfs/tree-defrag.c
index cb65089..c09dbe4 100644
--- a/fs/btrfs/tree-defrag.c
+++ b/fs/btrfs/tree-defrag.c
@@ -39,7 +39,6 @@
 	int level;
 	int next_key_ret = 0;
 	u64 last_ret = 0;
-	u64 min_trans = 0;
 
 	if (root->fs_info->extent_root == root) {
 		/*
@@ -81,7 +80,7 @@
 
 	path->keep_locks = 1;
 
-	ret = btrfs_search_forward(root, &key, path, min_trans);
+	ret = btrfs_search_forward(root, &key, path, BTRFS_OLDEST_GENERATION);
 	if (ret < 0)
 		goto out;
 	if (ret > 0) {
@@ -130,7 +129,7 @@
 	 */
 	path->slots[1] = btrfs_header_nritems(path->nodes[1]);
 	next_key_ret = btrfs_find_next_key(root, path, &key, 1,
-					   min_trans);
+					   BTRFS_OLDEST_GENERATION);
 	if (next_key_ret == 0) {
 		memcpy(&root->defrag_progress, &key, sizeof(key));
 		ret = -EAGAIN;
diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c
index 331f3a1..c5c56f7 100644
--- a/fs/btrfs/uuid-tree.c
+++ b/fs/btrfs/uuid-tree.c
@@ -282,7 +282,7 @@
 	key.offset = 0;
 
 again_search_slot:
-	ret = btrfs_search_forward(root, &key, path, 0);
+	ret = btrfs_search_forward(root, &key, path, BTRFS_OLDEST_GENERATION);
 	if (ret) {
 		if (ret > 0)
 			ret = 0;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index e34a523..320acfa 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3001,7 +3001,17 @@
 			mutex_unlock(&fs_info->delete_unused_bgs_mutex);
 			goto error;
 		}
-		BUG_ON(ret == 0); /* Corruption */
+		if (ret == 0) {
+			/*
+			 * On the first search we would find chunk tree with
+			 * offset -1, which is not possible. On subsequent
+			 * loops this would find an existing item on an invalid
+			 * offset (one less than the previous one, wrong
+			 * alignment and size).
+			 */
+			ret = -EUCLEAN;
+			goto error;
+		}
 
 		ret = btrfs_previous_item(chunk_root, path, key.objectid,
 					  key.type);
@@ -4135,7 +4145,8 @@
 	key.offset = 0;
 
 	while (1) {
-		ret = btrfs_search_forward(root, &key, path, 0);
+		ret = btrfs_search_forward(root, &key, path,
+				BTRFS_OLDEST_GENERATION);
 		if (ret) {
 			if (ret > 0)
 				ret = 0;
diff --git a/fs/exec.c b/fs/exec.c
index 8d254c6..2745dc5 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -835,6 +835,7 @@
 			goto out;
 	}
 
+	bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;
 	*sp_location = sp;
 
 out:
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 47ecf08..a887dc7 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1532,7 +1532,8 @@
 		int gdb_num = group / EXT4_DESC_PER_BLOCK(sb);
 		int gdb_num_end = ((group + flex_gd->count - 1) /
 				   EXT4_DESC_PER_BLOCK(sb));
-		int meta_bg = ext4_has_feature_meta_bg(sb);
+		int meta_bg = ext4_has_feature_meta_bg(sb) &&
+			      gdb_num >= le32_to_cpu(es->s_first_meta_bg);
 		sector_t padding_blocks = meta_bg ? 0 : sbi->s_sbh->b_blocknr -
 					 ext4_group_first_block_no(sb, 0);
 		sector_t old_gdb = 0;
diff --git a/fs/fat/nfs.c b/fs/fat/nfs.c
index eb19265..f442a8d 100644
--- a/fs/fat/nfs.c
+++ b/fs/fat/nfs.c
@@ -139,6 +139,12 @@
 		fid->parent_i_gen = parent->i_generation;
 		type = FILEID_FAT_WITH_PARENT;
 		*lenp = FAT_FID_SIZE_WITH_PARENT;
+	} else {
+		/*
+		 * We need to initialize this field because the fh is actually
+		 * 12 bytes long
+		 */
+		fid->parent_i_pos_hi = 0;
 	}
 
 	return type;
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index ee05cc7..2ba54e0 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -728,7 +728,6 @@
 
 static inline void fuse_make_bad(struct inode *inode)
 {
-	remove_inode_hash(inode);
 	set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state);
 }
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index c4af5b1..3e5ca5b 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -324,8 +324,11 @@
 	} else if ((inode->i_mode ^ attr->mode) & S_IFMT) {
 		/* Inode has changed type, any I/O on the old should fail */
 		fuse_make_bad(inode);
-		iput(inode);
-		goto retry;
+		if (inode != d_inode(sb->s_root)) {
+			remove_inode_hash(inode);
+			iput(inode);
+			goto retry;
+		}
 	}
 
 	fi = get_fuse_inode(inode);
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index ee3c923..0ab1789 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -910,8 +910,22 @@
 	 * we then decide whether to use the Joliet descriptor.
 	 */
 	inode = isofs_iget(s, sbi->s_firstdatazone, 0);
-	if (IS_ERR(inode))
-		goto out_no_root;
+
+	/*
+	 * Fix for broken CDs with a corrupt root inode but a correct Joliet
+	 * root directory.
+	 */
+	if (IS_ERR(inode)) {
+		if (joliet_level && sbi->s_firstdatazone != first_data_zone) {
+			printk(KERN_NOTICE
+			       "ISOFS: root inode is unusable. "
+			       "Disabling Rock Ridge and switching to Joliet.");
+			sbi->s_rock = 0;
+			inode = NULL;
+		} else {
+			goto out_no_root;
+		}
+	}
 
 	/*
 	 * Fix for broken CDs with Rock Ridge and empty ISO root directory but
diff --git a/fs/nilfs2/alloc.c b/fs/nilfs2/alloc.c
index 095cf8b..459575a 100644
--- a/fs/nilfs2/alloc.c
+++ b/fs/nilfs2/alloc.c
@@ -623,10 +623,10 @@
 	lock = nilfs_mdt_bgl_lock(inode, group);
 
 	if (!nilfs_clear_bit_atomic(lock, group_offset, bitmap))
-		nilfs_msg(inode->i_sb, KERN_WARNING,
-			  "%s (ino=%lu): entry number %llu already freed",
-			  __func__, inode->i_ino,
-			  (unsigned long long)req->pr_entry_nr);
+		nilfs_warn(inode->i_sb,
+			   "%s (ino=%lu): entry number %llu already freed",
+			   __func__, inode->i_ino,
+			   (unsigned long long)req->pr_entry_nr);
 	else
 		nilfs_palloc_group_desc_add_entries(desc, lock, 1);
 
@@ -664,10 +664,10 @@
 	lock = nilfs_mdt_bgl_lock(inode, group);
 
 	if (!nilfs_clear_bit_atomic(lock, group_offset, bitmap))
-		nilfs_msg(inode->i_sb, KERN_WARNING,
-			  "%s (ino=%lu): entry number %llu already freed",
-			  __func__, inode->i_ino,
-			  (unsigned long long)req->pr_entry_nr);
+		nilfs_warn(inode->i_sb,
+			   "%s (ino=%lu): entry number %llu already freed",
+			   __func__, inode->i_ino,
+			   (unsigned long long)req->pr_entry_nr);
 	else
 		nilfs_palloc_group_desc_add_entries(desc, lock, 1);
 
@@ -773,10 +773,10 @@
 		do {
 			if (!nilfs_clear_bit_atomic(lock, group_offset,
 						    bitmap)) {
-				nilfs_msg(inode->i_sb, KERN_WARNING,
-					  "%s (ino=%lu): entry number %llu already freed",
-					  __func__, inode->i_ino,
-					  (unsigned long long)entry_nrs[j]);
+				nilfs_warn(inode->i_sb,
+					   "%s (ino=%lu): entry number %llu already freed",
+					   __func__, inode->i_ino,
+					   (unsigned long long)entry_nrs[j]);
 			} else {
 				n++;
 			}
@@ -818,10 +818,10 @@
 			ret = nilfs_palloc_delete_entry_block(inode,
 							      last_nrs[k]);
 			if (ret && ret != -ENOENT)
-				nilfs_msg(inode->i_sb, KERN_WARNING,
-					  "error %d deleting block that object (entry=%llu, ino=%lu) belongs to",
-					  ret, (unsigned long long)last_nrs[k],
-					  inode->i_ino);
+				nilfs_warn(inode->i_sb,
+					   "error %d deleting block that object (entry=%llu, ino=%lu) belongs to",
+					   ret, (unsigned long long)last_nrs[k],
+					   inode->i_ino);
 		}
 
 		desc_kaddr = kmap_atomic(desc_bh->b_page);
@@ -836,9 +836,9 @@
 		if (nfree == nilfs_palloc_entries_per_group(inode)) {
 			ret = nilfs_palloc_delete_bitmap_block(inode, group);
 			if (ret && ret != -ENOENT)
-				nilfs_msg(inode->i_sb, KERN_WARNING,
-					  "error %d deleting bitmap block of group=%lu, ino=%lu",
-					  ret, group, inode->i_ino);
+				nilfs_warn(inode->i_sb,
+					   "error %d deleting bitmap block of group=%lu, ino=%lu",
+					   ret, group, inode->i_ino);
 		}
 	}
 	return 0;
diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index 3da6201..920d202 100644
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -361,10 +361,10 @@
 		     (flags & NILFS_BTREE_NODE_ROOT) ||
 		     nchildren < 0 ||
 		     nchildren > NILFS_BTREE_NODE_NCHILDREN_MAX(size))) {
-		nilfs_msg(inode->i_sb, KERN_CRIT,
-			  "bad btree node (ino=%lu, blocknr=%llu): level = %d, flags = 0x%x, nchildren = %d",
-			  inode->i_ino, (unsigned long long)blocknr, level,
-			  flags, nchildren);
+		nilfs_crit(inode->i_sb,
+			   "bad btree node (ino=%lu, blocknr=%llu): level = %d, flags = 0x%x, nchildren = %d",
+			   inode->i_ino, (unsigned long long)blocknr, level,
+			   flags, nchildren);
 		ret = 1;
 	}
 	return ret;
@@ -391,9 +391,9 @@
 		     level >= NILFS_BTREE_LEVEL_MAX ||
 		     nchildren < 0 ||
 		     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
-		nilfs_msg(inode->i_sb, KERN_CRIT,
-			  "bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d",
-			  inode->i_ino, level, flags, nchildren);
+		nilfs_crit(inode->i_sb,
+			   "bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d",
+			   inode->i_ino, level, flags, nchildren);
 		ret = 1;
 	}
 	return ret;
@@ -460,10 +460,10 @@
 {
 	if (unlikely(nilfs_btree_node_get_level(node) != level)) {
 		dump_stack();
-		nilfs_msg(btree->b_inode->i_sb, KERN_CRIT,
-			  "btree level mismatch (ino=%lu): %d != %d",
-			  btree->b_inode->i_ino,
-			  nilfs_btree_node_get_level(node), level);
+		nilfs_crit(btree->b_inode->i_sb,
+			   "btree level mismatch (ino=%lu): %d != %d",
+			   btree->b_inode->i_ino,
+			   nilfs_btree_node_get_level(node), level);
 		return 1;
 	}
 	return 0;
@@ -528,7 +528,7 @@
 
  out_no_wait:
 	if (!buffer_uptodate(bh)) {
-		nilfs_msg(btree->b_inode->i_sb, KERN_ERR,
+		nilfs_err(btree->b_inode->i_sb,
 			  "I/O error reading b-tree node block (ino=%lu, blocknr=%llu)",
 			  btree->b_inode->i_ino, (unsigned long long)ptr);
 		brelse(bh);
@@ -733,7 +733,7 @@
 		dat = nilfs_bmap_get_dat(btree);
 		ret = nilfs_dat_translate(dat, ptr, &blocknr);
 		if (ret < 0)
-			goto out;
+			goto dat_error;
 		ptr = blocknr;
 	}
 	cnt = 1;
@@ -752,7 +752,7 @@
 			if (dat) {
 				ret = nilfs_dat_translate(dat, ptr2, &blocknr);
 				if (ret < 0)
-					goto out;
+					goto dat_error;
 				ptr2 = blocknr;
 			}
 			if (ptr2 != ptr + cnt || ++cnt == maxblocks)
@@ -791,6 +791,11 @@
  out:
 	nilfs_btree_free_path(path);
 	return ret;
+
+ dat_error:
+	if (ret == -ENOENT)
+		ret = -EINVAL;  /* Notify bmap layer of metadata corruption */
+	goto out;
 }
 
 static void nilfs_btree_promote_key(struct nilfs_bmap *btree,
@@ -2098,10 +2103,10 @@
 	ret = nilfs_btree_do_lookup(btree, path, key, NULL, level + 1, 0);
 	if (ret < 0) {
 		if (unlikely(ret == -ENOENT))
-			nilfs_msg(btree->b_inode->i_sb, KERN_CRIT,
-				  "writing node/leaf block does not appear in b-tree (ino=%lu) at key=%llu, level=%d",
-				  btree->b_inode->i_ino,
-				  (unsigned long long)key, level);
+			nilfs_crit(btree->b_inode->i_sb,
+				   "writing node/leaf block does not appear in b-tree (ino=%lu) at key=%llu, level=%d",
+				   btree->b_inode->i_ino,
+				   (unsigned long long)key, level);
 		goto out;
 	}
 
