Merge branch 'linux-4.14.y' of https://github.com/openela/kernel-lts into android-4.14-phoenix Change-Id: I45723a1f753222efff3c72390659ef62e4dd9fab

commit: 2ebc6e4a761231b2772528c92152dd5ba7f87ecd [log] [tgz]
author: Tim Zimmermann <tim@linux4.de> Thu Mar 14 20:15:33 2024 +0100
committer: Tim Zimmermann <tim@linux4.de> Thu Mar 14 20:21:45 2024 +0100
tree: 02ae02073ce521ab27f82c406b57c79ab7390356
parent: dbb6769ccb7897a3e5f6930da2775e5b2f1a4491 [diff]
parent: b0df11ec78550503645b585157ed1782be8961d7 [diff]
diff --git a/.elts/config.yaml b/.elts/config.yaml
new file mode 100644
index 0000000..18cef06
--- /dev/null
+++ b/.elts/config.yaml

@@ -0,0 +1,5 @@
+upstream_repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+upstream_base: 4.19.304
+base: 4.14.336
+upstream_version: 4.19.307
+version: 4.14.339

diff --git a/.elts/meta/4.14.337.yaml b/.elts/meta/4.14.337.yaml
new file mode 100644
index 0000000..6f23131
--- /dev/null
+++ b/.elts/meta/4.14.337.yaml

@@ -0,0 +1,48 @@
+ced7e0c8ca4be414095ad46b6363eaf8fb227d07:
+  title: 'net/qla3xxx: switch from ''pci_'' to ''dma_'' API'
+  mainline: 41fb4c1ba7478fe34c7e094e124e4ee4513b9763
+  upstream: 4c731d37cdd8bb66e4a6cff0ce69eb6ecf4e7620
+fda9db2ddde56d0a4fa6e08604c5c02ed4656190:
+  title: 'net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues'
+  mainline: 89f45c30172c80e55c887f32f1af8e184124577b
+  upstream: 39437c89a3074b3e869dab2d0e65148923e327a5
+1aa3bd40236223e2a8404b76d65e0e3c31ab91ba:
+  title: 'asix: Add check for usbnet_get_endpoints'
+  mainline: eaac6a2d26b65511e164772bec6918fcbc61938e
+  upstream: 1d267835dadc8cec3bd3da252171bb335f507cd3
+73a7f8a478ab010be26db513967aacc263263b85:
+  title: 'bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()'
+  mainline: e009b2efb7a8850498796b360043ac25c8d3d28f
+  upstream: b39d97468acf9651ff68e44f0e0c7ebac4ecdca7
+ff510bc907debb02a00d5be80c678fb54042eb01:
+  title: 'mm/memory-failure: check the mapcount of the precise page'
+  mainline: c79c5a0a00a9457718056b588f312baadf44e471
+  upstream: c6f50413f2aacc919b5de443aa080b94f5ebb21d
+e5e8870a91aa5d8eeae9dfd3d6ab6cc6932a3f2b:
+  title: 'mm: fix unmap_mapping_range high bits shift bug'
+  mainline: 9eab0421fa94a3dde0d1f7e36ab3294fc306c99d
+  upstream: 2db1c46c3913b8bc92fed235a344de2671fe9d8d
+8d576e5e8705890e3f9f2bd0f5fe0de0832ac61f:
+  title: 'fuse: nlookup missing decrement in fuse_direntplus_link'
+  mainline: b8bd342d50cbf606666488488f9fea374aceb2d5
+  upstream: 437d8898fbf40b92516aef697b5638acccb7a6f9
+24f1cf2efb69d6cc0cb5d50291f9eb4c95e6f29c:
+  title: 'netfilter: nf_tables: Reject tables of unsupported family'
+  mainline: f1082dd31fe461d482d69da2a8eccfeb7bf07ac2
+  upstream: 087d38ae0fd5a9a41b949e97601b4b0d09336f19
+895547de81e54a04152a30c1dc1de41be55245e5:
+  title: 'net: add a route cache full diagnostic message'
+  mainline: 22c2ad616b74f3de2256b242572ab449d031d941
+  upstream: 47468fae2704151503214f4d4327c164118247fd
+2ee1663e55e8977ff4e86354691f47a45ab20acc:
+  title: 'net/dst: use a smaller percpu_counter batch for dst entries accounting'
+  mainline: cf86a086a18095e33e0637cb78cda1fcf5280852
+  upstream: 9635bd0a5296e2e725c6b33e530d0ef582e2f64e
+e0411760af63f47a43cf1971cd2328ec449645cf:
+  title: 'ipv6: make ip6_rt_gc_expire an atomic_t'
+  mainline: 9cb7c013420f98fa6fd12fc6a5dc055170c108db
+  upstream: b4cfbeaebeb355dbaefb218470055de2e8a73020
+12cda1d5779e05665140a7e8fc88297e4ef9b418:
+  title: 'ipv6: remove max_size check inline with ipv4'
+  mainline: af6d10345ca76670c1b7c37799f0d5576ccef277
+  upstream: 95372b040ae689293c6863b90049f1af68410c8b

diff --git a/.elts/meta/4.14.338.yaml b/.elts/meta/4.14.338.yaml
new file mode 100644
index 0000000..22677c7
--- /dev/null
+++ b/.elts/meta/4.14.338.yaml

@@ -0,0 +1,492 @@
+634e7f82e8c70e7f17de0b0c48fd13f35e569043:
+  title: 'f2fs: explicitly null-terminate the xattr list'
+  mainline: e26b6d39270f5eab0087453d9b544189a38c8564
+  upstream: 16ae3132ff7746894894927c1892493693b89135
+0e4e1621037f71e6ce79cc4f1c0d76150de207a4:
+  title: 'ASoC: cs43130: Fix the position of const qualifier'
+  mainline: e7f289a59e76a5890a57bc27b198f69f175f75d9
+  upstream: f35d77a3c58a9be14531185ff47c3f0d867382ad
+92937c54dad3773d96442d1e36bec981fb8d2c7d:
+  title: 'ASoC: cs43130: Fix incorrect frame delay configuration'
+  mainline: aa7e8e5e4011571022dc06e4d7a2f108feb53d1a
+  upstream: 1e8f3203c494cd382088eb64defed2d116a99c65
+e0d5e7495b1562301f7d8afcfb109125d4e39e3e:
+  title: 'ASoC: rt5650: add mutex to avoid the jack detection failure'
+  mainline: cdba4301adda7c60a2064bf808e48fccd352aaa9
+  upstream: 48ce529c83522944f116f03884819051f44f0fb6
+b2007da41920e3e1506bcae0ea5d67d82deaa1b4:
+  title: 'net/tg3: fix race condition in tg3_reset_task()'
+  mainline: 16b55b1f2269962fb6b5154b8bf43f37c9a96637
+  upstream: dc52503ad3ca93f3bc200b259f8ac56cef05a488
+6a04e427ce1ced4962a1cb607c3beae5639787f9:
+  title: 'ASoC: da7219: Support low DC impedance headset'
+  mainline: 5f44de697383fcc9a9a1a78f99e09d1838704b90
+  upstream: 5324775cab629021225667b4fe0fe9b28cb4b200
+dee75f1cda40e535bb660f6c342ec1a7c3b4b3e1:
+  title: 'drm/exynos: fix a potential error pointer dereference'
+  mainline: 73bf1c9ae6c054c53b8e84452c5e46f86dd28246
+  upstream: edfa0e9b334c3e88953297073835dfa576e1d564
+fd2a03c0a010e92c62e5a242c8d1ef86cbe5e6b9:
+  title: 'clk: rockchip: rk3128: Fix HCLK_OTG gate register'
+  mainline: c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2
+  upstream: 9e35336aecd6b82ed29c30d057bd07795ca9876f
+9111572de29071a25887bc3ceb20ca794815fca5:
+  title: 'jbd2: correct the printing of write_flags in jbd2_write_superblock()'
+  mainline: 85559227211020b270728104c3b89918f7af27ac
+  upstream: 1574191683ca491a382eb120475df573b8a69efe
+ebbce42e84a5b6dd1c08203b22f947e12b5838c5:
+  title: 'drm/crtc: Fix uninit-value bug in drm_mode_setcrtc'
+  mainline: 3823119b9c2b5f9e9b760336f75bc989b805cde6
+  upstream: 3df929b0b60fd82c58ba5b807bc9bdc77d1550c6
+1e00941f86357671797d8cdaf7a9f96a74e9ee3b:
+  title: 'tracing: Have large events show up as ''[LINE TOO BIG]'' instead of nothing'
+  mainline: b55b0a0d7c4aa2dac3579aa7e6802d1f57445096
+  upstream: fcd96231c7d79c5c03ac2fc73345e552caf7d7b5
+f4848e88a912d30601968682a2cf7483637b1477:
+  title: 'tracing: Add size check when printing trace_marker output'
+  mainline: 60be76eeabb3d83858cc6577fc65c7d0f36ffd42
+  upstream: 9a9d6a726688a0ed9fb16458d6918e51aadce9b5
+76ea9993683668623fbe34e433e64b176941ad11:
+  title: 'ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI'
+  mainline: 712292308af2265cd9b126aedfa987f10f452a33
+  upstream: 70887567dd96c2f5b46d853b603de30ea22741a2
+92125c979c109cf2e1c5747b6967e2ea9f82b2bc:
+  title: 'reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning'
+  mainline: b5ec294472794ed9ecba0cb4b8208372842e7e0d
+  upstream: 8155a089c4a5d9afe6506463537944492b9b2839
+f56eab3175dcce9f9a198db019a2460d37bd8e65:
+  title: 'Input: atkbd - skip ATKBD_CMD_GETID in translated mode'
+  mainline: 936e4d49ecbc8c404790504386e1422b599dec39
+  upstream: eb59410d1cca3f1223b65e7562dc0d9acae26b39
+83363b85a42a78939fead3717f1e5e9c2d088400:
+  title: 's390/scm: fix virtual vs physical address confusion'
+  mainline: b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c
+  upstream: e695700535c286e4f4f5a7c19e36ff6d61a25a4a
+2fe8f0179e36aab4ec1b75016b1d014476d69c04:
+  title: 'ARC: fix spare error'
+  mainline: aca02d933f63ba8bc84258bf35f9ffaf6b664336
+  upstream: c536440b603111f5fcafa36050d2481f29f23e92
+b2c25c249b8c3bc24dc867b5a0bcd88171eca56b:
+  title: 'Input: xpad - add Razer Wolverine V2 support'
+  mainline: c3d1610345b79cbe29ef6ca04a4780eff0d360c7