@@ -2138,11 +2143,11 @@
 	if (level < NILFS_BTREE_LEVEL_NODE_MIN ||
 	    level >= NILFS_BTREE_LEVEL_MAX) {
 		dump_stack();
-		nilfs_msg(btree->b_inode->i_sb, KERN_WARNING,
-			  "invalid btree level: %d (key=%llu, ino=%lu, blocknr=%llu)",
-			  level, (unsigned long long)key,
-			  btree->b_inode->i_ino,
-			  (unsigned long long)bh->b_blocknr);
+		nilfs_warn(btree->b_inode->i_sb,
+			   "invalid btree level: %d (key=%llu, ino=%lu, blocknr=%llu)",
+			   level, (unsigned long long)key,
+			   btree->b_inode->i_ino,
+			   (unsigned long long)bh->b_blocknr);
 		return;
 	}
 
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index a15a160..0087336 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -331,7 +331,7 @@
 	int ret, ncps, nicps, nss, count, i;
 
 	if (unlikely(start == 0 || start > end)) {
-		nilfs_msg(cpfile->i_sb, KERN_ERR,
+		nilfs_err(cpfile->i_sb,
 			  "cannot delete checkpoints: invalid range [%llu, %llu)",
 			  (unsigned long long)start, (unsigned long long)end);
 		return -EINVAL;
@@ -385,7 +385,7 @@
 								   cpfile, cno);
 					if (ret == 0)
 						continue;
-					nilfs_msg(cpfile->i_sb, KERN_ERR,
+					nilfs_err(cpfile->i_sb,
 						  "error %d deleting checkpoint block",
 						  ret);
 					break;
@@ -990,12 +990,10 @@
 	int err;
 
 	if (cpsize > sb->s_blocksize) {
-		nilfs_msg(sb, KERN_ERR,
-			  "too large checkpoint size: %zu bytes", cpsize);
+		nilfs_err(sb, "too large checkpoint size: %zu bytes", cpsize);
 		return -EINVAL;
 	} else if (cpsize < NILFS_MIN_CHECKPOINT_SIZE) {
-		nilfs_msg(sb, KERN_ERR,
-			  "too small checkpoint size: %zu bytes", cpsize);
+		nilfs_err(sb, "too small checkpoint size: %zu bytes", cpsize);
 		return -EINVAL;
 	}
 
diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
index 63bd200..d2d1927 100644
--- a/fs/nilfs2/dat.c
+++ b/fs/nilfs2/dat.c
@@ -363,11 +363,11 @@
 	kaddr = kmap_atomic(entry_bh->b_page);
 	entry = nilfs_palloc_block_get_entry(dat, vblocknr, entry_bh, kaddr);
 	if (unlikely(entry->de_blocknr == cpu_to_le64(0))) {
-		nilfs_msg(dat->i_sb, KERN_CRIT,
-			  "%s: invalid vblocknr = %llu, [%llu, %llu)",
-			  __func__, (unsigned long long)vblocknr,
-			  (unsigned long long)le64_to_cpu(entry->de_start),
-			  (unsigned long long)le64_to_cpu(entry->de_end));
+		nilfs_crit(dat->i_sb,
+			   "%s: invalid vblocknr = %llu, [%llu, %llu)",
+			   __func__, (unsigned long long)vblocknr,
+			   (unsigned long long)le64_to_cpu(entry->de_start),
+			   (unsigned long long)le64_to_cpu(entry->de_end));
 		kunmap_atomic(kaddr);
 		brelse(entry_bh);
 		return -EINVAL;
@@ -494,11 +494,11 @@
 	int err;
 
 	if (entry_size > sb->s_blocksize) {
-		nilfs_msg(sb, KERN_ERR, "too large DAT entry size: %zu bytes",
+		nilfs_err(sb, "too large DAT entry size: %zu bytes",
 			  entry_size);
 		return -EINVAL;
 	} else if (entry_size < NILFS_MIN_DAT_ENTRY_SIZE) {
-		nilfs_msg(sb, KERN_ERR, "too small DAT entry size: %zu bytes",
+		nilfs_err(sb, "too small DAT entry size: %zu bytes",
 			  entry_size);
 		return -EINVAL;
 	}
diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
index 96e3ed0..93aa648 100644
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -75,7 +75,7 @@
 		dat = nilfs_bmap_get_dat(direct);
 		ret = nilfs_dat_translate(dat, ptr, &blocknr);
 		if (ret < 0)
-			return ret;
+			goto dat_error;
 		ptr = blocknr;
 	}
 
@@ -88,7 +88,7 @@
 		if (dat) {
 			ret = nilfs_dat_translate(dat, ptr2, &blocknr);
 			if (ret < 0)
-				return ret;
+				goto dat_error;
 			ptr2 = blocknr;
 		}
 		if (ptr2 != ptr + cnt)
@@ -96,6 +96,11 @@
 	}
 	*ptrp = ptr;
 	return cnt;
+
+ dat_error:
+	if (ret == -ENOENT)
+		ret = -EINVAL;  /* Notify bmap layer of metadata corruption */
+	return ret;
 }
 
 static __u64
@@ -337,16 +342,18 @@
 
 	key = nilfs_bmap_data_get_key(bmap, *bh);
 	if (unlikely(key > NILFS_DIRECT_KEY_MAX)) {
-		nilfs_msg(bmap->b_inode->i_sb, KERN_CRIT,
-			  "%s (ino=%lu): invalid key: %llu", __func__,
-			  bmap->b_inode->i_ino, (unsigned long long)key);
+		nilfs_crit(bmap->b_inode->i_sb,
+			   "%s (ino=%lu): invalid key: %llu",
+			   __func__,
+			   bmap->b_inode->i_ino, (unsigned long long)key);
 		return -EINVAL;
 	}
 	ptr = nilfs_direct_get_ptr(bmap, key);
 	if (unlikely(ptr == NILFS_BMAP_INVALID_PTR)) {
-		nilfs_msg(bmap->b_inode->i_sb, KERN_CRIT,
-			  "%s (ino=%lu): invalid pointer: %llu", __func__,
-			  bmap->b_inode->i_ino, (unsigned long long)ptr);
+		nilfs_crit(bmap->b_inode->i_sb,
+			   "%s (ino=%lu): invalid pointer: %llu",
+			   __func__,
+			   bmap->b_inode->i_ino, (unsigned long long)ptr);
 		return -EINVAL;
 	}
 
diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c
index d8c0a9d..3ba2cc4 100644
--- a/fs/nilfs2/gcinode.c
+++ b/fs/nilfs2/gcinode.c
@@ -152,7 +152,7 @@
 	if (!buffer_uptodate(bh)) {
 		struct inode *inode = bh->b_page->mapping->host;
 
-		nilfs_msg(inode->i_sb, KERN_ERR,
+		nilfs_err(inode->i_sb,
 			  "I/O error reading %s block for GC (ino=%lu, vblocknr=%llu)",
 			  buffer_nilfs_node(bh) ? "node" : "data",
 			  inode->i_ino, (unsigned long long)bh->b_blocknr);
diff --git a/fs/nilfs2/ifile.c b/fs/nilfs2/ifile.c
index b8fa45c..7efaac7 100644
--- a/fs/nilfs2/ifile.c
+++ b/fs/nilfs2/ifile.c
@@ -151,8 +151,8 @@
 
 	err = nilfs_palloc_get_entry_block(ifile, ino, 0, out_bh);
 	if (unlikely(err))
-		nilfs_msg(sb, KERN_WARNING, "error %d reading inode: ino=%lu",
-			  err, (unsigned long)ino);
+		nilfs_warn(sb, "error %d reading inode: ino=%lu",
+			   err, (unsigned long)ino);
 	return err;
 }
 
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 7fe5b55..2789d83 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -116,11 +116,11 @@
 				 * However, the page having this block must
 				 * be locked in this case.
 				 */
-				nilfs_msg(inode->i_sb, KERN_WARNING,
-					  "%s (ino=%lu): a race condition while inserting a data block at offset=%llu",
-					  __func__, inode->i_ino,
-					  (unsigned long long)blkoff);
-				err = 0;
+				nilfs_warn(inode->i_sb,
+					   "%s (ino=%lu): a race condition while inserting a data block at offset=%llu",
+					   __func__, inode->i_ino,
+					   (unsigned long long)blkoff);
+				err = -EAGAIN;
 			}
 			nilfs_transaction_abort(inode->i_sb);
 			goto out;
@@ -871,9 +871,8 @@
 		goto repeat;
 
 failed:
-	nilfs_msg(ii->vfs_inode.i_sb, KERN_WARNING,
-		  "error %d truncating bmap (ino=%lu)", ret,
-		  ii->vfs_inode.i_ino);
+	nilfs_warn(ii->vfs_inode.i_sb, "error %d truncating bmap (ino=%lu)",
+		   ret, ii->vfs_inode.i_ino);
 }
 
 void nilfs_truncate(struct inode *inode)
@@ -1106,9 +1105,9 @@
 			 * This will happen when somebody is freeing
 			 * this inode.
 			 */
-			nilfs_msg(inode->i_sb, KERN_WARNING,
-				  "cannot set file dirty (ino=%lu): the file is being freed",
-				  inode->i_ino);
+			nilfs_warn(inode->i_sb,
+				   "cannot set file dirty (ino=%lu): the file is being freed",
+				   inode->i_ino);
 			spin_unlock(&nilfs->ns_inode_lock);
 			return -EINVAL; /*
 					 * NILFS_I_DIRTY may remain for
@@ -1137,9 +1136,9 @@
 
 	err = nilfs_load_inode_block(inode, &ibh);
 	if (unlikely(err)) {
-		nilfs_msg(inode->i_sb, KERN_WARNING,
-			  "cannot mark inode dirty (ino=%lu): error %d loading inode block",
-			  inode->i_ino, err);
+		nilfs_warn(inode->i_sb,
+			   "cannot mark inode dirty (ino=%lu): error %d loading inode block",
+			   inode->i_ino, err);
 		return err;
 	}
 	nilfs_update_inode(inode, ibh, flags);
@@ -1165,8 +1164,8 @@
 	struct nilfs_mdt_info *mdi = NILFS_MDT(inode);
 
 	if (is_bad_inode(inode)) {
-		nilfs_msg(inode->i_sb, KERN_WARNING,
-			  "tried to mark bad_inode dirty. ignored.");
+		nilfs_warn(inode->i_sb,
+			   "tried to mark bad_inode dirty. ignored.");
 		dump_stack();
 		return;
 	}
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index fe420bc..1d63a29 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -583,25 +583,25 @@
 
 	if (unlikely(ret < 0)) {
 		if (ret == -ENOENT)
-			nilfs_msg(inode->i_sb, KERN_CRIT,
-				  "%s: invalid virtual block address (%s): ino=%llu, cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu",
-				  __func__, vdesc->vd_flags ? "node" : "data",
-				  (unsigned long long)vdesc->vd_ino,
-				  (unsigned long long)vdesc->vd_cno,
-				  (unsigned long long)vdesc->vd_offset,
-				  (unsigned long long)vdesc->vd_blocknr,
-				  (unsigned long long)vdesc->vd_vblocknr);
+			nilfs_crit(inode->i_sb,
+				   "%s: invalid virtual block address (%s): ino=%llu, cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu",
+				   __func__, vdesc->vd_flags ? "node" : "data",
+				   (unsigned long long)vdesc->vd_ino,
+				   (unsigned long long)vdesc->vd_cno,
+				   (unsigned long long)vdesc->vd_offset,
+				   (unsigned long long)vdesc->vd_blocknr,
+				   (unsigned long long)vdesc->vd_vblocknr);
 		return ret;
 	}
 	if (unlikely(!list_empty(&bh->b_assoc_buffers))) {
-		nilfs_msg(inode->i_sb, KERN_CRIT,
-			  "%s: conflicting %s buffer: ino=%llu, cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu",
-			  __func__, vdesc->vd_flags ? "node" : "data",
-			  (unsigned long long)vdesc->vd_ino,
-			  (unsigned long long)vdesc->vd_cno,
-			  (unsigned long long)vdesc->vd_offset,
-			  (unsigned long long)vdesc->vd_blocknr,
-			  (unsigned long long)vdesc->vd_vblocknr);
+		nilfs_crit(inode->i_sb,
+			   "%s: conflicting %s buffer: ino=%llu, cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu",
+			   __func__, vdesc->vd_flags ? "node" : "data",
+			   (unsigned long long)vdesc->vd_ino,
+			   (unsigned long long)vdesc->vd_cno,
+			   (unsigned long long)vdesc->vd_offset,
+			   (unsigned long long)vdesc->vd_blocknr,
+			   (unsigned long long)vdesc->vd_vblocknr);
 		brelse(bh);
 		return -EEXIST;
 	}
@@ -851,8 +851,7 @@
 	return 0;
 
  failed:
-	nilfs_msg(nilfs->ns_sb, KERN_ERR, "error %d preparing GC: %s", ret,
-		  msg);
+	nilfs_err(nilfs->ns_sb, "error %d preparing GC: %s", ret, msg);
 	return ret;
 }
 
@@ -961,7 +960,7 @@
 
 	ret = nilfs_ioctl_move_blocks(inode->i_sb, &argv[0], kbufs[0]);
 	if (ret < 0) {
-		nilfs_msg(inode->i_sb, KERN_ERR,
+		nilfs_err(inode->i_sb,
 			  "error %d preparing GC: cannot read source blocks",
 			  ret);
 	} else {
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index 52763f8..5071279 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -208,7 +208,7 @@
  out_no_wait:
 	err = -EIO;
 	if (!buffer_uptodate(first_bh)) {
-		nilfs_msg(inode->i_sb, KERN_ERR,
+		nilfs_err(inode->i_sb,
 			  "I/O error reading meta-data file (ino=%lu, block-offset=%lu)",
 			  inode->i_ino, block);
 		goto failed_bh;
diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c
index 1ba4719..a2a44bc 100644
--- a/fs/nilfs2/namei.c
+++ b/fs/nilfs2/namei.c
@@ -281,9 +281,9 @@
 		goto out;
 
 	if (!inode->i_nlink) {
-		nilfs_msg(inode->i_sb, KERN_WARNING,
-			  "deleting nonexistent file (ino=%lu), %d",
-			  inode->i_ino, inode->i_nlink);
+		nilfs_warn(inode->i_sb,
+			   "deleting nonexistent file (ino=%lu), %d",
+			   inode->i_ino, inode->i_nlink);
 		set_nlink(inode, 1);
 	}
 	err = nilfs_delete_entry(de, page);
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index f9798f1..c68eb8d 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -330,6 +330,15 @@
 
 #endif /* CONFIG_PRINTK */
 
+#define nilfs_crit(sb, fmt, ...)					\
+	nilfs_msg(sb, KERN_CRIT, fmt, ##__VA_ARGS__)
+#define nilfs_err(sb, fmt, ...)						\
+	nilfs_msg(sb, KERN_ERR, fmt, ##__VA_ARGS__)
+#define nilfs_warn(sb, fmt, ...)					\
+	nilfs_msg(sb, KERN_WARNING, fmt, ##__VA_ARGS__)
+#define nilfs_info(sb, fmt, ...)					\
+	nilfs_msg(sb, KERN_INFO, fmt, ##__VA_ARGS__)
+
 extern struct nilfs_super_block *
 nilfs_read_super_block(struct super_block *, u64, int, struct buffer_head **);
 extern int nilfs_store_magic_and_option(struct super_block *,
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 6abaa56..cd3a859 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -410,9 +410,8 @@
 	BUG_ON(!PageLocked(page));
 
 	if (!silent)
-		nilfs_msg(sb, KERN_WARNING,
-			  "discard dirty page: offset=%lld, ino=%lu",
-			  page_offset(page), inode->i_ino);
+		nilfs_warn(sb, "discard dirty page: offset=%lld, ino=%lu",
+			   page_offset(page), inode->i_ino);
 
 	ClearPageUptodate(page);
 	ClearPageMappedToDisk(page);
@@ -428,9 +427,9 @@
 		do {
 			lock_buffer(bh);
 			if (!silent)
-				nilfs_msg(sb, KERN_WARNING,
-					  "discard dirty block: blocknr=%llu, size=%zu",
-					  (u64)bh->b_blocknr, bh->b_size);
+				nilfs_warn(sb,
+					   "discard dirty block: blocknr=%llu, size=%zu",
+					   (u64)bh->b_blocknr, bh->b_size);
 
 			set_mask_bits(&bh->b_state, clear_bits, 0);
 			unlock_buffer(bh);
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index cff5973..38de7da 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -60,7 +60,7 @@
 
 	switch (err) {
 	case NILFS_SEG_FAIL_IO:
-		nilfs_msg(sb, KERN_ERR, "I/O error reading segment");
+		nilfs_err(sb, "I/O error reading segment");
 		return -EIO;
 	case NILFS_SEG_FAIL_MAGIC:
 		msg = "Magic number mismatch";
@@ -81,10 +81,10 @@
 		msg = "No super root in the last segment";
 		break;
 	default:
-		nilfs_msg(sb, KERN_ERR, "unrecognized segment error %d", err);
+		nilfs_err(sb, "unrecognized segment error %d", err);
 		return -EINVAL;
 	}
-	nilfs_msg(sb, KERN_WARNING, "invalid segment: %s", msg);
+	nilfs_warn(sb, "invalid segment: %s", msg);
 	return -EINVAL;
 }
 
@@ -553,10 +553,10 @@
 		put_page(page);
 
  failed_inode:
-		nilfs_msg(sb, KERN_WARNING,
-			  "error %d recovering data block (ino=%lu, block-offset=%llu)",
-			  err, (unsigned long)rb->ino,
-			  (unsigned long long)rb->blkoff);
+		nilfs_warn(sb,
+			   "error %d recovering data block (ino=%lu, block-offset=%llu)",
+			   err, (unsigned long)rb->ino,
+			   (unsigned long long)rb->blkoff);
 		if (!err2)
 			err2 = err;
  next:
@@ -679,8 +679,7 @@
 	}
 
 	if (nsalvaged_blocks) {
-		nilfs_msg(sb, KERN_INFO, "salvaged %lu blocks",
-			  nsalvaged_blocks);
+		nilfs_info(sb, "salvaged %lu blocks", nsalvaged_blocks);
 		ri->ri_need_recovery = NILFS_RECOVERY_ROLLFORWARD_DONE;
 	}
  out:
@@ -691,7 +690,7 @@
  confused:
 	err = -EINVAL;
  failed:
-	nilfs_msg(sb, KERN_ERR,
+	nilfs_err(sb,
 		  "error %d roll-forwarding partial segment at blocknr = %llu",
 		  err, (unsigned long long)pseg_start);
 	goto out;
@@ -713,8 +712,8 @@
 	set_buffer_dirty(bh);
 	err = sync_dirty_buffer(bh);
 	if (unlikely(err))
-		nilfs_msg(nilfs->ns_sb, KERN_WARNING,
-			  "buffer sync write failed during post-cleaning of recovery.");
+		nilfs_warn(nilfs->ns_sb,
+			   "buffer sync write failed during post-cleaning of recovery.");
 	brelse(bh);
 }
 
@@ -749,8 +748,7 @@
 
 	err = nilfs_attach_checkpoint(sb, ri->ri_cno, true, &root);
 	if (unlikely(err)) {
-		nilfs_msg(sb, KERN_ERR,
-			  "error %d loading the latest checkpoint", err);
+		nilfs_err(sb, "error %d loading the latest checkpoint", err);
 		return err;
 	}
 
@@ -761,8 +759,7 @@
 	if (ri->ri_need_recovery == NILFS_RECOVERY_ROLLFORWARD_DONE) {
 		err = nilfs_prepare_segment_for_recovery(nilfs, sb, ri);
 		if (unlikely(err)) {
-			nilfs_msg(sb, KERN_ERR,
-				  "error %d preparing segment for recovery",
+			nilfs_err(sb, "error %d preparing segment for recovery",
 				  err);
 			goto failed;
 		}
@@ -776,8 +773,7 @@
 		nilfs_detach_log_writer(sb);
 
 		if (unlikely(err)) {
-			nilfs_msg(sb, KERN_ERR,
-				  "error %d writing segment for recovery",
+			nilfs_err(sb, "error %d writing segment for recovery",
 				  err);
 			goto failed;
 		}
diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
index 4d10870..31c8250 100644
--- a/fs/nilfs2/segbuf.c
+++ b/fs/nilfs2/segbuf.c
@@ -520,7 +520,7 @@
 	} while (--segbuf->sb_nbio > 0);
 
 	if (unlikely(atomic_read(&segbuf->sb_err) > 0)) {
-		nilfs_msg(segbuf->sb_super, KERN_ERR,
+		nilfs_err(segbuf->sb_super,
 			  "I/O error writing log (start-blocknr=%llu, block-count=%lu) in segment %llu",
 			  (unsigned long long)segbuf->sb_pseg_start,
 			  segbuf->sb_sum.nblocks,
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index d918b9d..fc6175b 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -167,7 +167,7 @@
 		 * it is saved and will be restored on
 		 * nilfs_transaction_commit().
 		 */
-		nilfs_msg(sb, KERN_WARNING, "journal info from a different FS");
+		nilfs_warn(sb, "journal info from a different FS");
 		save = current->journal_info;
 	}
 	if (!ti) {
@@ -1992,9 +1992,9 @@
 			err = nilfs_ifile_get_inode_block(
 				ifile, ii->vfs_inode.i_ino, &ibh);
 			if (unlikely(err)) {
-				nilfs_msg(sci->sc_super, KERN_WARNING,
-					  "log writer: error %d getting inode block (ino=%lu)",
-					  err, ii->vfs_inode.i_ino);
+				nilfs_warn(sci->sc_super,
+					   "log writer: error %d getting inode block (ino=%lu)",
+					   err, ii->vfs_inode.i_ino);
 				return err;
 			}
 			spin_lock(&nilfs->ns_inode_lock);
@@ -2504,7 +2504,7 @@
 		if (likely(!err))
 			break;
 
-		nilfs_msg(sb, KERN_WARNING, "error %d cleaning segments", err);
+		nilfs_warn(sb, "error %d cleaning segments", err);
 		set_current_state(TASK_INTERRUPTIBLE);
 		schedule_timeout(sci->sc_interval);
 	}
@@ -2512,9 +2512,9 @@
 		int ret = nilfs_discard_segments(nilfs, sci->sc_freesegs,
 						 sci->sc_nfreesegs);
 		if (ret) {
-			nilfs_msg(sb, KERN_WARNING,
-				  "error %d on discard request, turning discards off for the device",
-				  ret);
+			nilfs_warn(sb,
+				   "error %d on discard request, turning discards off for the device",
+				   ret);
 			nilfs_clear_opt(nilfs, DISCARD);
 		}
 	}
@@ -2596,9 +2596,9 @@
 	/* start sync. */
 	sci->sc_task = current;
 	wake_up(&sci->sc_wait_task); /* for nilfs_segctor_start_thread() */
-	nilfs_msg(sci->sc_super, KERN_INFO,
-		  "segctord starting. Construction interval = %lu seconds, CP frequency < %lu seconds",
-		  sci->sc_interval / HZ, sci->sc_mjcp_freq / HZ);
+	nilfs_info(sci->sc_super,
+		   "segctord starting. Construction interval = %lu seconds, CP frequency < %lu seconds",
+		   sci->sc_interval / HZ, sci->sc_mjcp_freq / HZ);
 
 	spin_lock(&sci->sc_state_lock);
  loop:
@@ -2671,8 +2671,8 @@
 	if (IS_ERR(t)) {
 		int err = PTR_ERR(t);
 