+  upstream: 01a92b3c981219d22f16bdc612e9a2afa515a5dd
+de80986229942606e6c9f0f2d27b0a9697c8ad3a:
+  title: 'drm/crtc: fix uninitialized variable use'
+  mainline: 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf
+  upstream: c39fa3fb4a7d22b915dfd86fc7e94bfeb03def3e
+40db091e8d96c76059905bd7398ee00f2eb8c042:
+  title: 'binder: fix comment on binder_alloc_new_buf() return value'
+  mainline: e1090371e02b601cbfcea175c2a6cc7c955fa830
+  upstream: 10cfdc51c399890e535ccc16ed3f58b7c5e8f93e
+572879a25b2217fba182dc8504abc783af98217e:
+  title: 'uio: Fix use-after-free in uio_open'
+  mainline: 0c9ae0b8605078eafc3bea053cc78791e97ba2e2
+  upstream: 3174e0f7de1ba392dc191625da83df02d695b60c
+4de569f9413900bfb66722ef06849c6dd08ec042:
+  title: 'coresight: etm4x: Fix width of CCITMIN field'
+  mainline: cc0271a339cc70cae914c3ec20edc2a8058407da
+  upstream: d3408053bdfcb5992fe7ff01627a96e4293ffd21
+08c21102abea6d209abc265063459da3d4ee4750:
+  title: 'x86/lib: Fix overflow when counting digits'
+  mainline: a24d61c609813963aacc9f6ec8343f4fcaac7243
+  upstream: cd6382e261952a7c2f1b8326bb9c11b074168d6c
+34d8bcffbe7c87b98ba9697a0a2b0c82e76ad325:
+  title: 'EDAC/thunderx: Fix possible out-of-bounds string access'
+  mainline: 475c58e1a471e9b873e3e39958c64a2d278275c8
+  upstream: 71c17ee02538802ceafc830f0736aa35b564e601
+4e40d13cc6bf0a594558125658cd54d7938c0160:
+  title: 'powerpc: add crtsavres.o to always-y instead of extra-y'
+  mainline: 1b1e38002648819c04773647d5242990e2824264
+  upstream: b7b85ec5ec15d5a3bc72ee1af35919caa91de9cb
+a62184e669bcf638ece2811aea8549cff21f1ee6:
+  title: 'powerpc: remove redundant ''default n'' from Kconfig-s'
+  mainline: 719736e1cc12b2fc28eba2122893a449eee66d08
+  upstream: de07ea70ce6f257b8647895b98f4ddc4fee764b0
+a75255720ea11b327ceaeaea9cd998bf76f0443c:
+  title: 'powerpc/44x: select I2C for CURRITUCK'
+  mainline: 4a74197b65e69c46fe6e53f7df2f4d6ce9ffe012
+  upstream: cce02fde090c5a828fd487c84433d8abcc36c14e
+4476a80ea1038fb3b93f62b209d0b71657e5669c:
+  title: 'powerpc/pseries/memhotplug: Quieten some DLPAR operations'
+  mainline: 20e9de85edae3a5866f29b6cce87c9ec66d62a1b
+  upstream: fddcaa763b053c5c983907ed6c1a4a141e54f060
+0fe15f7b9cb118f8e1f1e0fbf54a29f812b15605:
+  title: 'powerpc/pseries/memhp: Fix access beyond end of drmem array'
+  mainline: bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5
+  upstream: bb79613a9a704469ddb8d6c6029d532a5cea384c
+5007064eca0329d3b10635e6e79682ffee1a7ecf:
+  title: 'selftests/powerpc: Fix error handling in FPU/VMX preemption tests'
+  mainline: 9dbd5927408c4a0707de73ae9dd9306b184e8fee
+  upstream: ee23d012aea27e6ae6408803c4dd4a7b228667a0
+78080fd925adc07e20d346105ae760ebe0565764:
+  title: 'powerpc/powernv: Add a null pointer check in opal_event_init()'
+  mainline: 8649829a1dd25199bbf557b2621cedb4bf9b3050
+  upstream: 8422d179cf46889c15ceff9ede48c5bfa4e7f0b4
+228d1909628f30b8d08476e5d95cc42299106eca:
+  title: 'powerpc/imc-pmu: Add a null pointer check in update_events_in_group()'
+  mainline: 0a233867a39078ebb0f575e2948593bbff5826b3
+  upstream: 75fc599bcdcb1de093c9ced2e3cccc832f3787f3
+e18751caa633cdd72d12c0cc18b0ff031164ba8b:
+  title: 'mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response'
+  mainline: 923fb6238cb3ac529aa2bf13b3b1e53762186a8b
+  upstream: 238f46e6bbe689fb70d3933ffc2b9b7b0caf38b9
+607acc13f86bf0acb33fef6aa25b3d5a02964566:
+  title: 'ACPI: video: check for error while searching for backlight device parent'
+  mainline: ccd45faf4973746c4f30ea41eec864e5cf191099
+  upstream: 556f02699d33c1f40b1b31bd25828ce08fa165d8
+96a4f056a48e452dd59358613be23937b3fa60e1:
+  title: 'net: netlabel: Fix kerneldoc warnings'
+  mainline: 294ea29113104487a905d0f81c00dfd64121b3d9
+  upstream: d717dc44f3ae18cb8524c6fd727836efe53ec8ad
+c3eb5ab095b46e82564541f4b5bfcc28786a9aec:
+  title: 'netlabel: remove unused parameter in netlbl_netlink_auditinfo()'
+  mainline: f7e0318a314f9271b0f0cdd4bfdc691976976d8c
+  upstream: eb9743bdb23da4136fe3a39b61f3c2fa7f8276d8
+1456753483efd25769fdac097c4d4cf3c0deb949:
+  title: 'calipso: fix memory leak in netlbl_calipso_add_pass()'
+  mainline: ec4e9d630a64df500641892f4e259e8149594a99
+  upstream: 9a8f811a146aa2a0230f8edb2e9f4b6609aab8da
+27f0c87acc3e816ba6f969888334c8c72f491b25:
+  title: 'mtd: Fix gluebi NULL pointer dereference caused by ftl notifier'
+  mainline: a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6
+  upstream: aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022
+bd4fe044189e5e33e38f681a7eba5e862160e3f7:
+  title: 'crypto: virtio - Handle dataq logic with tasklet'
+  mainline: fed93fb62e05c38152b0fc1dc9609639e63eed76
+  upstream: 96be18c8fff9d57e29621386e2fa17268383ea27
+3d1343b49d7b745740609c97bbd1459fb05a2db8:
+  title: 'crypto: ccp - fix memleak in ccp_init_dm_workarea'
+  mainline: a1c95dd5bc1d6a5d7a75a376c2107421b7d6240d
+  upstream: 063f6c37b06c115b1d8336d5dac7ea4f7c9ffe53
+1371d1aac1d6b88b0aff31013be162b0caf13d26:
+  title: 'crypto: af_alg - Disallow multiple in-flight AIO requests'
+  mainline: 67b164a871af1d736f131fd6fe78a610909f06f3
+  upstream: 19af0310c8767c993f2a5d5261e4df3f9f465ce1
+cb2e4d4c3197d8f2ab3e295bee5273bdb0f50bd3:
+  title: 'crypto: sahara - remove FLAGS_NEW_KEY logic'
+  mainline: 8fd183435728b139248a77978ea3732039341779
+  upstream: 6ccb0052254f97e5f4c4b98befdb15de7efcde8d
+726ac2c4fa83c53364a57d7479b0ac42f9057aa6:
+  title: 'crypto: sahara - fix ahash selftest failure'
+  mainline: afffcf3db98b9495114b79d5381f8cc3f69476fb
+  upstream: 9c241bed6d321355b41dce62e2c527fc1788c403
+e7d1a334957ed6f85ff14bc20124a0f7472c656e:
+  title: 'crypto: sahara - fix processing requests with cryptlen < sg->length'
+  mainline: 5b8668ce3452827d27f8c34ff6ba080a8f983ed0
+  upstream: 6aff781a57751247c3bc51dce2a3038ca0d31c36
+e4adbef4abb98a739765ed95a33453bf10f7c1c8:
+  title: 'crypto: sahara - fix error handling in sahara_hw_descriptor_create()'
+  mainline: ee6e6f0a7f5b39d50a5ef5fcc006f4f693db18a7
+  upstream: 71ba0d44a741640a962d4a6092afc84e976379bc
+6e45fa30b4b1a531d8867ee85baec327dd6602d6:
+  title: 'pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()'
+  mainline: 86222a8fc16ec517de8da2604d904c9df3a08e5d
+  upstream: 3b333cded94fbe5ce30d699b316c4715151268ae
+120738293f95e68c8eca2ab81c768b7f45389929:
+  title: 'crypto: virtio - Wait for tasklet to complete on device remove'
+  mainline: 67cc511e8d436456cc98033e6d4ba83ebfc8e672
+  upstream: 9cef719eefbc3956016f701cc026d7eb9834ffcb
+e62a797c5d8d58f318c17ec81c0ecbc6dec2f6f0:
+  title: 'crypto: sahara - fix ahash reqsize'
+  mainline: efcb50f41740ac55e6ccc4986c1a7740e21c62b4
+  upstream: dff90a1b4c980b6ddf4ec6cb5167eb08e5026e82
+49816cb9a0a59fd5293841ec0fb43cd795882133:
+  title: 'crypto: sahara - fix wait_for_completion_timeout() error handling'
+  mainline: 2dba8e1d1a7957dcbe7888846268538847b471d1
+  upstream: 882eba76746aa86d3295112fbb140829bd1145db
+3f01b32b887839e9884e6c73137383647578d491:
+  title: 'crypto: sahara - improve error handling in sahara_sha_process()'
+  mainline: 5deff027fca49a1eb3b20359333cf2ae562a2343
+  upstream: 4532bf0aaedae56a9a0313f6a8e19f1536a076ae
+81a7245bbae96e94e99775f9ed7816c56d44ec62:
+  title: 'crypto: sahara - fix processing hash requests with req->nbytes < sg->length'
+  mainline: 7bafa74d1ba35dcc173e1ce915e983d65905f77e
+  upstream: 8bb4be72f74b13d51e5e460441b97618252ce481
+ab2940679b406a2cd07178e5e0178cf9a6546e39:
+  title: 'crypto: sahara - do not resize req->src when doing hash operations'
+  mainline: a3c6f4f4d249cecaf2f34471aadbfb4f4ef57298
+  upstream: 28076a1a44407a15442589780b1d06579504adc3
+fb0e9e3f0e7837698efe7070fc875db673901c05:
+  title: 'crypto: scompress - return proper error code for allocation failure'
+  mainline: 6a4d1b18ef00a7b182740b7b4d8a0fcd317368f8
+  upstream: 1915874d67287ba1ab71825ae6a4efbb2a0e2b11
+8b5ecff755cbfa45a1215921bf4e5782547f2f0b:
+  title: 'crypto: scompress - Use per-CPU struct instead multiple variables'
+  mainline: 71052dcf4be70be4077817297dcde7b155e745f2
+  upstream: f8f261f9ade28894f5b547d1ec2a905308990f28
+17c8b716fd42226a901eeb0dfb1ff00347e9f588:
+  title: 'crypto: scomp - fix req->dst buffer overflow'
+  mainline: 744e1885922a9943458954cfea917b31064b4131
+  upstream: 1142d65c5b881590962ad763f94505b6dd67d2fe
+72daedd6e82587cc8988ddea958dea2838b01cb4:
+  title: 'NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT'
+  mainline: 037e56a22ff37f9a9c2330b66cff55d3d1ff9b90
+  upstream: 1b297c8879954e09b1b8fbdd77a58f01fc4618a1
+26459b2b58fa2eba9f12275d7e2d8d1dc9794677:
+  title: 'bpf, lpm: Fix check prefixlen before walking trie'
+  mainline: 9b75dbeb36fcd9fc7ed51d370310d0518a387769
+  upstream: 1b653d866e0fe86e424fe4b8fa743d716eee71b6
+bd06c9590761e3ff8827d9a1c8581625be0b9c79:
+  title: 'wifi: libertas: stop selecting wext'
+  mainline: 8170b04c2c92eee52ea50b96db4c54662197e512
+  upstream: a4087ece661fe2d4f95c2625a0b7d5dd0080229b
+fdf6985a539e1435a5ef7b4de9cf15a2c1c8406d:
+  title: 'ncsi: internal.h: Fix a spello'
+  mainline: 195a8ec4033b4124f6864892e71dcef24ba74a5a
+  upstream: 3cb8ac9da29fac5ee4e6813f2c3e12690ee84a98
+05fd39a024db3af5ea78291dcf24af261e8a68d1:
+  title: 'net/ncsi: Fix netlink major/minor version numbers'
+  mainline: 3084b58bfd0b9e4b5e034f31f31b42977db35f12
+  upstream: 80a3ca0918eed409291a816fbed6b44678d01641
+c2b0d1feb5b926fc9ba0c386454570de69dde649:
+  title: 'firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()'
+  mainline: 964946b88887089f447a9b6a28c39ee97dc76360
+  upstream: fbdc266ebf438e711ebd48d9b1370e30f4e31096
+897f298f90efb10cf81393cd7e0190b37c2ebbc9:
+  title: 'rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift'
+  mainline: 6c1d61913570d4255548ac598cfbef6f1e3c3eee
+  upstream: a9386c2f247611bfad7510b64eb2932e2c555a5a
+bd03ed76b048543b7401018196dc0526caa00ec9:
+  title: 'wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior'
+  mainline: bc8263083af60e7e57c6120edbc1f75d6c909a35
+  upstream: 6b08b1e6d85f67f5782a49daf4725dc281ed9be7
+88d5a3786e5cb6a10065d7e26c250bb8c848a2a2:
+  title: 'wifi: rtlwifi: add calculate_bit_shift()'
+  mainline: 52221dfddbbfb5b4e029bb2efe9bb7da33ec1e46
+  upstream: 09ceb7f1710717628488f5686cc083314c693e54
+2128cf6809ee76d13a74481b5985e30ec5485a45:
+  title: 'wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()'
+  mainline: 969bc926f04b438676768aeffffffb050e480b62
+  upstream: ad3d745248c04faa6e60abb9d2dee9555faa470c
+e393571a6bd85fd5ffec367d11483d52b0c80718:
+  title: 'wifi: rtlwifi: rtl8192c: using calculate_bit_shift()'
+  mainline: 1dedc3a6699d827d345019e921b8d8f37f694333
+  upstream: 29e2ecd3fdeb952696f9267d49257e93dca32321
+4d6a0f73aba3e60b208083788b48f92c13608888:
+  title: 'wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()'
+  mainline: f4088c8fcbabadad9dd17d17ae9ba24e9e3221ec
+  upstream: 1d5fd854141a1a073381f3356109ebba8709b4c6
+60ca01685d4eb09fd2705165e9def96b64dc7da5:
+  title: 'wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()'
+  mainline: 3d03e8231031bcc65a48cd88ef9c71b6524ce70b
+  upstream: 8f79e8a983010ac6e31e2ce6bde6d00e2c9a4e4e
+915183b8e7402ad215ba4a3d7b034ca1b25bd70f:
+  title: 'rtlwifi: rtl8192de: make arrays static const, makes object smaller'
+  mainline: b05897ca8c821a16ac03850c4704fe460b3f21a0
+  upstream: 86cd6555b79b22b64bf49a031bc056c4d4c447bd
+08b7dd75bc7b17d784e8e765225d24d7158f5aeb:
+  title: 'wifi: rtlwifi: rtl8192de: using calculate_bit_shift()'
+  mainline: b8b2baad2e652042cf8b6339939ac2f4e6f53de4
+  upstream: 9f1500e8c3a50be139e87d71394d5109e46e3dad
+3ab28359e0eb80b57a58893db84412b5e85d7777:
+  title: 'wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()'
+  mainline: 63526897fc0d086069bcab67c3a112caaec751cb
+  upstream: 6642a375aa95f4344ab1fc7332f2d45c20ea2d63
+a25a56719d96f567cb73dba6bddc2f4b5e7ef420:
+  title: 'wifi: rtlwifi: rtl8192se: using calculate_bit_shift()'
+  mainline: ac32b9317063b101a8ff3d3e885f76f87a280419
+  upstream: 9e50da7d71796c662bb39dada2d3ca44c2bf2362
+6ba5a14ad6f87a7d610a96c08cf1100b11583c7e:
+  title: 'Bluetooth: Fix bogus check for re-auth no supported with non-ssp'
+  mainline: d03376c185926098cb4d668d6458801eb785c0a5
+  upstream: f7f627ac761b2fb0c487e5aaff1585f1014ab9a6
+6d5e17b3543373963fda337744203edf8e4f5c40:
+  title: 'ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()'
+  mainline: d375b98e0248980681e5e56b712026174d617198
+  upstream: 135414f300c5db995e2a2f3bf0f455de9d014aee
+8f07604e4630933aeb436be46c38b7240725a2eb:
+  title: 'RDMA/usnic: Silence uninitialized symbol smatch warnings'
+  mainline: b9a85e5eec126d6ae6c362f94b447c223e8fe6e4
+  upstream: ef87ffe5e8093ea540803811b1496238d778069c
+faf2ca73bc2b927d4ba2f830d57de1662ce77852:
+  title: 'media: pvrusb2: fix use after free on context disconnection'
+  mainline: ded85b0c0edd8f45fec88783d7555a5b982449c1
+  upstream: ec36c134dd020d28e312c2f1766f85525e747aab
+27d74baf1b5b0f7fe7659b1359c29efdf1915982:
+  title: 'drm/bridge: Fix typo in post_disable() description'
+  mainline: 288b039db225676e0c520c981a1b5a2562d893a3
+  upstream: d1992dd1ba7a9b4353cc2c673233be297c8d5c96
+bbf60e5c55914a70605910a108192c9eaf502907:
+  title: 'f2fs: fix to avoid dirent corruption'
+  mainline: 53edb549565f55ccd0bdf43be3d66ce4c2d48b28
+  upstream: 02160112e6d45c2610b049df6eb693d7a2e57b46
+2a37830abde108247bac114a185b5661ad69eb82:
+  title: 'drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()'
+  mainline: 39c960bbf9d9ea862398759e75736cfb68c3446f
+  upstream: f55536f3377690f9e1b8f7fba5d19e371b73d20f
+c465f32956eead2b3a38259c31d0e811d2b96f40:
+  title: 'drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()'
+  mainline: b5c5baa458faa5430c445acd9a17481274d77ccf
+  upstream: 98d47b927d85a4151d048a41b950d92e1b01e88f
+31655ae29f5b0ad9fc6bf1b0d79032bb7f08dbae:
+  title: 'drm/radeon: check return value of radeon_ring_lock()'
+  mainline: 71225e1c930942cb1e042fc08c5cc0c4ef30e95e
+  upstream: 4d8d372eb7e865053b954f04ee34eeb1fed1da39
+5eeba65918540f2e0cd6b8c09ffafd49436ecf0a:
+  title: 'ASoC: cs35l33: Fix GPIO name and drop legacy include'
+  mainline: 50678d339d670a92658e5538ebee30447c88ccb3
+  upstream: c03156a046ae69f1abc2d93b57d6f410729d2c84
+ec3ed7b8f8f728621c66e1e29b6b281b3a76ed39:
+  title: 'ASoC: cs35l34: Fix GPIO name and drop legacy include'
+  mainline: a6122b0b4211d132934ef99e7b737910e6d54d2f
+  upstream: b02d4b488da9830762611dd07d206fd49cfd72cb
+6af25088ade37074893cb9dbb9d515e4807739d6:
+  title: 'drm/msm/mdp4: flush vblank event on disable'
+  mainline: c6721b3c6423d8a348ae885a0f4c85e14f9bf85c
+  upstream: f7133b078dbe8e5973d5b569b9fd58b5ff068f2c
+d25d4a3bbb225f6f6a5e13396b33d8f51d736d10:
+  title: 'drm/drv: propagate errors from drm_modeset_register_all()'
+  mainline: 5f8dec200923a76dc57187965fd59c1136f5d085
+  upstream: f6f65dac6c1b18f3a4fff214f80e08f92f873fed
+b7e655dc8c70d3267aabf18fef0214a17fd10403:
+  title: 'drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()'
+  mainline: 7a2464fac80d42f6f8819fed97a553e9c2f43310
+  upstream: 21b1645660717d6126dd4866c850fcc5c4703a41
+e7d18b4f0386f969ea7962389c04afeb3ff6feb1:
+  title: 'drm/radeon/dpm: fix a memleak in sumo_parse_power_table'
+  mainline: 0737df9ed0997f5b8addd6e2b9699a8c6edba2e4
+  upstream: a8b530d665fb6a0af23f94f7cca175a2122b3ed2
+1bfe8303ba10f5bedc81d22675d4449e16ca0cba:
+  title: 'drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table'