-		nilfs_msg(sci->sc_super, KERN_ERR,
-			  "error %d creating segctord thread", err);
+		nilfs_err(sci->sc_super, "error %d creating segctord thread",
+			  err);
 		return err;
 	}
 	wait_event(sci->sc_wait_task, sci->sc_task != NULL);
@@ -2782,14 +2782,14 @@
 		nilfs_segctor_write_out(sci);
 
 	if (!list_empty(&sci->sc_dirty_files)) {
-		nilfs_msg(sci->sc_super, KERN_WARNING,
-			  "disposed unprocessed dirty file(s) when stopping log writer");
+		nilfs_warn(sci->sc_super,
+			   "disposed unprocessed dirty file(s) when stopping log writer");
 		nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1);
 	}
 
 	if (!list_empty(&sci->sc_iput_queue)) {
-		nilfs_msg(sci->sc_super, KERN_WARNING,
-			  "disposed unprocessed inode(s) in iput queue when stopping log writer");
+		nilfs_warn(sci->sc_super,
+			   "disposed unprocessed inode(s) in iput queue when stopping log writer");
 		nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1);
 	}
 
@@ -2868,8 +2868,8 @@
 	spin_lock(&nilfs->ns_inode_lock);
 	if (!list_empty(&nilfs->ns_dirty_files)) {
 		list_splice_init(&nilfs->ns_dirty_files, &garbage_list);
-		nilfs_msg(sb, KERN_WARNING,
-			  "disposed unprocessed dirty file(s) when detaching log writer");
+		nilfs_warn(sb,
+			   "disposed unprocessed dirty file(s) when detaching log writer");
 	}
 	spin_unlock(&nilfs->ns_inode_lock);
 	up_write(&nilfs->ns_segctor_sem);
diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
index 317e728..0f0b68b 100644
--- a/fs/nilfs2/sufile.c
+++ b/fs/nilfs2/sufile.c
@@ -180,9 +180,9 @@
 	down_write(&NILFS_MDT(sufile)->mi_sem);
 	for (seg = segnumv; seg < segnumv + nsegs; seg++) {
 		if (unlikely(*seg >= nilfs_sufile_get_nsegments(sufile))) {
-			nilfs_msg(sufile->i_sb, KERN_WARNING,
-				  "%s: invalid segment number: %llu",
-				  __func__, (unsigned long long)*seg);
+			nilfs_warn(sufile->i_sb,
+				   "%s: invalid segment number: %llu",
+				   __func__, (unsigned long long)*seg);
 			nerr++;
 		}
 	}
@@ -239,9 +239,8 @@
 	int ret;
 
 	if (unlikely(segnum >= nilfs_sufile_get_nsegments(sufile))) {
-		nilfs_msg(sufile->i_sb, KERN_WARNING,
-			  "%s: invalid segment number: %llu",
-			  __func__, (unsigned long long)segnum);
+		nilfs_warn(sufile->i_sb, "%s: invalid segment number: %llu",
+			   __func__, (unsigned long long)segnum);
 		return -EINVAL;
 	}
 	down_write(&NILFS_MDT(sufile)->mi_sem);
@@ -419,9 +418,8 @@
 	kaddr = kmap_atomic(su_bh->b_page);
 	su = nilfs_sufile_block_get_segment_usage(sufile, segnum, su_bh, kaddr);
 	if (unlikely(!nilfs_segment_usage_clean(su))) {
-		nilfs_msg(sufile->i_sb, KERN_WARNING,
-			  "%s: segment %llu must be clean", __func__,
-			  (unsigned long long)segnum);
+		nilfs_warn(sufile->i_sb, "%s: segment %llu must be clean",
+			   __func__, (unsigned long long)segnum);
 		kunmap_atomic(kaddr);
 		return;
 	}
@@ -477,9 +475,8 @@
 	kaddr = kmap_atomic(su_bh->b_page);
 	su = nilfs_sufile_block_get_segment_usage(sufile, segnum, su_bh, kaddr);
 	if (nilfs_segment_usage_clean(su)) {
-		nilfs_msg(sufile->i_sb, KERN_WARNING,
-			  "%s: segment %llu is already clean",
-			  __func__, (unsigned long long)segnum);
+		nilfs_warn(sufile->i_sb, "%s: segment %llu is already clean",
+			   __func__, (unsigned long long)segnum);
 		kunmap_atomic(kaddr);
 		return;
 	}
@@ -1222,12 +1219,12 @@
 	int err;
 
 	if (susize > sb->s_blocksize) {
-		nilfs_msg(sb, KERN_ERR,
-			  "too large segment usage size: %zu bytes", susize);
+		nilfs_err(sb, "too large segment usage size: %zu bytes",
+			  susize);
 		return -EINVAL;
 	} else if (susize < NILFS_MIN_SEGMENT_USAGE_SIZE) {
-		nilfs_msg(sb, KERN_ERR,
-			  "too small segment usage size: %zu bytes", susize);
+		nilfs_err(sb, "too small segment usage size: %zu bytes",
+			  susize);
 		return -EINVAL;
 	}
 
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index e21a4f9..c2244cf 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -115,7 +115,7 @@
  *
  * This implements the body of nilfs_error() macro.  Normally,
  * nilfs_error() should be used.  As for sustainable errors such as a
- * single-shot I/O error, nilfs_msg() should be used instead.
+ * single-shot I/O error, nilfs_err() should be used instead.
  *
  * Callers should not add a trailing newline since this will do it.
  */
@@ -196,8 +196,7 @@
 	}
 
 	if (unlikely(err)) {
-		nilfs_msg(sb, KERN_ERR, "unable to write superblock: err=%d",
-			  err);
+		nilfs_err(sb, "unable to write superblock: err=%d", err);
 		if (err == -EIO && nilfs->ns_sbh[1]) {
 			/*
 			 * sbp[0] points to newer log than sbp[1],
@@ -267,7 +266,7 @@
 		    sbp[1]->s_magic == cpu_to_le16(NILFS_SUPER_MAGIC)) {
 			memcpy(sbp[0], sbp[1], nilfs->ns_sbsize);
 		} else {
-			nilfs_msg(sb, KERN_CRIT, "superblock broke");
+			nilfs_crit(sb, "superblock broke");
 			return NULL;
 		}
 	} else if (sbp[1] &&
@@ -377,9 +376,9 @@
 	offset = sb2off & (nilfs->ns_blocksize - 1);
 	nsbh = sb_getblk(sb, newblocknr);
 	if (!nsbh) {
-		nilfs_msg(sb, KERN_WARNING,
-			  "unable to move secondary superblock to block %llu",
-			  (unsigned long long)newblocknr);
+		nilfs_warn(sb,
+			   "unable to move secondary superblock to block %llu",
+			   (unsigned long long)newblocknr);
 		ret = -EIO;
 		goto out;
 	}
@@ -573,7 +572,7 @@
 	up_read(&nilfs->ns_segctor_sem);
 	if (unlikely(err)) {
 		if (err == -ENOENT || err == -EINVAL) {
-			nilfs_msg(sb, KERN_ERR,
+			nilfs_err(sb,
 				  "Invalid checkpoint (checkpoint number=%llu)",
 				  (unsigned long long)cno);
 			err = -EINVAL;
@@ -671,8 +670,7 @@
 	err = nilfs_ifile_count_free_inodes(root->ifile,
 					    &nmaxinodes, &nfreeinodes);
 	if (unlikely(err)) {
-		nilfs_msg(sb, KERN_WARNING,
-			  "failed to count free inodes: err=%d", err);
+		nilfs_warn(sb, "failed to count free inodes: err=%d", err);
 		if (err == -ERANGE) {
 			/*
 			 * If nilfs_palloc_count_max_entries() returns
@@ -804,7 +802,7 @@
 			break;
 		case Opt_snapshot:
 			if (is_remount) {
-				nilfs_msg(sb, KERN_ERR,
+				nilfs_err(sb,
 					  "\"%s\" option is invalid for remount",
 					  p);
 				return 0;
@@ -820,8 +818,7 @@
 			nilfs_clear_opt(nilfs, DISCARD);
 			break;
 		default:
-			nilfs_msg(sb, KERN_ERR,
-				  "unrecognized mount option \"%s\"", p);
+			nilfs_err(sb, "unrecognized mount option \"%s\"", p);
 			return 0;
 		}
 	}
@@ -857,10 +854,10 @@
 	mnt_count = le16_to_cpu(sbp[0]->s_mnt_count);
 
 	if (nilfs->ns_mount_state & NILFS_ERROR_FS) {
-		nilfs_msg(sb, KERN_WARNING, "mounting fs with errors");
+		nilfs_warn(sb, "mounting fs with errors");
 #if 0
 	} else if (max_mnt_count >= 0 && mnt_count >= max_mnt_count) {
-		nilfs_msg(sb, KERN_WARNING, "maximal mount count reached");
+		nilfs_warn(sb, "maximal mount count reached");
 #endif
 	}
 	if (!max_mnt_count)
@@ -923,7 +920,7 @@
 	features = le64_to_cpu(sbp->s_feature_incompat) &
 		~NILFS_FEATURE_INCOMPAT_SUPP;
 	if (features) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "couldn't mount because of unsupported optional features (%llx)",
 			  (unsigned long long)features);
 		return -EINVAL;
@@ -931,7 +928,7 @@
 	features = le64_to_cpu(sbp->s_feature_compat_ro) &
 		~NILFS_FEATURE_COMPAT_RO_SUPP;
 	if (!sb_rdonly(sb) && features) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "couldn't mount RDWR because of unsupported optional features (%llx)",
 			  (unsigned long long)features);
 		return -EINVAL;
@@ -950,12 +947,12 @@
 	inode = nilfs_iget(sb, root, NILFS_ROOT_INO);
 	if (IS_ERR(inode)) {
 		ret = PTR_ERR(inode);
-		nilfs_msg(sb, KERN_ERR, "error %d getting root inode", ret);
+		nilfs_err(sb, "error %d getting root inode", ret);
 		goto out;
 	}
 	if (!S_ISDIR(inode->i_mode) || !inode->i_blocks || !inode->i_size) {
 		iput(inode);
-		nilfs_msg(sb, KERN_ERR, "corrupt root inode");
+		nilfs_err(sb, "corrupt root inode");
 		ret = -EINVAL;
 		goto out;
 	}
@@ -983,7 +980,7 @@
 	return ret;
 
  failed_dentry:
-	nilfs_msg(sb, KERN_ERR, "error %d getting root dentry", ret);
+	nilfs_err(sb, "error %d getting root dentry", ret);
 	goto out;
 }
 
@@ -1003,7 +1000,7 @@
 		ret = (ret == -ENOENT) ? -EINVAL : ret;
 		goto out;
 	} else if (!ret) {
-		nilfs_msg(s, KERN_ERR,
+		nilfs_err(s,
 			  "The specified checkpoint is not a snapshot (checkpoint number=%llu)",
 			  (unsigned long long)cno);
 		ret = -EINVAL;
@@ -1012,7 +1009,7 @@
 
 	ret = nilfs_attach_checkpoint(s, cno, false, &root);
 	if (ret) {
-		nilfs_msg(s, KERN_ERR,
+		nilfs_err(s,
 			  "error %d while loading snapshot (checkpoint number=%llu)",
 			  ret, (unsigned long long)cno);
 		goto out;
@@ -1109,7 +1106,7 @@
 	cno = nilfs_last_cno(nilfs);
 	err = nilfs_attach_checkpoint(sb, cno, true, &fsroot);
 	if (err) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "error %d while loading last checkpoint (checkpoint number=%llu)",
 			  err, (unsigned long long)cno);
 		goto failed_unload;
@@ -1172,8 +1169,8 @@
 	err = -EINVAL;
 
 	if (!nilfs_valid_fs(nilfs)) {
-		nilfs_msg(sb, KERN_WARNING,
-			  "couldn't remount because the filesystem is in an incomplete recovery state");
+		nilfs_warn(sb,
+			   "couldn't remount because the filesystem is in an incomplete recovery state");
 		goto restore_opts;
 	}
 
@@ -1203,9 +1200,9 @@
 			~NILFS_FEATURE_COMPAT_RO_SUPP;
 		up_read(&nilfs->ns_sem);
 		if (features) {
-			nilfs_msg(sb, KERN_WARNING,
-				  "couldn't remount RDWR because of unsupported optional features (%llx)",
-				  (unsigned long long)features);
+			nilfs_warn(sb,
+				   "couldn't remount RDWR because of unsupported optional features (%llx)",
+				   (unsigned long long)features);
 			err = -EROFS;
 			goto restore_opts;
 		}
@@ -1264,7 +1261,7 @@
 	return 0;
 
 parse_error:
-	nilfs_msg(NULL, KERN_ERR, "invalid option \"%s\": %s", option, msg);
+	nilfs_err(NULL, "invalid option \"%s\": %s", option, msg);
 	return 1;
 }
 