+  mainline: 28c28d7f77c06ac2c0b8f9c82bc04eba22912b3b
+  upstream: afb2be8f4279799aee6f2451287bd6f594b2e1cd
+1755d5eb6e59ad98a24166819c2495a376aa42ae:
+  title: 'media: cx231xx: fix a memleak in cx231xx_init_isoc'
+  mainline: 5d3c8990e2bbf929cb211563dadd70708f42e4e6
+  upstream: 68d7d5923f8a2f03193b27297252d0e7cc7045fc
+d4030a0f227463e56c947b32329c9921f6540e71:
+  title: 'media: dvbdev: drop refcount on error path in dvb_device_open()'
+  mainline: a2dd235df435a05d389240be748909ada91201d2
+  upstream: 782a58a14de9f6551dc0e82c19e0caa6f7cc419c
+792d62725c643e5f7638ea7b515c99a14c8e3737:
+  title: 'drm/amd/pm: fix a double-free in si_dpm_init'
+  mainline: ac16667237a82e2597e329eb9bc520d1cf9dff30
+  upstream: afe9f5b871f86d58ecdc45b217b662227d7890d0
+a6e7ea708763a4cbe3d71042c9d3f3c595f379d7:
+  title: 'drivers/amd/pm: fix a use-after-free in kv_parse_power_table'
+  mainline: 28dd788382c43b330480f57cd34cde0840896743
+  upstream: 8a27d9d9fc9b5564b8904c3a77a7dea482bfa34e
+99afdfa5464efb18504ec34b1770ea1a3f45cde9:
+  title: 'gpu/drm/radeon: fix two memleaks in radeon_vm_init'
+  mainline: c2709b2d6a537ca0fa0f1da36fdaf07e48ef447d
+  upstream: aa2bcb8cddd990e37a0c750a04a8bc3fbc1e0710
+5b38ec02c46daabc1e4c2437a97b01ced82fc186:
+  title: 'watchdog: set cdev owner before adding'
+  mainline: 38d75297745f04206db9c29bdd75557f0344c7cc
+  upstream: c0a529ab2af0bbe06dc278655d2ad67725ee04bc
+070a50e21971a395ea35e22ba5145c90bf6aca7b:
+  title: 'watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling'
+  mainline: f33f5b1fd1be5f5106d16f831309648cb0f1c31d
+  upstream: 3f30085bd96cbb0a6d9a7c70989d6fcae7b9b651
+d0bbd4afe43cd08a408c737ad9d3d826deeb09ea:
+  title: 'binder: fix async space check for 0-sized buffers'
+  mainline: 3091c21d3e9322428691ce0b7a0cfa9c0b239eeb
+  upstream: 05088b886fea59cc827e5b5cedb66165cf532f72
+8f95561662745f6212e830179c4dcf3e8f90e232:
+  title: 'Input: atkbd - use ab83 as id when skipping the getid command'
+  mainline: 58f65f9db7e0de366a5a115c2e2c0703858bba69
+  upstream: 6c42ba1fc7d39b1d72c1adc43ea2e519f5450b3c
+98b497bbb72b5c745556a05985241d55ecf93df6:
+  title: 'xen-netback: don''t produce zero-size SKB frags'
+  mainline: c7ec4f2d684e17d69bbdd7c4324db0ef5daac26a
+  upstream: 5bb8270789c88c0e4ad78c0de2f274f2275c7f6c
+553b9fbf5d0dc52038c1845033e0d0919cdc72ec:
+  title: 'binder: fix race between mmput() and do_exit()'
+  mainline: 9a9ab0d963621d9d12199df9817e66982582d5a5
+  upstream: 95b1d336b0642198b56836b89908d07b9a0c9608
+09f65d968ecc015e036d03f6edc697ed6d317855:
+  title: 'binder: fix unused alloc->free_async_space'
+  mainline: c6d05e0762ab276102246d24affd1e116a46aa0c
+  upstream: e2425a67b5ed67496959d0dfb99816f5757164b0
+e3ff741c08a574f4a541ca15781a76c8faacc15a:
+  title: 'tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug'
+  mainline: 71fee48fb772ac4f6cfa63dbebc5629de8b4cc09
+  upstream: 98654bc44cfe00f1dfc8caf48079c504c473fdc3
+848d134a5b0b0139ae89155936f6f0009f418aac:
+  title: 'usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()'
+  mainline: ff2b89de471da942a4d853443688113a44fd35ed
+  upstream: 21ee23b1b0c36b032eb44f3492151e924832f33d
+3b3fc47ec4e2ab45ad6193fa5f768af07a3aed39:
+  title: 'usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart'
+  mainline: e9d40b215e38480fd94c66b06d79045717a59e9c
+  upstream: 35efd8f23709cda8cf17cdf607645c1e92362150
+f2860da15f7c3d6fbb7d7736bc6f9e5401328661:
+  title: 'usb: chipidea: wait controller resume finished for wakeup irq'
+  mainline: 128d849074d05545becf86e713715ce7676fc074
+  upstream: 744c753fe43a01c4ba74441f3367ce56e7c24dbb
+f68f3eb091d0f045aa79a6101593eb8d81eaeea5:
+  title: 'usb: mon: Fix atomicity violation in mon_bin_vma_fault'
+  mainline: 2dd23cc4d0e6aa55cf9fb3b05f2f4165b01de81c
+  upstream: c9fe83c03d64e60e3bdf4ec118dd391ced800125
+af21cdde8b15d3432699c214e0970ddac152f539:
+  title: 'ALSA: oxygen: Fix right channel of capture volume mixer'
+  mainline: a03cfad512ac24a35184d7d87ec0d5489e1cb763
+  upstream: 2d412772b60b435611f2bdf9ae66d284b1e4581c
+e9dc3538ec3195a260e630bb807dcd1c59141b3c:
+  title: 'fbdev: flush deferred work in fb_deferred_io_fsync()'
+  mainline: 15e4c1f462279b4e128f27de48133e0debe9e0df
+  upstream: 14b84d9a230b69084dc967a2e837e8f77f16e239
+72900b18da7e387b139b435d58968f2fbf1922df:
+  title: 'wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code'
+  mainline: b3943b3c2971444364e03224cfc828c5789deada
+  upstream: fef91b68a7a1ce6fe250c823f9eac0a8a4b86d67
+e68bf9e612fc65950931a48e191d5bbdf3321db8:
+  title: 'wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors'
+  mainline: 5894d0089cbc146063dcc0239a78ede0a8142efb
+  upstream: a0aa5c8bacad6f5a6f5cd0aeba459b54f4f01c0f
+d1a47b4a12ca2b93fda76fea730b12b677ad2cf1:
+  title: 'wifi: mwifiex: configure BSSID consistently when starting AP'
+  mainline: f0dd488e11e71ac095df7638d892209c629d9af2
+  upstream: 99f3aa8c515deb19b25056a2e9f589ba43098260
+5ce237ebadbd8ba81f08f349159a0e7d14aaa853:
+  title: 'HID: wacom: Correct behavior when processing some confidence == false touches'
+  mainline: 502296030ec6b0329e00f9fb15018e170cc63037
+  upstream: 9fb6c2fd168add72754c8633e9d857f109d26c79
+e890afc067e68597bca534724a9c034c406a679d:
+  title: 'MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()'
+  mainline: 89c4b588d11e9acf01d604de4b0c715884f59213
+  upstream: c6d7d05b5180b508b589c37820aafa76698f9c2c
+e46223e9fa8f7dc8beb87d13cab9117150e4c7d0:
+  title: 'MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()'
+  mainline: 3c1e5abcda64bed0c7bffa65af2316995f269a61
+  upstream: 8e16eb8d75597a2bc1747e4fe4bd48cd219e0c08
+9f63fb12c2ed40fbec3472326ccaa66f842f895e:
+  title: 'apparmor: avoid crash when parsed profile name is empty'
+  mainline: 55a8210c9e7d21ff2644809699765796d4bfb200
+  upstream: 9286ee97aa4803d99185768735011d0d65827c9e
+2690f9764726feaa9616353bf3c44689d5743c88:
+  title: 'serial: imx: Correct clock error message in function probe()'
+  mainline: 3e189470cad27d41a3a9dc02649f965b7ed1c90f
+  upstream: e6e09a88789b818f970ab9eba427dee23f82f007
+df281fb15750e6711a272493cfe73b175e74ff7f:
+  title: 'net: ravb: Fix dma_addr_t truncation in error case'
+  mainline: e327b2372bc0f18c30433ac40be07741b59231c5
+  upstream: 83fabba372ea78f9d0caaf15fe0b10b1704d84e0
+4dcf29c0ff8acca60293aee99bc256e4f5215fe1:
+  title: 'ipvs: avoid stat macros calls from preemptible context'
+  mainline: d6938c1c76c64f42363d0d1f051e1b4641c2ad40
+  upstream: 614235859d46cae23af6120f48bca9c4250a5392
+dd39912acd0b28dec249a9466db430d2b32f53c7:
+  title: 'kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ'
+  mainline: ad99b5105c0823ff02126497f4366e6a8009453e
+  upstream: b06507c19c19199534c14e73a85c3a2c1cef0a36
+5b7a52eb9c1d0dfa92d90e668646565c6293904f:
+  title: 'kdb: Fix a potential buffer overflow in kdb_local()'
+  mainline: 4f41d30cd6dc865c3cbc1a852372321eba6d4e4c
+  upstream: e7c31af67b6c8afa5e917520a61bc0d79d86db68
+fcbf91b1a3630d288b639ac39b1ab10529ea1c4e:
+  title: 'i2c: s3c24xx: fix read transfers in polling mode'
+  mainline: 0d9cf23ed55d7ba3ab26d617a3ae507863674c8f
+  upstream: 47028cccbd01b6f540b0ab289c37dc0b8b46c561
+ce27684d192649d7048f579ebf7d641095503f72:
+  title: 'i2c: s3c24xx: fix transferring more than one message in polling mode'
+  mainline: 990489e1042c6c5d6bccf56deca68f8dbeed8180
+  upstream: 0646c260c4b4b827b3e73ebe146cd06a4c11b09d
+1b29cdadfd7b1c8199fb02f4308cf4ae3dd166b7:
+  title: 'Revert "NFSD: Fix possible sleep during nfsd4_release_lockowner()"'
+  mainline: ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b
+  upstream: 10d75984495f7fe62152c3b0dbfa3f0a6b739c9b
+be892379d02565cc7ee9c36a4efce9e19f2bf349:
+  title: 'crypto: scompress - initialize per-CPU variables on each CPU'
+  mainline: 8c3fffe3993b06dd1955a79bd2f0f3b143d259b3
+  upstream: a132ff91717c28498c602e62824f0684a02c8832

diff --git a/.elts/meta/4.14.339.yaml b/.elts/meta/4.14.339.yaml
new file mode 100644
index 0000000..e0b618f
--- /dev/null
+++ b/.elts/meta/4.14.339.yaml

@@ -0,0 +1,681 @@
+7641f759ca67017f4c30a592499e57880eaff71f:
+  title: 'PCI: mediatek: Clear interrupt status before dispatching handler'
+  mainline: 4e11c29873a8a296a20f99b3e03095e65ebf897d
+  upstream: fd110f42e3679af082c427b7a2eeb942d5af470f
+efb9a9043e383cc61ee11c500879b095c0ac69b4:
+  title: 'include/linux/units.h: add helpers for kelvin to/from Celsius conversion'
+  mainline: 23331e4893614deb555c65cdf115c8a28ed32471
+  upstream: cde2b87517dcf1e2aa887ad8a327b022e663dcea
+7fa3ad8fce867983af62f56e43a3a2e9d3b6b3ed:
+  title: 'units: Add Watt units'
+  mainline: 2ee5f8f05949735fa2f4c463a5e13fcb3660c719
+  upstream: 0e7f574162e2f15f4b63f9892906f6a9afe4429f
+c87d7d3960d2b5393160f7cff6d2044bb092f3aa:
+  title: 'units: change from ''L'' to ''UL'''
+  mainline: c9221919a2d2df5741ab074dfec5bdfc6f1e043b
+  upstream: 08333e4c4f3ffe6f9d916cc111d9f3429a6aa6c2
+a86917709d63eed8549377e273ed49aaf6f0fe85:
+  title: 'units: add the HZ macros'
+  mainline: e2c77032fcbe515194107994d12cd72ddb77b022
+  upstream: fe79b37c6a59c623c9e64e53d5d9a0fffcfe977f
+43f2c1d0c3164fa36be2176c14471487612cc7d4:
+  title: 'serial: sc16is7xx: set safe default SPI clock frequency'
+  mainline: 3ef79cd1412236d884ab0c46b4d1921380807b48
+  upstream: 5733959d6770324020e30dd9313cbeac0aec07ef
+baa039a424b919c35e14d292209e6eb1c75a56ae:
+  title: 'driver core: add device probe log helper'
+  mainline: a787e5400a1ceeb0ef92d71ec43aeb35b1fa1334
+  upstream: b0465a4897047ece1e4275fefc88a66ee41c5379
+5691ddf6d4ceb137c3411a02d3c1e8ec04dd63f3:
+  title: 'spi: introduce SPI_MODE_X_MASK macro'
+  mainline: 029b42d8519cef70c4fb5fcaccd08f1053ed2bf0
+  upstream: 93d63ccd20b55ae704d2c89664375e6f98552ee6
+6b48b4b203794e7f13aa0f97451bad4acbae2cae:
+  title: 'serial: sc16is7xx: add check for unsupported SPI modes during probe'
+  mainline: 6d710b769c1f5f0d55c9ad9bb49b7dce009ec103
+  upstream: cccdd04643a7d21d0ca5d8205b15ec0ea1be1c6b
+545e2955bf5596fac2adf3a7857fa459c544c148:
+  title: 'crypto: api - Disallow identical driver names'
+  mainline: 27016f75f5ed47e2d8e0ca75a8ff1f40bc1a5e27
+  upstream: 15a67115d487ea5cb8213915a4f75f58adb87cbc
+ea24848bab92c13dbf6ab1b2174f9d036487d253:
+  title: 'PM: hibernate: Enforce ordering during image compression/decompression'
+  mainline: 71cd7e80cfde548959952eac7063aeaea1f2e1c6
+  upstream: 489506a2a0cbbfc7065d4d18ec6bb9baa3818c62
+581445afd04cac92963d8b56b3eea08b320d6330:
+  title: 'hwrng: core - Fix page fault dead lock on mmap-ed hwrng'
+  mainline: 78aafb3884f6bc6636efcc1760c891c8500b9922
+  upstream: eafd83b92f6c044007a3591cbd476bcf90455990
+669cd9318ec5d236f24973f8ca3faad5f31d4b6d:
+  title: 'rpmsg: virtio: Free driver_override when rpmsg_remove()'
+  mainline: d5362c37e1f8a40096452fc201c30e705750e687
+  upstream: 229ce47cbfdc7d3a9415eb676abbfb77d676cb08
+ea4d137035293e76e164c462a2fedfb4287924cf:
+  title: 'parisc/firmware: Fix F-extend for PDC addresses'
+  mainline: 735ae74f73e55c191d48689bd11ff4a06ea0508f
+  upstream: 63cc5eb9b4102474423c4d6563fdf2ebbedf437f
+c0ec35dc112eab077896d9f5b4c0a290b778c38a:
+  title: 'block: Remove special-casing of compound pages'
+  mainline: 1b151e2435fc3a9b10c8946c6aebe9f3e1938c55
+  upstream: d2d0b95ca1b5fefa3deed444a803c9f809db66cf
+3b71309c662f680a1cd0175c3324e87d75464c5f:
+  title: 'powerpc: Use always instead of always-y in for crtsavres.o'
+f3497ef9602db8907ed48225b0bd62a8c24dac6f:
+  title: 'x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum'
+72a6d97e54e06db480e8cdbdab3cd0110295251b:
+  title: 'driver core: Annotate dev_err_probe() with __must_check'
+  mainline: e1f82a0dcf388d98bcc7ad195c03bd812405e6b2
+  upstream: d31978bfec1d251a75d4a038e564ef2ff9d8be40
+8a65f3d70ff92f689506357203bfa8fef42ed031:
+  title: 'Revert "driver core: Annotate dev_err_probe() with __must_check"'
+  mainline: f601e8f37c2c1c52f2923fffc48204a7f7dc023d
+  upstream: b715d543d42e8e4ddd645193410cd4511fc46d6c
+4fa22d4f07a2ab952ca8005d816b1eb7b4ae7bb8:
+  title: 'driver code: print symbolic error code'
+  mainline: 693a8e936590f93451e6f5a3d748616f5a59c80b
+  upstream: cf07cb793264fd3c459918dda7e839d6a279493c
+7fa4477471e885e41d5272987d399084f8a90d72:
+  title: 'drivers: core: fix kernel-doc markup for dev_err_probe()'
+  mainline: 074b3aad307de6126fbac1fff4996d1034b48fee
+  upstream: 4d61ff79b439fe9cd5eaa3363a25853f230e2026
+b2d336bd83e5129931108606348fe6d64b2ea95d:
+  title: 'vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING'
+  mainline: 6c21660fe221a15c789dee2bc2fd95516bc5aeaf
+  upstream: 91759822dd336c20f817e6fd59cccee3952599f7
+f99b9736c1b4642c7694718ff2e559060e102460:
+  title: 'llc: make llc_ui_sendmsg() more robust against bonding changes'
+  mainline: dad555c816a50c6a6a8a86be1f9177673918c647
+  upstream: 84e9d10419f6f4f3f3cd8f9aaf44a48719aa4b1b
+dc5870e21f3001b3ec8576e6f54031a8cba164f5:
+  title: 'llc: Drop support for ETH_P_TR_802_2.'
+  mainline: e3f9bed9bee261e3347131764e42aeedf1ffea61
+  upstream: 165ad1e22779685c3ed3dd349c6c4c632309cc62
+e5ac391f7644fa947a50c342ea44829eaecddedd:
+  title: 'net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv'
+  mainline: 13e788deb7348cc88df34bed736c3b3b9927ea52
+  upstream: 344350bfa3b4b37d7c3d5a00536e6fbf0e953fbf
+6a3e1d9862f94de4bee1e33e16f05038f5389a2b:
+  title: 'tcp: Add memory barrier to tcp_push()'
+  mainline: 7267e8dcad6b2f9fce05a6a06335d7040acbc2b6
+  upstream: 52c46caf283bfa3016a5e41363df93c02037f788
+ef58e1caae5c94a09529c65681dad1fd4e8fb0ee:
+  title: 'netlink: fix potential sleeping issue in mqueue_flush_file'
+  mainline: 234ec0b6034b16869d45128b8cd2dc6ffe596f04
+  upstream: d53a2b227d0fd0ca1404cddec607d32154a7259f
+43a2aef972f44aa2b326fa198bdf8dfabb943956:
+  title: 'net/mlx5: Use kfree(ft->g) in arfs_create_groups()'
+  mainline: 360000b26e37a75b3000bf0585b263809d96ffd3
+  upstream: af3bf8e9a72fbd173e06b688039c3f6fbde45315
+c68c6c612420fbc4d139aae2815f9cb4b4477ee0:
+  title: 'net/mlx5e: fix a double-free in arfs_create_groups'
+  mainline: 3c6d5189246f590e4e1f167991558bdb72a4738b
+  upstream: e3d3ed8c152971dbe64c92c9ecb98fdb52abb629
+aa81ef3caf4be77e37974492532e649a2fcb19f8:
+  title: 'netfilter: nf_tables: restrict anonymous set and map names to 16 bytes'
+  mainline: b462579b2b86a8f5230543cadd3a4836be27baf7
+  upstream: de19690509d3fe9374922b36bb5f2de25d76f75c
+c655c5bcecd961e52b149f6ca3931ccb3fea68c4:
+  title: 'fjes: fix memleaks in fjes_hw_setup'
+  mainline: f6cc4b6a3ae53df425771000e9c9540cce9b7bb1
+  upstream: 3dfd95c03c387368f519339499b27e2de5aeb998
+6fa5ff53b288d8a31412cbf775292e5355d2aa62:
+  title: 'net: fec: fix the unhandled context fault from smmu'
+  mainline: 5e344807735023cd3a67c37a1852b849caa42620
+  upstream: ba33e0ab29dab25e63b1e2d0c8200798729bb759
+762a825fada9668d550eddd794000c7f2caccdfa:
+  title: 'btrfs: don''t warn if discard range is not aligned to sector'
+  mainline: a208b3f132b48e1f94f620024e66fea635925877
+  upstream: e50c68c5202041af6e5e8f6917f9b9bb8dcadbcc
+7b51f7d4004c09506c8b18d952ac742f27a3ef61:
+  title: 'btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args'
+  mainline: 173431b274a9a54fc10b273b46e67f46bcf62d2e
+  upstream: f084057282bc5f45e5f50a4b226244a30666422d
+0d987a601a2677d5d2632e82dcaa3fd47eda8d5e:
+  title: 'netfilter: nf_tables: reject QUEUE/DROP verdict parameters'
+  mainline: f342de4e2f33e0e39165d8639387aa6c19dff660