@@ -1367,7 +1364,7 @@
 	} else if (!sd.cno) {
 		if (nilfs_tree_is_busy(s->s_root)) {
 			if ((flags ^ s->s_flags) & MS_RDONLY) {
-				nilfs_msg(s, KERN_ERR,
+				nilfs_err(s,
 					  "the device already has a %s mount.",
 					  sb_rdonly(s) ? "read-only" : "read/write");
 				err = -EBUSY;
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 33fba75..cd6aace 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -270,8 +270,8 @@
 	err = nilfs_cpfile_get_stat(nilfs->ns_cpfile, &cpstat);
 	up_read(&nilfs->ns_segctor_sem);
 	if (err < 0) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "unable to get checkpoint stat: err=%d", err);
+		nilfs_err(nilfs->ns_sb, "unable to get checkpoint stat: err=%d",
+			  err);
 		return err;
 	}
 
@@ -293,8 +293,8 @@
 	err = nilfs_cpfile_get_stat(nilfs->ns_cpfile, &cpstat);
 	up_read(&nilfs->ns_segctor_sem);
 	if (err < 0) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "unable to get checkpoint stat: err=%d", err);
+		nilfs_err(nilfs->ns_sb, "unable to get checkpoint stat: err=%d",
+			  err);
 		return err;
 	}
 
@@ -412,8 +412,8 @@
 	err = nilfs_sufile_get_stat(nilfs->ns_sufile, &sustat);
 	up_read(&nilfs->ns_segctor_sem);
 	if (err < 0) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "unable to get segment stat: err=%d", err);
+		nilfs_err(nilfs->ns_sb, "unable to get segment stat: err=%d",
+			  err);
 		return err;
 	}
 
@@ -787,15 +787,15 @@
 
 	err = kstrtouint(skip_spaces(buf), 0, &val);
 	if (err) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "unable to convert string: err=%d", err);
+		nilfs_err(nilfs->ns_sb, "unable to convert string: err=%d",
+			  err);
 		return err;
 	}
 
 	if (val < NILFS_SB_FREQ) {
 		val = NILFS_SB_FREQ;
-		nilfs_msg(nilfs->ns_sb, KERN_WARNING,
-			  "superblock update frequency cannot be lesser than 10 seconds");
+		nilfs_warn(nilfs->ns_sb,
+			   "superblock update frequency cannot be lesser than 10 seconds");
 	}
 
 	down_write(&nilfs->ns_sem);
@@ -998,8 +998,7 @@
 	nilfs->ns_dev_subgroups = kzalloc(devgrp_size, GFP_KERNEL);
 	if (unlikely(!nilfs->ns_dev_subgroups)) {
 		err = -ENOMEM;
-		nilfs_msg(sb, KERN_ERR,
-			  "unable to allocate memory for device group");
+		nilfs_err(sb, "unable to allocate memory for device group");
 		goto failed_create_device_group;
 	}
 
@@ -1108,15 +1107,13 @@
 	nilfs_kset = kset_create_and_add(NILFS_ROOT_GROUP_NAME, NULL, fs_kobj);
 	if (!nilfs_kset) {
 		err = -ENOMEM;
-		nilfs_msg(NULL, KERN_ERR,
-			  "unable to create sysfs entry: err=%d", err);
+		nilfs_err(NULL, "unable to create sysfs entry: err=%d", err);
 		goto failed_sysfs_init;
 	}
 
 	err = sysfs_create_group(&nilfs_kset->kobj, &nilfs_feature_attr_group);
 	if (unlikely(err)) {
-		nilfs_msg(NULL, KERN_ERR,
-			  "unable to create feature group: err=%d", err);
+		nilfs_err(NULL, "unable to create feature group: err=%d", err);
 		goto cleanup_sysfs_init;
 	}
 
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index e04d2c2..e0a887e 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -192,7 +192,7 @@
 		nilfs_get_segnum_of_block(nilfs, nilfs->ns_last_pseg);
 	nilfs->ns_cno = nilfs->ns_last_cno + 1;
 	if (nilfs->ns_segnum >= nilfs->ns_nsegments) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
+		nilfs_err(nilfs->ns_sb,
 			  "pointed segment number is out of range: segnum=%llu, nsegments=%lu",
 			  (unsigned long long)nilfs->ns_segnum,
 			  nilfs->ns_nsegments);
@@ -219,12 +219,12 @@
 	int err;
 
 	if (!valid_fs) {
-		nilfs_msg(sb, KERN_WARNING, "mounting unchecked fs");
+		nilfs_warn(sb, "mounting unchecked fs");
 		if (s_flags & MS_RDONLY) {
-			nilfs_msg(sb, KERN_INFO,
-				  "recovery required for readonly filesystem");
-			nilfs_msg(sb, KERN_INFO,
-				  "write access will be enabled during recovery");
+			nilfs_info(sb,
+				   "recovery required for readonly filesystem");
+			nilfs_info(sb,
+				   "write access will be enabled during recovery");
 		}
 	}
 
@@ -239,12 +239,11 @@
 			goto scan_error;
 
 		if (!nilfs_valid_sb(sbp[1])) {
-			nilfs_msg(sb, KERN_WARNING,
-				  "unable to fall back to spare super block");
+			nilfs_warn(sb,
+				   "unable to fall back to spare super block");
 			goto scan_error;
 		}
-		nilfs_msg(sb, KERN_INFO,
-			  "trying rollback from an earlier position");
+		nilfs_info(sb, "trying rollback from an earlier position");
 
 		/*
 		 * restore super block with its spare and reconfigure
@@ -257,9 +256,9 @@
 		/* verify consistency between two super blocks */
 		blocksize = BLOCK_SIZE << le32_to_cpu(sbp[0]->s_log_block_size);
 		if (blocksize != nilfs->ns_blocksize) {
-			nilfs_msg(sb, KERN_WARNING,
-				  "blocksize differs between two super blocks (%d != %d)",
-				  blocksize, nilfs->ns_blocksize);
+			nilfs_warn(sb,
+				   "blocksize differs between two super blocks (%d != %d)",
+				   blocksize, nilfs->ns_blocksize);
 			goto scan_error;
 		}
 
@@ -278,8 +277,7 @@
 
 	err = nilfs_load_super_root(nilfs, sb, ri.ri_super_root);
 	if (unlikely(err)) {
-		nilfs_msg(sb, KERN_ERR, "error %d while loading super root",
-			  err);
+		nilfs_err(sb, "error %d while loading super root", err);
 		goto failed;
 	}
 
@@ -294,28 +292,28 @@
 		__u64 features;
 
 		if (nilfs_test_opt(nilfs, NORECOVERY)) {
-			nilfs_msg(sb, KERN_INFO,
-				  "norecovery option specified, skipping roll-forward recovery");
+			nilfs_info(sb,
+				   "norecovery option specified, skipping roll-forward recovery");
 			goto skip_recovery;
 		}
 		features = le64_to_cpu(nilfs->ns_sbp[0]->s_feature_compat_ro) &
 			~NILFS_FEATURE_COMPAT_RO_SUPP;
 		if (features) {
-			nilfs_msg(sb, KERN_ERR,
+			nilfs_err(sb,
 				  "couldn't proceed with recovery because of unsupported optional features (%llx)",
 				  (unsigned long long)features);
 			err = -EROFS;
 			goto failed_unload;
 		}
 		if (really_read_only) {
-			nilfs_msg(sb, KERN_ERR,
+			nilfs_err(sb,
 				  "write access unavailable, cannot proceed");
 			err = -EROFS;
 			goto failed_unload;
 		}
 		sb->s_flags &= ~MS_RDONLY;
 	} else if (nilfs_test_opt(nilfs, NORECOVERY)) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "recovery cancelled because norecovery option was specified for a read/write mount");
 		err = -EINVAL;
 		goto failed_unload;
@@ -331,12 +329,12 @@
 	up_write(&nilfs->ns_sem);
 
 	if (err) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "error %d updating super block. recovery unfinished.",
 			  err);
 		goto failed_unload;
 	}
-	nilfs_msg(sb, KERN_INFO, "recovery complete");
+	nilfs_info(sb, "recovery complete");
 
  skip_recovery:
 	nilfs_clear_recovery_info(&ri);
@@ -344,7 +342,7 @@
 	return 0;
 
  scan_error:
-	nilfs_msg(sb, KERN_ERR, "error %d while searching super root", err);
+	nilfs_err(sb, "error %d while searching super root", err);
 	goto failed;
 
  failed_unload:
@@ -408,7 +406,7 @@
 	u64 nsegments, nblocks;
 
 	if (le32_to_cpu(sbp->s_rev_level) < NILFS_MIN_SUPP_REV) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
+		nilfs_err(nilfs->ns_sb,
 			  "unsupported revision (superblock rev.=%d.%d, current rev.=%d.%d). Please check the version of mkfs.nilfs(2).",
 			  le32_to_cpu(sbp->s_rev_level),
 			  le16_to_cpu(sbp->s_minor_rev_level),
@@ -421,13 +419,11 @@
 
 	nilfs->ns_inode_size = le16_to_cpu(sbp->s_inode_size);
 	if (nilfs->ns_inode_size > nilfs->ns_blocksize) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "too large inode size: %d bytes",
+		nilfs_err(nilfs->ns_sb, "too large inode size: %d bytes",
 			  nilfs->ns_inode_size);
 		return -EINVAL;
 	} else if (nilfs->ns_inode_size < NILFS_MIN_INODE_SIZE) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "too small inode size: %d bytes",
+		nilfs_err(nilfs->ns_sb, "too small inode size: %d bytes",
 			  nilfs->ns_inode_size);
 		return -EINVAL;
 	}
@@ -436,8 +432,7 @@
 
 	nilfs->ns_blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment);
 	if (nilfs->ns_blocks_per_segment < NILFS_SEG_MIN_BLOCKS) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "too short segment: %lu blocks",
+		nilfs_err(nilfs->ns_sb, "too short segment: %lu blocks",
 			  nilfs->ns_blocks_per_segment);
 		return -EINVAL;
 	}
@@ -447,7 +442,7 @@
 		le32_to_cpu(sbp->s_r_segments_percentage);
 	if (nilfs->ns_r_segments_percentage < 1 ||
 	    nilfs->ns_r_segments_percentage > 99) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
+		nilfs_err(nilfs->ns_sb,
 			  "invalid reserved segments percentage: %lu",
 			  nilfs->ns_r_segments_percentage);
 		return -EINVAL;
@@ -589,16 +584,16 @@
 
 	if (!sbp[0]) {
 		if (!sbp[1]) {
-			nilfs_msg(sb, KERN_ERR, "unable to read superblock");
+			nilfs_err(sb, "unable to read superblock");
 			return -EIO;
 		}
-		nilfs_msg(sb, KERN_WARNING,
-			  "unable to read primary superblock (blocksize = %d)",
-			  blocksize);
+		nilfs_warn(sb,
+			   "unable to read primary superblock (blocksize = %d)",
+			   blocksize);
 	} else if (!sbp[1]) {
-		nilfs_msg(sb, KERN_WARNING,
-			  "unable to read secondary superblock (blocksize = %d)",
-			  blocksize);
+		nilfs_warn(sb,
+			   "unable to read secondary superblock (blocksize = %d)",
+			   blocksize);
 	}
 
 	/*
@@ -620,14 +615,14 @@
 	}
 	if (!valid[swp]) {
 		nilfs_release_super_block(nilfs);
-		nilfs_msg(sb, KERN_ERR, "couldn't find nilfs on the device");
+		nilfs_err(sb, "couldn't find nilfs on the device");
 		return -EINVAL;
 	}
 
 	if (!valid[!swp])
-		nilfs_msg(sb, KERN_WARNING,
-			  "broken superblock, retrying with spare superblock (blocksize = %d)",
-			  blocksize);
+		nilfs_warn(sb,
+			   "broken superblock, retrying with spare superblock (blocksize = %d)",
+			   blocksize);
 	if (swp)
 		nilfs_swap_super_block(nilfs);
 
@@ -661,7 +656,7 @@
 
 	blocksize = sb_min_blocksize(sb, NILFS_MIN_BLOCK_SIZE);
 	if (!blocksize) {
-		nilfs_msg(sb, KERN_ERR, "unable to set blocksize");
+		nilfs_err(sb, "unable to set blocksize");
 		err = -EINVAL;
 		goto out;
 	}
@@ -680,7 +675,7 @@
 	blocksize = BLOCK_SIZE << le32_to_cpu(sbp->s_log_block_size);
 	if (blocksize < NILFS_MIN_BLOCK_SIZE ||
 	    blocksize > NILFS_MAX_BLOCK_SIZE) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "couldn't mount because of unsupported filesystem blocksize %d",
 			  blocksize);
 		err = -EINVAL;
@@ -690,7 +685,7 @@
 		int hw_blocksize = bdev_logical_block_size(sb->s_bdev);
 
 		if (blocksize < hw_blocksize) {
-			nilfs_msg(sb, KERN_ERR,
+			nilfs_err(sb,
 				  "blocksize %d too small for device (sector-size = %d)",
 				  blocksize, hw_blocksize);
 			err = -EINVAL;
diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c
index e3d1673..ef9bcfe 100644
--- a/fs/sysv/itree.c
+++ b/fs/sysv/itree.c
@@ -82,9 +82,6 @@
 	return (sysv_zone_t*)((char*)bh->b_data + bh->b_size);
 }
 
-/*
- * Requires read_lock(&pointers_lock) or write_lock(&pointers_lock)
- */
 static Indirect *get_branch(struct inode *inode,
 			    int depth,
 			    int offsets[],
@@ -104,15 +101,18 @@
 		bh = sb_bread(sb, block);
 		if (!bh)
 			goto failure;
+		read_lock(&pointers_lock);
 		if (!verify_chain(chain, p))
 			goto changed;
 		add_chain(++p, bh, (sysv_zone_t*)bh->b_data + *++offsets);
+		read_unlock(&pointers_lock);
 		if (!p->key)
 			goto no_block;
 	}
 	return NULL;
 
 changed:
+	read_unlock(&pointers_lock);
 	brelse(bh);
 	*err = -EAGAIN;
 	goto no_block;
@@ -218,9 +218,7 @@
 		goto out;
 
 reread:
-	read_lock(&pointers_lock);
 	partial = get_branch(inode, depth, offsets, chain, &err);
-	read_unlock(&pointers_lock);
 
 	/* Simplest case - block found, no allocation needed */
 	if (!partial) {
@@ -290,9 +288,9 @@
 	*top = 0;
 	for (k = depth; k > 1 && !offsets[k-1]; k--)
 		;
+	partial = get_branch(inode, k, offsets, chain, &err);
 
 	write_lock(&pointers_lock);
-	partial = get_branch(inode, k, offsets, chain, &err);
 	if (!partial)
 		partial = chain + k-1;
 	/*
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 7cdd346..b1ec5e2 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -273,9 +273,6 @@
 				return err;
 			}
 		}
-
-		SetPageUptodate(page);
-		ClearPageError(page);
 	}
 
 	if (PagePrivate(page))
@@ -474,9 +471,6 @@
 				return err;
 			}
 		}
-
-		SetPageUptodate(page);
-		ClearPageError(page);
 	}
 
 	err = allocate_budget(c, page, ui, appending);
@@ -486,10 +480,8 @@
 		 * If we skipped reading the page because we were going to
 		 * write all of it, then it is not up to date.
 		 */
-		if (skipped_read) {
+		if (skipped_read)
 			ClearPageChecked(page);
-			ClearPageUptodate(page);
-		}
 		/*
 		 * Budgeting failed which means it would have to force
 		 * write-back but didn't, because we set the @fast flag in the
@@ -580,6 +572,9 @@
 		goto out;
 	}
 
+	if (len == PAGE_SIZE)
+		SetPageUptodate(page);
+
 	if (!PagePrivate(page)) {
 		SetPagePrivate(page);
 		atomic_long_inc(&c->dirty_pg_cnt);
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 7dc27ce..4406931 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -601,6 +601,15 @@
 }
 #endif /* CONFIG_PM_SLEEP */
 
+/*
+ * Check if the gfp flags allow compaction - GFP_NOIO is a really
+ * tricky context because the migration might require IO.
+ */
+static inline bool gfp_compaction_allowed(gfp_t gfp_mask)
+{
+	return IS_ENABLED(CONFIG_COMPACTION) && (gfp_mask & __GFP_IO);
+}
+
 #if (defined(CONFIG_MEMORY_ISOLATION) && defined(CONFIG_COMPACTION)) || defined(CONFIG_CMA)
 /* The below functions must be run on a range from a single zone. */
 extern int alloc_contig_range(unsigned long start, unsigned long end,
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index 0f7c8f8..d118df7 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -190,7 +190,7 @@
 	unsigned char		maxpriority;		/* maximum priority (0 if queue is not a priority queue) */
 	unsigned char		priority;		/* current priority */
 	unsigned char		nr;			/* # tasks remaining for cookie */
-	unsigned short		qlen;			/* total # tasks waiting in queue */
+	unsigned int		qlen;			/* total # tasks waiting in queue */
 	struct rpc_timer	timer_list;
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) || IS_ENABLED(CONFIG_TRACEPOINTS)
 	const char *		name;
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 671f86f..1f8626c 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -176,6 +176,7 @@
 			       void (*delack_handler)(unsigned long),
 			       void (*keepalive_handler)(unsigned long));
 void inet_csk_clear_xmit_timers(struct sock *sk);
+void inet_csk_clear_xmit_timers_sync(struct sock *sk);
 
 static inline void inet_csk_schedule_ack(struct sock *sk)
 {
diff --git a/include/net/sock.h b/include/net/sock.h
index 96f6f10..4d65d47 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1561,6 +1561,13 @@
 #endif
 }
 
+static inline void sock_not_owned_by_me(const struct sock *sk)
+{
+#ifdef CONFIG_LOCKDEP
+	WARN_ON_ONCE(lockdep_sock_is_held(sk) && debug_locks);
+#endif
+}
+
 static inline bool sock_owned_by_user(const struct sock *sk)
 {
 	sock_owned_by_me(sk);
@@ -2108,6 +2115,8 @@
 
 void sk_stop_timer(struct sock *sk, struct timer_list *timer);
 
+void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer);
+
 int __sk_queue_drop_skb(struct sock *sk, struct sk_buff_head *sk_queue,
 			struct sk_buff *skb, unsigned int flags,
 			void (*destructor)(struct sock *sk,
diff --git a/include/soc/fsl/qman.h b/include/soc/fsl/qman.h
index d4dfefd..5c004b2 100644
--- a/include/soc/fsl/qman.h
+++ b/include/soc/fsl/qman.h
@@ -1160,6 +1160,15 @@
 void qman_delete_cgr_safe(struct qman_cgr *cgr);
 
 /**
+ * qman_update_cgr_safe - Modifies a congestion group object from any CPU
+ * @cgr: the 'cgr' object to modify
+ * @opts: state of the CGR settings
+ *
+ * This will select the proper CPU and modify the CGR settings.
+ */
+int qman_update_cgr_safe(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts);
+
+/**
  * qman_query_cgr_congested - Queries CGR's congestion status
  * @cgr: the 'cgr' object to query
  * @result: returns 'cgr's congestion status, 1 (true) if congested
diff --git a/init/initramfs.c b/init/initramfs.c
index 623746e..a11cfb9 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -650,7 +650,7 @@
 		printk(KERN_INFO "rootfs image is not initramfs (%s)"
 				"; looks like an initrd\n", err);
 		fd = sys_open("/initrd.image",
-			      O_WRONLY|O_CREAT, 0700);
+			      O_WRONLY|O_CREAT|O_LARGEFILE, 0700);
 		if (fd >= 0) {
 			ssize_t written = xwrite(fd, (char *)initrd_start,
 						initrd_end - initrd_start);
diff --git a/kernel/events/core.c b/kernel/events/core.c
index c62064b..fcbe2b0 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5911,9 +5911,16 @@
 {
 	struct perf_event *leader = event->group_leader, *sub;
 	u64 read_format = event->attr.read_format;
+	unsigned long flags;
 	u64 values[5];
 	int n = 0;
 
+	/*
+	 * Disabling interrupts avoids all counter scheduling
+	 * (context switches, timer based rotation and IPIs).
+	 */
+	local_irq_save(flags);
+
 	values[n++] = 1 + leader->nr_siblings;
 
 	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
@@ -5945,6 +5952,8 @@
 
 		__output_copy(handle, values, n * sizeof(u64));
 	}
+
+	local_irq_restore(flags);
 }
 
 #define PERF_FORMAT_TOTAL_TIMES (PERF_FORMAT_TOTAL_TIME_ENABLED|\
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 9daadf1..710a8c3 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -202,6 +202,7 @@
 		if (mem_sleep_labels[state] &&
 		    !strcmp(str, mem_sleep_labels[state])) {
 			mem_sleep_default = state;
+			mem_sleep_current = state;
 			break;
 		}
 
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 5eba611..dbdab1b 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1912,6 +1912,12 @@
 	 */
 	mutex_acquire(&console_lock_dep_map, 0, 1, _THIS_IP_);
 
+	/*
+	 * Update @console_may_schedule for trylock because the previous
+	 * owner may have been schedulable.
+	 */
+	console_may_schedule = 0;
+
 	return 1;
 }
 
diff --git a/kernel/sys.c b/kernel/sys.c
index 05ed2a3..420232c 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1393,7 +1393,7 @@
 	if (!strncmp(current->comm, "bpfloader", 9) ||
 	    !strncmp(current->comm, "netbpfload", 10) ||
 	    !strncmp(current->comm, "netd", 4)) {
-		strcpy(tmp.release, "5.4.0");
+		strcpy(tmp.release, "5.4.186");
 		pr_debug("fake uname: %s/%d release=%s\n",
 			 current->comm, current->pid, tmp.release);
 	}
diff --git a/mm/compaction.c b/mm/compaction.c
index 0d8a825..5907fbd 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1721,16 +1721,11 @@
 		unsigned int alloc_flags, const struct alloc_context *ac,
 		enum compact_priority prio)
 {
-	int may_perform_io = gfp_mask & __GFP_IO;
 	struct zoneref *z;
 	struct zone *zone;
 	enum compact_result rc = COMPACT_SKIPPED;
 
-	/*
-	 * Check if the GFP flags allow compaction - GFP_NOIO is really
-	 * tricky context because the migration might require IO
-	 */
-	if (!may_perform_io)
+	if (!gfp_compaction_allowed(gfp_mask))
 		return COMPACT_SKIPPED;
 
 	trace_mm_compaction_try_to_compact_pages(order, gfp_mask, prio);
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index de9a601..6606990 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -996,7 +996,7 @@
 	if (kill)
 		collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED);
 
-	unmap_success = try_to_unmap(p, ttu, NULL);
+	unmap_success = try_to_unmap(hpage, ttu, NULL);
 	if (!unmap_success)
 		pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n",
 		       pfn, page_mapcount(p));
diff --git a/mm/memory.c b/mm/memory.c
index 4d292cd..eac98dc 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4528,6 +4528,10 @@
 		goto out;
 	pte = *ptep;
 
+	/* Never return PFNs of anon folios in COW mappings. */
+	if (vm_normal_page(vma, address, pte))
+		goto unlock;
+
 	if ((flags & FOLL_WRITE) && !pte_write(pte))
 		goto unlock;
 
diff --git a/mm/memtest.c b/mm/memtest.c
index f53ace7..d407373 100644
--- a/mm/memtest.c
+++ b/mm/memtest.c
@@ -46,10 +46,10 @@
 	last_bad = 0;
 
 	for (p = start; p < end; p++)
-		*p = pattern;
+		WRITE_ONCE(*p, pattern);
 
 	for (p = start; p < end; p++, start_phys_aligned += incr) {
-		if (*p == pattern)
+		if (READ_ONCE(*p) == pattern)
 			continue;
 		if (start_phys_aligned == last_bad + incr) {
 			last_bad += incr;
diff --git a/mm/migrate.c b/mm/migrate.c
index 7709981..568ee82 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -508,8 +508,12 @@
 	if (PageSwapBacked(page)) {
 		__SetPageSwapBacked(newpage);
 		if (PageSwapCache(page)) {
+			int i;
+
 			SetPageSwapCache(newpage);
-			set_page_private(newpage, page_private(page));
+			for (i = 0; i < (1 << compound_order(page)); i++)
+				set_page_private(newpage + i,
+						 page_private(page + i));
 		}
 	} else {
 		VM_BUG_ON_PAGE(PageSwapCache(page), page);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 71cdb7e..6ea571d 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3999,6 +3999,7 @@
 						struct alloc_context *ac)
 {
 	bool can_direct_reclaim = gfp_mask & __GFP_DIRECT_RECLAIM;
+	bool can_compact = gfp_compaction_allowed(gfp_mask);
 	const bool costly_order = order > PAGE_ALLOC_COSTLY_ORDER;
 	struct page *page = NULL;
 	unsigned int alloc_flags;
@@ -4070,7 +4071,7 @@
 	 * Don't try this for allocations that are allowed to ignore
 	 * watermarks, as the ALLOC_NO_WATERMARKS attempt didn't yet happen.
 	 */
-	if (can_direct_reclaim &&
+	if (can_direct_reclaim && can_compact &&
 			(costly_order ||
 			   (order > 0 && ac->migratetype != MIGRATE_MOVABLE))
 			&& !gfp_pfmemalloc_allowed(gfp_mask)) {
@@ -4158,9 +4159,10 @@
 