+  upstream: 8365e9d92b85fda975a5ece7a3a139cb964018c8
+64ae55163661acf809649c0635c6b21e5d028ae6:
+  title: 'gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04'
+  mainline: 805c74eac8cb306dc69b87b6b066ab4da77ceaf1
+  upstream: c8bd34e256d33bf1ccce1540fbfe3e4dbd3d2c8e
+c8c5f7898fcca7d74c44b655d176277efb9fea24:
+  title: 'drm: Don''t unref the same fb many times by mistake due to deadlock handling'
+  mainline: cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c
+  upstream: 376e21a9e4c2c63ee5d8d3aa74be5082c3882229
+c08fbf9dc1f387f205d5bcc50e015e63b4c9e0a4:
+  title: 'drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking'
+  mainline: 914437992876838662c968cb416f832110fb1093
+  upstream: 80cb196c51aaf67c29f7fc59ae8d5d77f13d650b
+a763a5bff50097dc988f3ac6a4e39aba8cfa1c1c:
+  title: 'drm/bridge: nxp-ptn3460: simplify some error checking'
+  mainline: 28d3d0696688154cc04983f343011d07bf0508e4
+  upstream: 245c7e59073add7c4bec107a7abb5f473fbb6762
+33922b26c79b28d52cdd80634cef19adfc8af24d:
+  title: 'mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan'
+  mainline: 59be5c35850171e307ca5d3d703ee9ff4096b948
+  upstream: 4f5ce9429566979ea623f6f3b897d0d1bebd6b46
+fd36c0072c50e2198c71ffcdf773f3a80efb4d86:
+  title: 'tick/sched: Preserve number of idle sleeps across CPU hotplug events'
+  mainline: 9a574ea9069be30b835a3da772c039993c43369b
+  upstream: 7c0fdf4485c7bb02a1c7d7a4a68c3686d6ac5d53
+3acd7d14ab042ec3180ad82f70f02c1640d70c0b:
+  title: 'powerpc/mm: Fix null-pointer dereference in pgtable_cache_add'
+  mainline: f46c8a75263f97bda13c739ba1c90aced0d3b071
+  upstream: 21e45a7b08d7cd98d6a53c5fc5111879f2d96611
+985b459da1516795390094540cd97bbea8263903:
+  title: 'powerpc: Fix build error due to is_valid_bugaddr()'
+  mainline: f8d3555355653848082c351fa90775214fb8a4fa
+  upstream: 8dc842cd56b541d8f82daa2dd0d178add07ed384
+74b8b0d494bf916399a7d32153e2234299bce7cb:
+  title: 'powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()'
+  mainline: d8c3f243d4db24675b653f0568bb65dae34e6455
+  upstream: d30f1f01acd2a4bcd819c346770ec0344b325bc1
+20d558564e788fe68498849aafc685f7beeaa85d:
+  title: 'powerpc/lib: Validate size for vector operations'
+  mainline: 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59
+  upstream: 42084a428a139f1a429f597d44621e3a18f3e414
+309b71479dd509d167afbf01830396412b280494:
+  title: 'audit: Send netlink ACK before setting connection in auditd_set'
+  mainline: 022732e3d846e197539712e51ecada90ded0572a
+  upstream: ee56b48a402f37f239cb0ab94ae0a2fa7dd31eb9
+15378f86c8f6fd91b5c159500e13bd46a3b15a7e:
+  title: 'ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop'
+  mainline: 143176a46bdd3bfbe9ba2462bf94458e80d65ebf
+  upstream: a4d8109395c1ab519ac9b421cc4ebe95cb75b64d
+6137fbdcc97d6e46ab81b911e0dd963423c9ac64:
+  title: 'PNP: ACPI: fix fortify warning'
+  mainline: ba3f5058db437d919f8468db50483dd9028ff688
+  upstream: 1f850064aeccaaa45a62285df4c227dcd90c852c
+93c7bcddd0ab070061059a25c7c776ad0a7c6e19:
+  title: 'ACPI: extlog: fix NULL pointer dereference check'
+  mainline: 72d9b9747e78979510e9aafdd32eb99c7aa30dd1
+  upstream: b7b33627be0626b16ca321b982d6a2261ef7f703
+dffbd4f7153e15063036c40c39c6f4162cdaacce:
+  title: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
+  mainline: 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68
+  upstream: e3e95c6850661c77e6dab079d9b5374a618ebb15
+b55d66744550c1de80b8e7d070f3d0ea112102da:
+  title: 'UBSAN: array-index-out-of-bounds in dtSplitRoot'
+  mainline: 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16
+  upstream: e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af
+83cbf9397419353ed0c7db735f115cd919f226a3:
+  title: 'jfs: fix slab-out-of-bounds Read in dtSearch'
+  mainline: fa5492ee89463a7590a1449358002ff7ef63529f
+  upstream: ce8bc22e948634a5c0a3fa58a179177d0e3f3950
+90cde898a4c41373b7c416d69815e9d7896b347a:
+  title: 'jfs: fix array-index-out-of-bounds in dbAdjTree'
+  mainline: 74ecdda68242b174920fe7c6133a856fb7d8559b
+  upstream: 3d3898b4d72c677d47fe3cb554449f2df5c12555
+364aa896131c66f247c842cce51c85f1cdcfe45f:
+  title: 'jfs: fix uaf in jfs_evict_inode'
+  mainline: e0e1958f4c365e380b17ccb35617345b31ef7bf3
+  upstream: 81b4249ef37297fb17ba102a524039a05c6c5d35
+8bd89028a322d70b0858c38060c0a5b3084d91f5:
+  title: 'pstore/ram: Fix crash when setting number of cpus to an odd number'
+  mainline: d49270a04623ce3c0afddbf3e984cb245aa48e9c
+  upstream: 8b69c30f4e8b69131d92096cb296dc1f217101e4
+96c5817c65966bcdcdec5ff419eb31c42ad9046d:
+  title: 'rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()'
+  mainline: bad1a11c0f061aa073bab785389fe04f19ba02e1
+  upstream: 1ba072b2f552823c3070dde7909f7615b131f956
+7e68d5085eb75299c781f7014ef6947822e30686:
+  title: 'jfs: fix array-index-out-of-bounds in diNewExt'
+  mainline: 49f9637aafa6e63ba686c13cb8549bf5e6920402
+  upstream: f423528488e4f9606cef858eceea210bf1163f41
+4208eff2d2a4e2fdc740c7e74cb1ed97a955d4ee:
+  title: 's390/ptrace: handle setting of fpc register correctly'
+  mainline: 8b13601d19c541158a6e18b278c00ba69ae37829
+  upstream: 6ccf904aac0292e1f6b1a1be6c407c414f7cf713
+1f85aac19a14227a6885559b4b4cdd0dcd175fa1:
+  title: 'KVM: s390: fix setting of fpc register'
+  mainline: b988b1bb0053c0dcd26187d29ef07566a565cf55
+  upstream: 3a04410b0bc7e056e0843ac598825dd359246d18
+3d8aee1169f45a8ea3015adafd87b73f603fbdeb:
+  title: 'SUNRPC: Fix a suspicious RCU usage warning'
+  mainline: 31b62908693c90d4d07db597e685d9f25a120073
+  upstream: fece80a2a6718ed58487ce397285bb1b83a3e54e
+38f20840ac95180eccf512780f7454f85b2bf99e:
+  title: 'ext4: unify the type of flexbg_size to unsigned int'
+  mainline: 658a52344fb139f9531e7543a6e0015b630feb38
+  upstream: 17c04def41743d01067a4c347b2d429f847c28c3
+13df229677abd27615136f5c763c3a476b6ad5fd:
+  title: 'scsi: lpfc: Fix possible file string name overflow when updating firmware'
+  mainline: f5779b529240b715f0e358489ad0ed933bf77c97
+  upstream: 273700c2b94ffe7da97cee356f826d1d3f525b1d
+bb52b4b4fc58efa71970b07a27c918d0250cffa8:
+  title: 'PCI: Add no PM reset quirk for NVIDIA Spectrum devices'
+  mainline: 3ed48c80b28d8dcd584d6ddaf00c75b7673e1a05
+  upstream: 07f181ed637a9867712f6a13f536453125b024ad
+98bddfaba61e706ba3198d9f791cd66bba6103cb:
+  title: 'bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk'
+  mainline: d6b83f1e3707c4d60acfa58afd3515e17e5d5384
+  upstream: 0fee6850e1b0a032580ef2af3c9eb6f68e57d9d0
+0ac0f96f90a5a03d0f2e4ac73257d5874c9aed24:
+  title: 'ARM: dts: imx7s: Fix lcdif compatible'
+  mainline: 5f55da4cc37051cda600ea870ce8cf29f1297715
+  upstream: 27e147bd10bdca40b504644b536561fdb46f42e0
+647e4506427c48a511e3b67b12eef2645bc61301:
+  title: 'ARM: dts: imx7s: Fix nand-controller #size-cells'
+  mainline: 4aadb841ed49bada1415c48c44d21f5b69e01299
+  upstream: b90391b6bfd67d81e6126a4d07bf29da7af36eb4
+d64a7edab1b9eb618164ee97ba6ca2e0c2c39410:
+  title: 'wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()'
+  mainline: 2adc886244dff60f948497b59affb6c6ebb3c348
+  upstream: f44f073c78112ff921a220d01b86d09f2ace59bc
+7474abe2c012625b0cc7f08d5089c1510d92a608:
+  title: 'bpf: Add map and need_defer parameters to .map_fd_put_ptr()'
+  mainline: 20c20bd11a0702ce4dc9300c3da58acf551d9725
+  upstream: 5aa1e7d3f6d0db96c7139677d9e898bbbd6a7dcf
+f3402b957fdf478a6f115e958f514e61c64cb846:
+  title: 'scsi: libfc: Don''t schedule abort twice'
+  mainline: b57c4db5d23b9df0118a25e2441c9288edd73710
+  upstream: debaf1600843a98fe794923781d731c2ccf5a1e8
+d49f575f0871d9008dbc471e24bb06afd954e336:
+  title: 'scsi: libfc: Fix up timeout error in fc_fcp_rec_error()'
+  mainline: 53122a49f49796beb2c4a1bb702303b66347e29f
+  upstream: 1cfcd5845f6141ea6580d13fc021fce7de324d3e
+2bcbb1bff89713910536e9aec5f42ce8d106a86b:
+  title: 'ARM: dts: rockchip: fix rk3036 hdmi ports node'
+  mainline: 27ded76ef0fcfcf939914532aae575cf23c221b4
+  upstream: 281c16796d60e713cb86c08e09200d290232c6d3
+131b53e398cd5cdd930d6b5c404953142b0ee046:
+  title: 'ARM: dts: imx25/27-eukrea: Fix RTC node name'
+  mainline: 68c711b882c262e36895547cddea2c2d56ce611d
+  upstream: 26633c330ad956bf3878057f88395a5aae89240f
+7c4c3abbd88ea0d578de393487684dadd026c0f1:
+  title: 'ARM: dts: imx: Use flash@0,0 pattern'
+  mainline: 1e1d7cc478fb16816de09740e3c323c0c188d58f
+  upstream: 9c5dc6b0e2d37b8e718cf3ef66c4a2f771dee20e
+f6bc8318f88aae9883253889f9e36bda8841e891:
+  title: 'ARM: dts: imx27: Fix sram node'
+  mainline: 2fb7b2a2f06bb3f8321cf26c33e4e820c5b238b6
+  upstream: 0ab77b773ebcc5aa5087fdd18deb851a7ed6a3a6
+9fc574b8c1464071d8319710708885ccc0a431b4:
+  title: 'ARM: dts: imx1: Fix sram node'
+  mainline: c248e535973088ba7071ff6f26ab7951143450af
+  upstream: 9d3aeecaac3030a1d95ed0483ecbf16c89e403f0
+a85363dccc0d0d632635e01c29fe341129125f9f:
+  title: 'ARM: dts: imx27-apf27dev: Fix LED name'
+  mainline: dc35e253d032b959d92e12f081db5b00db26ae64
+  upstream: 6296b2c41f0bca9e1308d4d7a85800245b486ad9
+c462fbab07ab0f93ec19d7a6d907685ea1a06d54:
+  title: 'ARM: dts: imx23-sansa: Use preferred i2c-gpios properties'
+  mainline: e3aa1a82fb20ee97597022f6528823a8ab82bde6
+  upstream: cf146a95be04e40b317c38b116b2efd4b043c3dd
+7e7a432ac9ea935be11a15fea46457de63f7e112:
+  title: 'ARM: dts: imx23/28: Fix the DMA controller node name'
+  mainline: 858d83ca4b50bbc8693d95cc94310e6d791fb2e6
+  upstream: 3d8e8afe1de475ab4d9470c6d731a1c0cf29deee
+da94a28d1bdc83ef21d12a68ed91787db4fa3b1e:
+  title: 'md: Whenassemble the array, consult the superblock of the freshest device'
+  mainline: dc1cc22ed58f11d58d8553c5ec5f11cbfc3e3039
+  upstream: 81ca80caa3c5c2e4e5d1da2dca42cc11964c1e9f
+d68481e8bff48e47200f68c0f58b20891791c91d:
+  title: 'wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices'
+  mainline: 4e87ca403e2008b9e182239e1abbf6876a55eb33
+  upstream: 099b8d44c6a0ab899600f6ece6737ce8b527dbc7
+a1351ac1cf686629cd1eb5b7a1065b3683611007:
+  title: 'wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()'
+  mainline: 5c16618bc06a41ad68fd8499a21d35ef57ca06c2
+  upstream: 93aab385375ddd03a83f5b8444c665ee2c2b6d88
+b656f1f1849b925cd68ab74a777a9cc75f8d774a:
+  title: 'wifi: cfg80211: free beacon_ies when overridden from hidden BSS'
+  mainline: 32af9a9e1069e55bc02741fb00ac9d0ca1a2eaef
+  upstream: fc736ef2b3b2e535c2ba46966bd8083365c96a11
+edbe2c53887737af65f496c2265285f74a4768cd:
+  title: 'ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument'
+  mainline: 67c7666fe808c3a7af3cc6f9d0a3dd3acfd26115
+  upstream: bbb3342c6343688fb673d7c6b51cbf8d184565d2
+658d3409acede1f86abdcfa706919570144a0b55:
+  title: 'fast_dput(): handle underflows gracefully'
+  mainline: 504e08cebe1d4e1efe25f915234f646e74a364a8
+  upstream: fabeeafdab5e1239e794b8ce72df02503d0ced83
+4b7f4e14cc08eacfa5ca86eacc05a8271b28d889:
+  title: 'RDMA/IPoIB: Fix error code return in ipoib_mcast_join'
+  mainline: 753fff78f430704548f45eda52d6d55371a52c0f
+  upstream: c6d9287ebe4ed77ea34fa450a5d70f4984824181
+abd23fc2b176740252f577b29693fbae20c1c8f5:
+  title: 'drm/drm_file: fix use of uninitialized variable'
+  mainline: 1d3062fad9c7313fff9970a88e0538a24480ffb8
+  upstream: 803bd61b474d6dbffc8c5418c61e8da586c94450
+99467f7e403930a41f8bea2542279956188c128d:
+  title: 'drm/framebuffer: Fix use of uninitialized variable'
+  mainline: f9af8f0c1dc567a5a6a6318ff324c45d80d4a60f
+  upstream: 081d55ccd15d7edd3786c285866cdd06a28f2c6f
+d6660003336dbf23b039bcb0601dff7a42f14f0d:
+  title: 'drm/mipi-dsi: Fix detach call without attach'
+  mainline: 90d50b8d85834e73536fdccd5aa913b30494fef0
+  upstream: 9eef5de467f413e14c9b145aa41914334c29f8a7
+edc53e8e2a27c8774234a5e3b143fdd6c3136644:
+  title: 'media: stk1160: Fixed high volume of stk1160_dbg messages'
+  mainline: b3695e86d25aafbe175dd51f6aaf6f68d341d590
+  upstream: 3f61c5b5bb53a842d683680c347366b9c431c3b4
+3590c7ea1d2a0882c4e8969300159543fda974aa:
+  title: 'PCI: add INTEL_HDA_ARL to pci_ids.h'
+  mainline: 5ec42bf04d72fd6d0a6855810cc779e0ee31dfd7
+  upstream: a6265345461f1580efd7e38ba6b9506dda987d23
+f5b5ee65a158a23f105ace2085c6beafb450aa89:
+  title: 'ALSA: hda: Add Icelake PCI ID'
+e3d7a6fbda19cd9d3d62c61f0557b2ddcbc86c4f:
+  title: 'ALSA: hda: Intel: add HDA_ARL PCI ID support'
+  mainline: a31014ebad617868c246d3985ff80d891f03711e
+  upstream: fa7eb2295f5fb213b4c5583bd1a3be6fdb682185
+c5e1693a823b9baaba503fd12531f9b7ae802a8d:
+  title: 'drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time'
+  mainline: 16ac5b21b31b439f03cdf44c153c5f5af94fb3eb
+  upstream: 8ab9b22151400c549f40f2390f1d101d80ec089e
+f1a52361385cf56587f45df0e419270b476fb717:
+  title: 'IB/ipoib: Fix mcast list locking'
+  mainline: 4f973e211b3b1c6d36f7c6a19239d258856749f9
+  upstream: 4c8922ae8eb8dcc1e4b7d1059d97a8334288d825
+a113f3ea4415f689541d9452c474ae03fc2e38d4:
+  title: 'media: ddbridge: fix an error code problem in ddb_probe'
+  mainline: 09b4195021be69af1e1936cca995712a6d0f2562
+  upstream: 7fe1190951cf4f45ff602250b29c4665c264b78e
+9b68e07d9da7ee0571e1bdd80bf64f631345fedb:
+  title: 'clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()'
+  mainline: bfbea9e5667cfa9552c3d88f023386f017f6c308
+  upstream: c807df25c33f1365fda042b11085a4861ec6e4f9
+96bc3d1b305d5d5fe2b95d94b86b46a902bd146b:
+  title: 'clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()'
+  mainline: 2fbabea626b6467eb4e6c4cb7a16523da12e43b4
+  upstream: 15b51ad774214f9bd9a969bf4880ebeb4dbd4868
+c33e46a8972e0956bf361ede13f448eaa042181a:
+  title: 'leds: trigger: panic: Don''t register panic notifier if creating the trigger failed'
+  mainline: afacb21834bb02785ddb0c3ec197208803b74faa
+  upstream: 6c0a90374357d7bc3fde5fc096ae996699e4eb22
+d7d0f5e11bb0b6145733eb2cb28b3639388f84f6:
+  title: 'um: Fix naming clash between UML and scheduler'
+  mainline: 541d4e4d435c8b9bfd29f70a1da4a2db97794e0a
+  upstream: 7ad082147c5d4e74b06ee5d9fd992fcdc1bf75bb
+9b93ed7199417436eb33dc11cd20fc5d4964f693:
+  title: 'um: Don''t use vfprintf() for os_info()'
+  mainline: 236f9fe39b02c15fa5530b53e9cca48354394389
+  upstream: e0fe0da96187d485633cdcfe4ae41ca4d15dd412
+a0b367d347123053abb1b97bc22154dab9ae22f3:
+  title: 'um: net: Fix return type of uml_net_start_xmit()'
+  mainline: 7d748f60a4b82b50bf25fad1bd42d33f049f76aa
+  upstream: af95ebc8ed68503602b0490faca91df4a844b223
+7a559ea7d22e2523c0c38d7597c79e8f5c663823:
+  title: 'mfd: ti_am335x_tscadc: Fix TI SoC dependencies'
+  mainline: 284d16c456e5d4b143f375b8ccc4038ab3f4ee0f
+  upstream: bad080a74ac807a1dac93c9db96156a434bb5cb4
+79a5e39dee6e10829a945d9f6a5761bdb46c3803:
+  title: 'PCI: Only override AMD USB controller if required'
+  mainline: e585a37e5061f6d5060517aed1ca4ccb2e56a34c
+  upstream: a17d6ef61d1615851dbf0111ce1e61af4a897804
+2b84420be156e351f2e9d5975ed7679bdda1ff19:
+  title: 'usb: hub: Replace hardcoded quirk value with BIT() macro'
+  mainline: 6666ea93d2c422ebeb8039d11e642552da682070
+  upstream: 2ba7f86b8703af8ace1a011b041c2bd654409e3d
+56552e5cf5d1e10d74d67c2b9a5adc4f258faee5:
+  title: 'libsubcmd: Fix memory leak in uniq()'
+  mainline: ad30469a841b50dbb541df4d6971d891f703c297
+  upstream: 0d143f52174d588228fa73275de701d58b62ea4a
+7f727e04636fa507a472cd48c5b7822fd92fa973:
+  title: "virtio_net: Fix \"\u2018%d\u2019 directive writing between 1 and 11 bytes into a region of size 10\" warnings"