 	/*
 	 * Do not retry costly high order allocations unless they are
-	 * __GFP_RETRY_MAYFAIL
+	 * __GFP_RETRY_MAYFAIL and we can compact
 	 */
-	if (costly_order && !(gfp_mask & __GFP_RETRY_MAYFAIL))
+	if (costly_order && (!can_compact ||
+			     !(gfp_mask & __GFP_RETRY_MAYFAIL)))
 		goto nopage;
 
 	if (should_reclaim_retry(gfp_mask, order, ac, alloc_flags,
@@ -4173,7 +4175,7 @@
 	 * implementation of the compaction depends on the sufficient amount
 	 * of free memory (see __compaction_suitable)
 	 */
-	if (did_some_progress > 0 &&
+	if (did_some_progress > 0 && can_compact &&
 			should_compact_retry(ac, order, alloc_flags,
 				compact_result, &compact_priority,
 				&compaction_retries))
diff --git a/mm/vmscan.c b/mm/vmscan.c
index e3bd37a..54691a3b 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2826,7 +2826,7 @@
 /* Use reclaim/compaction for costly allocs or under memory pressure */
 static bool in_reclaim_compaction(struct scan_control *sc)
 {
-	if (IS_ENABLED(CONFIG_COMPACTION) && sc->order &&
+	if (gfp_compaction_allowed(sc->gfp_mask) && sc->order &&
 			(sc->order > PAGE_ALLOC_COSTLY_ORDER ||
 			 sc->priority < DEF_PRIORITY - 2))
 		return true;
@@ -3026,6 +3026,9 @@
 	unsigned long watermark;
 	enum compact_result suitable;
 
+	if (!gfp_compaction_allowed(sc->gfp_mask))
+		return false;
+
 	suitable = compaction_suitable(zone, sc->order, 0, sc->reclaim_idx);
 	if (suitable == COMPACT_SUCCESS)
 		/* Allocation should succeed already. Don't reclaim. */
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 815d4fb..8d76721 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -329,7 +329,7 @@
 		return 0;
 
 	list_for_each_entry(vid_info, &vlan_info->vid_list, list) {
-		if (!vlan_hw_filter_capable(by_dev, vid_info->proto))
+		if (!vlan_hw_filter_capable(by_dev, vid_info))
 			continue;
 		err = vlan_vid_add(dev, vid_info->proto, vid_info->vid);
 		if (err)
@@ -341,7 +341,7 @@
 	list_for_each_entry_continue_reverse(vid_info,
 					     &vlan_info->vid_list,
 					     list) {
-		if (!vlan_hw_filter_capable(by_dev, vid_info->proto))
+		if (!vlan_hw_filter_capable(by_dev, vid_info))
 			continue;
 		vlan_vid_del(dev, vid_info->proto, vid_info->vid);
 	}
@@ -363,7 +363,7 @@
 		return;
 
 	list_for_each_entry(vid_info, &vlan_info->vid_list, list) {
-		if (!vlan_hw_filter_capable(by_dev, vid_info->proto))
+		if (!vlan_hw_filter_capable(by_dev, vid_info))
 			continue;
 		vlan_vid_del(dev, vid_info->proto, vid_info->vid);
 	}
diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index 63df63e..b652d1d 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -285,10 +285,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val > hdev->conn_info_max_age)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val == 0 || val > hdev->conn_info_max_age) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->conn_info_min_age = val;
 	hci_dev_unlock(hdev);
 
@@ -313,10 +315,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val < hdev->conn_info_min_age)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val == 0 || val < hdev->conn_info_min_age) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->conn_info_max_age = val;
 	hci_dev_unlock(hdev);
 
@@ -594,10 +598,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val % 2 || val > hdev->sniff_max_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val == 0 || val % 2 || val > hdev->sniff_max_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->sniff_min_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -622,10 +628,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val % 2 || val < hdev->sniff_min_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val == 0 || val % 2 || val < hdev->sniff_min_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->sniff_max_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -914,10 +922,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->le_conn_min_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -942,10 +952,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->le_conn_max_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -1054,10 +1066,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0020 || val > 0x4000 || val > hdev->le_adv_max_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val < 0x0020 || val > 0x4000 || val > hdev->le_adv_max_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->le_adv_min_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -1082,10 +1096,12 @@
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0020 || val > 0x4000 || val < hdev->le_adv_min_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val < 0x0020 || val > 0x4000 || val < hdev->le_adv_min_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->le_adv_max_interval = val;
 	hci_dev_unlock(hdev);
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c6daea8..f012db5 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2190,6 +2190,31 @@
 		if (test_bit(HCI_ENCRYPT, &hdev->flags))
 			set_bit(HCI_CONN_ENCRYPT, &conn->flags);
 
+		/* "Link key request" completed ahead of "connect request" completes */
+		if (ev->encr_mode == 1 && !test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
+		    ev->link_type == ACL_LINK) {
+			struct link_key *key;
+			struct hci_cp_read_enc_key_size cp;
+
+			key = hci_find_link_key(hdev, &ev->bdaddr);
+			if (key) {
+				set_bit(HCI_CONN_ENCRYPT, &conn->flags);
+
+				if (!(hdev->commands[20] & 0x10)) {
+					conn->enc_key_size = HCI_LINK_KEY_SIZE;
+				} else {
+					cp.handle = cpu_to_le16(conn->handle);
+					if (hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE,
+							 sizeof(cp), &cp)) {
+						bt_dev_err(hdev, "sending read key size failed");
+						conn->enc_key_size = HCI_LINK_KEY_SIZE;
+					}
+				}
+
+				hci_encrypt_cfm(conn, ev->status);
+			}
+		}
+
 		/* Get remote features */
 		if (conn->type == ACL_LINK) {
 			struct hci_cp_read_remote_features cp;
diff --git a/net/core/sock.c b/net/core/sock.c
index 8ab2019..044e864 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2929,6 +2929,13 @@
 }
 EXPORT_SYMBOL(sk_stop_timer);
 
+void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer)
+{
+	if (del_timer_sync(timer))
+		__sock_put(sk);
+}
+EXPORT_SYMBOL(sk_stop_timer_sync);
+
 void sock_init_data(struct socket *sock, struct sock *sk)
 {
 	sk_init_common(sk);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 8742775..944962a 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -553,6 +553,20 @@
 }
 EXPORT_SYMBOL(inet_csk_clear_xmit_timers);
 
+void inet_csk_clear_xmit_timers_sync(struct sock *sk)
+{
+	struct inet_connection_sock *icsk = inet_csk(sk);
+
+	/* ongoing timer handlers need to acquire socket lock. */
+	sock_not_owned_by_me(sk);
+
+	icsk->icsk_pending = icsk->icsk_ack.pending = 0;
+
+	sk_stop_timer_sync(sk, &icsk->icsk_retransmit_timer);
+	sk_stop_timer_sync(sk, &icsk->icsk_delack_timer);
+	sk_stop_timer_sync(sk, &sk->sk_timer);
+}
+
 void inet_csk_delete_keepalive_timer(struct sock *sk)
 {
 	sk_stop_timer(sk, &sk->sk_timer);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 14f1d34..21d5355 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2498,6 +2498,8 @@
 	bh_unlock_sock(sk);
 	local_bh_enable();
 	release_sock(sk);
+	if (!sk->sk_net_refcnt)
+		inet_csk_clear_xmit_timers_sync(sk);
 	sock_put(sk);
 }
 EXPORT_SYMBOL(tcp_close);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index d43abeb..8400b64 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -527,19 +527,19 @@
 	if (!w) {
 		/* New dump:
 		 *
-		 * 1. hook callback destructor.
-		 */
-		cb->args[3] = (long)cb->done;
-		cb->done = fib6_dump_done;
-
-		/*
-		 * 2. allocate and initialize walker.
+		 * 1. allocate and initialize walker.
 		 */
 		w = kzalloc(sizeof(*w), GFP_ATOMIC);
 		if (!w)
 			return -ENOMEM;
 		w->func = fib6_dump_node;
 		cb->args[2] = (long)w;
+
+		/* 2. hook callback destructor.
+		 */
+		cb->args[3] = (long)cb->done;
+		cb->done = fib6_dump_done;
+
 	}
 
 	arg.skb = skb;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 05e7400..6ae941f 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1536,15 +1536,14 @@
 		}
 
 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-		    sta->sdata->u.vlan.sta) {
-			ieee80211_clear_fast_rx(sta);
+		    sta->sdata->u.vlan.sta)
 			RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
-		}
 
 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
 			ieee80211_vif_dec_num_mcast(sta->sdata);
 
 		sta->sdata = vlansdata;
+		ieee80211_check_fast_rx(sta);
 		ieee80211_check_fast_xmit(sta);
 
 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 407346b..d5a1b67 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3202,6 +3202,12 @@
 		if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
 			     (NFT_SET_EVAL | NFT_SET_OBJECT))
 			return -EOPNOTSUPP;
+		if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) ==
+			     (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT))
+			return -EOPNOTSUPP;
+		if ((flags & (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) ==
+			     (NFT_SET_CONSTANT | NFT_SET_TIMEOUT))
+			return -EOPNOTSUPP;
 	}
 
 	dtype = 0;
@@ -3242,6 +3248,10 @@
 	if (nla[NFTA_SET_TIMEOUT] != NULL) {
 		if (!(flags & NFT_SET_TIMEOUT))
 			return -EINVAL;
+
+		if (flags & NFT_SET_ANONYMOUS)
+			return -EOPNOTSUPP;
+
 		timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
 						nla[NFTA_SET_TIMEOUT])));
 	}
@@ -3249,6 +3259,10 @@
 	if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
 		if (!(flags & NFT_SET_TIMEOUT))
 			return -EINVAL;
+
+		if (flags & NFT_SET_ANONYMOUS)
+			return -EOPNOTSUPP;
+
 		gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
 	}
 
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 9f1e801..1700c42 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -37,6 +37,14 @@
 		return opt[offset + 1];
 }
 
+static int nft_skb_copy_to_reg(const struct sk_buff *skb, int offset, u32 *dest, unsigned int len)
+{
+	if (len % NFT_REG32_SIZE)
+		dest[len / NFT_REG32_SIZE] = 0;
+
+	return skb_copy_bits(skb, offset, dest, len);
+}
+
 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
 				 struct nft_regs *regs,
 				 const struct nft_pktinfo *pkt)
@@ -58,8 +66,7 @@
 	}
 	offset += priv->offset;
 
-	dest[priv->len / NFT_REG32_SIZE] = 0;
-	if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
+	if (nft_skb_copy_to_reg(pkt->skb, offset, dest, priv->len) < 0)
 		goto err;
 	return;
 err:
@@ -115,7 +122,8 @@
 		if (priv->flags & NFT_EXTHDR_F_PRESENT) {
 			*dest = 1;
 		} else {
-			dest[priv->len / NFT_REG32_SIZE] = 0;
+			if (priv->len % NFT_REG32_SIZE)
+				dest[priv->len / NFT_REG32_SIZE] = 0;
 			memcpy(dest, opt + offset, priv->len);
 		}
 
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 2d9934d..bed8bbc 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -1513,6 +1513,11 @@
 		nfc_send_to_raw_sock(ndev->nfc_dev, skb,
 				     RAW_PAYLOAD_NCI, NFC_DIRECTION_RX);
 
+		if (!nci_plen(skb->data)) {
+			kfree_skb(skb);
+			break;
+		}
+
 		/* Process frame */
 		switch (nci_mt(skb->data)) {
 		case NCI_MT_RSP_PKT:
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index 20ea9d1..f2b9016 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -203,14 +203,14 @@
 	struct tcf_skbmod *d = to_skbmod(a);
 	unsigned char *b = skb_tail_pointer(skb);
 	struct tcf_skbmod_params  *p = rtnl_dereference(d->skbmod_p);
-	struct tc_skbmod opt = {
-		.index   = d->tcf_index,
-		.refcnt  = d->tcf_refcnt - ref,
-		.bindcnt = d->tcf_bindcnt - bind,
-		.action  = d->tcf_action,
-	};
+	struct tc_skbmod opt;
 	struct tcf_t t;
 
+	memset(&opt, 0, sizeof(opt));
+	opt.index   = d->tcf_index;
+	opt.refcnt  = d->tcf_refcnt - ref,
+	opt.bindcnt = d->tcf_bindcnt - bind;
+	opt.action = d->tcf_action;
 	opt.flags  = p->flags;
 	if (nla_put(skb, TCA_SKBMOD_PARMS, sizeof(opt), &opt))
 		goto nla_put_failure;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index fb3c29b..c5741c9 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1733,6 +1733,9 @@
 	if (xp->xfrm_nr == 0)
 		return 0;
 
+	if (xp->xfrm_nr > XFRM_MAX_DEPTH)
+		return -ENOBUFS;
+
 	for (i = 0; i < xp->xfrm_nr; i++) {
 		struct xfrm_user_tmpl *up = &vec[i];
 		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
index e15cd63..c2e41da 100644
--- a/scripts/Makefile.extrawarn
+++ b/scripts/Makefile.extrawarn
@@ -75,5 +75,7 @@
 KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast)
 KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access)
 KBUILD_CFLAGS += $(call cc-disable-warning, cast-function-type-strict)
+KBUILD_CFLAGS += -Wno-enum-compare-conditional
+KBUILD_CFLAGS += -Wno-enum-enum-conversion
 endif
 endif
diff --git a/scripts/module-lto.lds b/scripts/module-lto.lds
deleted file mode 100644
index d0699ae..0000000
--- a/scripts/module-lto.lds
+++ /dev/null
@@ -1,22 +0,0 @@
-
-SECTIONS {
- /DISCARD/ : {
-  *(.eh_frame)
- }
- .bss : {
-  *(.bss .bss.[0-9a-zA-Z_]*)
-  *(.bss..L*)
- }
- .data : {
-  *(.data .data.[0-9a-zA-Z_]*)
-  *(.data..L*)
- }
- .rodata : {
-  *(.rodata .rodata.[0-9a-zA-Z_]*)
-  *(.rodata..L*)
- }
- .text : ALIGN((1 << 12)) {
-  *(.text.__cfi_check)
-  *(.text .text.[0-9a-zA-Z_]* .text..L.cfi*)
- }
-}
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index a6e81ef..0fec3d1 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1323,7 +1323,8 @@
 		check_star = 1;
 	} else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
 		check_priv = 1;
-		if (size != TRANS_TRUE_SIZE ||
+		if (!S_ISDIR(d_backing_inode(dentry)->i_mode) ||
+		    size != TRANS_TRUE_SIZE ||
 		    strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
 			rc = -EINVAL;
 	} else
@@ -2749,6 +2750,15 @@
 	if (value == NULL || size > SMK_LONGLABEL || size == 0)
 		return -EINVAL;
 
+	if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) {
+		if (!S_ISDIR(inode->i_mode) || size != TRANS_TRUE_SIZE ||
+		    strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
+			return -EINVAL;
+
+		nsp->smk_flags |= SMK_INODE_TRANSMUTE;
+		return 0;
+	}
+
 	skp = smk_import_entry(value, size);
 	if (IS_ERR(skp))
 		return PTR_ERR(skp);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 9942735..0f65515 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6746,7 +6746,7 @@
 	SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
 	SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
-	SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
+	SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
 	SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
@@ -7909,8 +7909,7 @@
 
 	snd_hda_gen_hp_automute(codec, jack);
 	vref = spec->gen.hp_jack_present ? (PIN_HP | AC_PINCTL_VREF_100) : PIN_HP;
-	snd_hda_codec_write(codec, 0x1b, 0, AC_VERB_SET_PIN_WIDGET_CONTROL,
-			    vref);
+	snd_hda_set_pin_ctl(codec, 0x1b, vref);
 }
 
 static void alc897_fixup_lenovo_headset_mic(struct hda_codec *codec,
@@ -7920,6 +7919,9 @@
 	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
 		spec->gen.hp_automute_hook = alc897_hp_automute_hook;
 	}
+	if (action == HDA_FIXUP_ACT_PROBE) {
+		snd_hda_set_pin_ctl_cache(codec, 0x1a, PIN_IN | AC_PINCTL_VREF_100);
+	}
 }
 
 static void alc897_fixup_lenovo_headset_mode(struct hda_codec *codec,
diff --git a/sound/sh/aica.c b/sound/sh/aica.c
index d9acf55..3df531b 100644
--- a/sound/sh/aica.c
+++ b/sound/sh/aica.c
@@ -295,18 +295,21 @@
 		dreamcastcard->clicks++;
 		if (unlikely(dreamcastcard->clicks >= AICA_PERIOD_NUMBER))
 			dreamcastcard->clicks %= AICA_PERIOD_NUMBER;
-		mod_timer(&dreamcastcard->timer, jiffies + 1);
+		if (snd_pcm_running(dreamcastcard->substream))
+			mod_timer(&dreamcastcard->timer, jiffies + 1);
 	}
 }
 
-static void aica_period_elapsed(unsigned long timer_var)
+static void aica_period_elapsed(struct timer_list *t)
 {
+	struct snd_card_aica *dreamcastcard = from_timer(dreamcastcard,
+							      t, timer);
+	struct snd_pcm_substream *substream = dreamcastcard->substream;
 	/*timer function - so cannot sleep */
 	int play_period;
 	struct snd_pcm_runtime *runtime;
-	struct snd_pcm_substream *substream;
-	struct snd_card_aica *dreamcastcard;
-	substream = (struct snd_pcm_substream *) timer_var;
+	if (!snd_pcm_running(substream))
+		return;
 	runtime = substream->runtime;
 	dreamcastcard = substream->pcm->private_data;
 	/* Have we played out an additional period? */
@@ -335,13 +338,6 @@
 	dreamcastcard = substream->pcm->private_data;
 	/*get the queue to do the work */
 	schedule_work(&(dreamcastcard->spu_dma_work));
-	/* Timer may already be running */
-	if (unlikely(dreamcastcard->timer.data)) {
-		mod_timer(&dreamcastcard->timer, jiffies + 4);
-		return;
-	}
-	setup_timer(&dreamcastcard->timer, aica_period_elapsed,
-		    (unsigned long) substream);
 	mod_timer(&dreamcastcard->timer, jiffies + 4);
 }
 
@@ -374,13 +370,20 @@
 	return 0;
 }
 
+static int snd_aicapcm_pcm_sync_stop(struct snd_pcm_substream *substream)
+{
+	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;
+
+	del_timer_sync(&dreamcastcard->timer);
+	cancel_work_sync(&dreamcastcard->spu_dma_work);
+	return 0;
+}
+
 static int snd_aicapcm_pcm_close(struct snd_pcm_substream
 				 *substream)
 {
 	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;
-	flush_work(&(dreamcastcard->spu_dma_work));
-	if (dreamcastcard->timer.data)
-		del_timer(&dreamcastcard->timer);
+	dreamcastcard->substream = NULL;
 	kfree(dreamcastcard->channel);
 	spu_disable();
 	return 0;
@@ -445,6 +448,7 @@
 	.prepare = snd_aicapcm_pcm_prepare,
 	.trigger = snd_aicapcm_pcm_trigger,
 	.pointer = snd_aicapcm_pcm_pointer,
+	.sync_stop = snd_aicapcm_pcm_sync_stop,
 };
 
 /* TO DO: set up to handle more than one pcm instance */
@@ -600,7 +604,7 @@
 {
 	int err;
 	struct snd_card_aica *dreamcastcard;
-	dreamcastcard = kmalloc(sizeof(struct snd_card_aica), GFP_KERNEL);
+	dreamcastcard = kzalloc(sizeof(struct snd_card_aica), GFP_KERNEL);
 	if (unlikely(!dreamcastcard))
 		return -ENOMEM;
 	err = snd_card_new(&devptr->dev, index, SND_AICA_DRIVER,
@@ -615,12 +619,11 @@
 	       "Yamaha AICA Super Intelligent Sound Processor for SEGA Dreamcast");
 	/* Prepare to use the queue */
 	INIT_WORK(&(dreamcastcard->spu_dma_work), run_spu_dma);
+	timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0);
 	/* Load the PCM 'chip' */
 	err = snd_aicapcmchip(dreamcastcard, 0);
 	if (unlikely(err < 0))
 		goto freedreamcast;
-	dreamcastcard->timer.data = 0;
-	dreamcastcard->channel = NULL;
 	/* Add basic controls */
 	err = add_aicamixer_controls(dreamcastcard);
 	if (unlikely(err < 0))
diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
index f8d4907..1388067 100644
--- a/sound/soc/soc-ops.c
+++ b/sound/soc/soc-ops.c
@@ -257,7 +257,7 @@
 	int max = mc->max;
 	int min = mc->min;
 	int sign_bit = mc->sign_bit;
-	unsigned int mask = (1 << fls(max)) - 1;
+	unsigned int mask = (1ULL << fls(max)) - 1;
 	unsigned int invert = mc->invert;
 	int val;
 	int ret;
diff --git a/tools/iio/iio_utils.c b/tools/iio/iio_utils.c
index d174487..1ef51c7 100644
--- a/tools/iio/iio_utils.c
+++ b/tools/iio/iio_utils.c
@@ -376,7 +376,7 @@
 		goto error_close_dir;
 	}
 
-	seekdir(dp, 0);
+	rewinddir(dp);
 	while (ent = readdir(dp), ent) {
 		if (strcmp(ent->d_name + strlen(ent->d_name) - strlen("_en"),
 			   "_en") == 0) {
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
index 2aba622..470d03e 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -1112,6 +1112,7 @@
 	retval = fscanf(fp, "%d\n", &pkg);
 	if (retval != 1)
 		errx(1, "%s: failed to parse", pathname);
+	fclose(fp);
 	return pkg;
 }
 
diff --git a/tools/testing/selftests/net/reuseaddr_conflict.c b/tools/testing/selftests/net/reuseaddr_conflict.c
index 7c5b126..bfb07dc 100644
--- a/tools/testing/selftests/net/reuseaddr_conflict.c
+++ b/tools/testing/selftests/net/reuseaddr_conflict.c
@@ -109,6 +109,6 @@
 	fd1 = open_port(0, 1);
 	if (fd1 >= 0)
 		error(1, 0, "Was allowed to create an ipv4 reuseport on an already bound non-reuseport socket with no ipv6");
-	fprintf(stderr, "Success");
+	fprintf(stderr, "Success\n");
 	return 0;
 }
diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
index 57bcb27..cb839d0 100644
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -110,7 +110,27 @@
 		swake_up(&vcpu->wq);
 
 	mmput(mm);
-	kvm_put_kvm(vcpu->kvm);
+}
+
+static void kvm_flush_and_free_async_pf_work(struct kvm_async_pf *work)
+{
+	/*
+	 * The async #PF is "done", but KVM must wait for the work item itself,
+	 * i.e. async_pf_execute(), to run to completion.  If KVM is a module,
+	 * KVM must ensure *no* code owned by the KVM (the module) can be run
+	 * after the last call to module_put().  Note, flushing the work item
+	 * is always required when the item is taken off the completion queue.
+	 * E.g. even if the vCPU handles the item in the "normal" path, the VM
+	 * could be terminated before async_pf_execute() completes.
+	 *
+	 * Wake all events skip the queue and go straight done, i.e. don't
+	 * need to be flushed (but sanity check that the work wasn't queued).
+	 */
+	if (work->wakeup_all)
+		WARN_ON_ONCE(work->work.func);
+	else
+		flush_work(&work->work);
+	kmem_cache_free(async_pf_cache, work);
 }
 
 void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)
@@ -137,7 +157,6 @@
 #else
 		if (cancel_work_sync(&work->work)) {
 			mmput(work->mm);
-			kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
 			kmem_cache_free(async_pf_cache, work);
 		}
 #endif
@@ -149,7 +168,10 @@
 			list_first_entry(&vcpu->async_pf.done,
 					 typeof(*work), link);
 		list_del(&work->link);
-		kmem_cache_free(async_pf_cache, work);
+
+		spin_unlock(&vcpu->async_pf.lock);
+		kvm_flush_and_free_async_pf_work(work);
+		spin_lock(&vcpu->async_pf.lock);
 	}
 	spin_unlock(&vcpu->async_pf.lock);
 
@@ -173,7 +195,7 @@
 
 		list_del(&work->queue);
 		vcpu->async_pf.queued--;
-		kmem_cache_free(async_pf_cache, work);
+		kvm_flush_and_free_async_pf_work(work);
 	}
 }
 
@@ -202,7 +224,6 @@
 	work->arch = *arch;
 	work->mm = current->mm;
 	mmget(work->mm);
-	kvm_get_kvm(work->vcpu->kvm);
 
 	/* this can't really happen otherwise gfn_to_pfn_async
 	   would succeed */