+  mainline: e3fe8d28c67bf6c291e920c6d04fa22afa14e6e4
+  upstream: 7840b2e4ba3e9288df84dac1417102a174c71229
+7da16dee92cf04281c2b9ba054ed1277bdef0745:
+  title: 'ceph: fix deadlock or deadcode of misusing dget()'
+  mainline: b493ad718b1f0357394d2cdecbf00a44a36fa085
+  upstream: eb55ba8aa7fb7aad54f40fbf4d8dcdfdba0bebf6
+f6292d4326aea4ef58ca1b9e0050d4531b09b656:
+  title: 'drm/amdgpu: Release ''adev->pm.fw'' before return in ''amdgpu_device_need_post()'''
+  mainline: 8a44fdd3cf91debbd09b43bd2519ad2b2486ccf4
+  upstream: 616053201f939cb326836316d8afcd1e3d2df18b
+4a8a10a1d1379bb73f929d2ff61c91cd50fa76e1:
+  title: 'wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update'
+  mainline: 1184950e341c11b6f82bc5b59564411d9537ab27
+  upstream: e01d8d01ba197cac99bef2495fbf5640f0bc5a72
+9b0dce0699b0cff330f26757170390e60beecc2f:
+  title: 'scsi: isci: Fix an error code problem in isci_io_request_build()'
+  mainline: 658365c6b0857e6a306436e315a8633937e3af42
+  upstream: 86ca4cb47d8213773044b151e6861784d646ee35
+287b49e9dddc421e7cbcf2ce9ded277dcd7bb385:
+  title: 'net: remove unneeded break'
+  mainline: 7ebb9db011088f9bd357791f49cb7012e66f29e2
+  upstream: b2460d9640b13afd691f35b075d16f7fc179c7cb
+6c59597adc4da77a4c79730b2d0d2f6bb5103f07:
+  title: 'ixgbe: Remove non-inclusive language'
+  mainline: 93b067f154b3edfd3d75a272fd9433bf787e2e1d
+  upstream: aba0ff77fce0db42a45de1dca5d34aa717d5415c
+12a1e3ffea01766734037b0fe1369d278b669d88:
+  title: 'ixgbe: Refactor overtemp event handling'
+  mainline: 6c1b4af8c1b20c70dde01e58381685d6a4a1d2c8
+  upstream: d9ffeffbc43250255f087adb55b1a99cd4fe0c43
+0fad6add2e903cf769f5d922a43c6616fce2d590:
+  title: 'ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()'
+  mainline: bbc404d20d1b46d89b461918bc44587620eda200
+  upstream: b74c5d0d164efc6a9ebd5e880234987e1e8970d1
+e0ffb3925dba851417d00745b2ce9c4b314589c3:
+  title: 'ipv6: Ensure natural alignment of const ipv6 loopback and router addresses'
+  mainline: 60365049ccbacd101654a66ddcb299abfabd4fc5
+  upstream: e6b0f4f7e3b2429d78a54ad5ec705b4119010c32
+86c1617a51a7e041f7b3106e796f5dd4177a53e2:
+  title: 'llc: call sock_orphan() at release time'
+  mainline: aa2b2eb3934859904c287bf5434647ba72e14c1c
+  upstream: 6b950c712a9a05cdda4aea7fcb2848766576c11b
+a0373ec83347192d0bc2f3352c074e8b023c42a5:
+  title: 'netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger'
+  mainline: 259eb32971e9eb24d1777a28d82730659f50fdcb
+  upstream: b0b2937fda85f1eaf885527518993a035cfa13bc
+ddff75cf19625cf745da29f133a12eb35e48de78:
+  title: 'net: Fix one possible memleak in ip_setup_cork'
+  mainline: 9783ccd0f2507cbe3c5ff1cb84bf6ae3a512d17d
+f4e1df41128d009e3eb57658e1304d2f35109b50:
+  title: 'net: ipv4: fix a memleak in ip_setup_cork'
+  mainline: 5dee6d6923458e26966717f2a3eae7d09fc10bf6
+  upstream: 3241813266b623a1153db37f0204cf4225bd6864
+fc4e079263f4dc3afed7beef32f09e11cfdb83ff:
+  title: 'af_unix: fix lockdep positive in sk_diag_dump_icons()'
+  mainline: 4d322dce82a1d44f8c83f0f54f95dd1b8dcf46c9
+  upstream: 875f31aaa67e306098befa5e798a049075910fa7
+17fe0fd15062dc03aedcf4bb6572a4a9592807b6:
+  title: 'net: sysfs: Fix /sys/class/net/<iface> path'
+  mainline: ae3f4b44641dfff969604735a0dcbf931f383285
+  upstream: 3dc7b3ffd5c539124ee8fc42a32a91b5df13717d
+985d3a3dd71c81ab2012fd3b8f0a769c71a19237:
+  title: 'HID: apple: Swap the Fn and Left Control keys on Apple keyboards'
+  mainline: 346338ef00d35bf8338ded171f9abeb9b10b43df
+  upstream: f27e9a72c1079449474ab6b4858bd30ec3d9ec89
+7412effbe212ef6ccdf8e42b1c40364e6c369a17:
+  title: 'HID: apple: Add support for the 2021 Magic Keyboard'
+  mainline: 0cd3be51733febb4f8acb92bcf55b75fe824dd05
+  upstream: adfbe479c1b60c4e97734dfbeeb483fe37a9df71
+e42213c7c7b015e6b41fb27d9b6264309042a750:
+  title: 'HID: apple: Add 2021 magic keyboard FN key mapping'
+  mainline: 531cb56972f2773c941499fcfb639cd5128dfb27
+  upstream: 0802f8e32b0212b3e5f14eb729c96e6d90a47934
+e827391d4767cbb6a25f85d1e17c05799f6f81f6:
+  title: 'bonding: remove print in bond_verify_device_path'
+  mainline: 486058f42a4728053ae69ebbf78e9731d8ce6f8b
+  upstream: 9bb3bf598f4b0f5481dbc585db2d5021304ac1b5
+7f0c76f847575a92100f05495514a3464534d593:
+  title: 'dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV'
+  mainline: a22fe1d6dec7e98535b97249fdc95c2be79120bb
+  upstream: 743259cc178aee41626f5929ed9ea6f63bb0c631
+24288c6c65f514b98d7b1c1feb237b51a56ab054:
+  title: 'phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP'
+  mainline: 7104ba0f1958adb250319e68a15eff89ec4fd36d
+  upstream: 486218c11e8d1c8f515a3bdd70d62203609d4b6b
+56dc4afb9fa67af5b158a6b184216302e793a0b7:
+  title: 'atm: idt77252: fix a memleak in open_card_ubr0'
+  mainline: f3616173bf9be9bf39d131b120d6eea4e6324cb5
+  upstream: bd70b7541b30213829ca7a2d02e428a4449821ff
+2214d04c620940a739fa5a5ce070a3c785aa0cd5:
+  title: 'hwmon: (aspeed-pwm-tacho) mutex for tach reading'
+  mainline: 1168491e7f53581ba7b6014a39a49cfbbb722feb
+  upstream: 52830e218a4d5e38c6a781c7912da777252f8c40
+2ac57567eda95eb1a9c39e819eab709767452dfe:
+  title: 'inet: read sk->sk_family once in inet_recv_error()'
+  mainline: eef00a82c568944f113f2de738156ac591bbd5cd
+  upstream: caa064c3c2394d03e289ebd6b0be5102eb8a5b40
+5a9a22f2873e63cd857c7a6659f3d38484ac2e70:
+  title: 'rxrpc: Fix response to PING RESPONSE ACKs to a dead call'
+  mainline: 6f769f22822aa4124b556339781b04d810f0e038
+  upstream: 16d97ffdca5515fccc7c969b6025d1551e84fe34
+96d352f660e2e222dc1bab6b2c4740237dd3b305:
+  title: 'tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()'
+  mainline: 3871aa01e1a779d866fa9dfdd5a836f342f4eb87
+  upstream: 24ec8f0da93b8a9fba11600be8a90f0d73fb46f1
+de3d17a308ceded0363dffa3b2ee69b9fbfbb6cc:
+  title: 'ppp_async: limit MRU to 64K'
+  mainline: cb88cb53badb8aeb3955ad6ce80b07b598e310b8
+  upstream: 4fdb14ba89faff6e6969a4dffdc8e54235d6e5ed
+a057d02cf808c2c042d13aa9ada37a250fe329f2:
+  title: 'netfilter: nft_compat: reject unused compat flag'
+  mainline: 292781c3c5485ce33bd22b2ef1b2bed709b4d672
+  upstream: 56fb2bf4ab8c91a2e078553497b6c5b2f1dac699
+990506c3102a4016f10a7b705a3f95a2dba0e567:
+  title: 'netfilter: nft_compat: restrict match/target protocol to u16'
+  mainline: d694b754894c93fb4d71a7f3699439dec111decc
+  upstream: 1d769e2dc5444c3ab3010887d7c3cda76a0310e7
+700f4e9ff1bac4b1bc1780bcc9cf5695e4392028:
+  title: 'net/af_iucv: clean up a try_then_request_module()'
+  mainline: 4eb9eda6ba64114d98827e2870e024d5ab7cd35b
+  upstream: 8811188205406ce59c34fabc18e2421b38c03fdd
+6716f2f7d44fa8420f77009a11593525ae9255b2:
+  title: 'USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e'
+  mainline: 129690fb229a20b6e563a77a2c85266acecf20bc
+  upstream: e3cd866fcbeb03b13f6fc7b6133cb542c8484c4a
+39a732c5a779ddbfbc3e662856dfcaa717af4a26:
+  title: 'USB: serial: option: add Fibocom FM101-GL variant'
+  mainline: b4a1f4eaf1d798066affc6ad040f76eb1a16e1c9
+  upstream: 9c83c6116f5dde982e1f33a1b47bde2991ac8ac5
+b30273541bae7aaec17a09c2780e4a4c395edde1:
+  title: 'USB: serial: cp210x: add ID for IMST iM871A-USB'
+  mainline: 12b17b4eb82a41977eb848048137b5908d52845c
+  upstream: 80af54d045296bab4e2fe8704b4b9fc1f533e47b
+eebb66beca62cded341b539533c7c7a91da8ac95:
+  title: 'Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID'
+  mainline: 683cd8259a9b883a51973511f860976db2550a6e
+  upstream: 0be65249b72efb7d6eec6aabbb9901f22b4c9856
+7d25e28ce6dc61080ffcab293998214b86a14b11:
+  title: 'vhost: use kzalloc() instead of kmalloc() followed by memset()'
+  mainline: 4d8df0f5f79f747d75a7d356d9b9ea40a4e4c8a9
+  upstream: 95eab1039625d54d1770665756dd34e9fe926638
+6a49558f890e67f40142f23305b2b6dbffee6931:
+  title: 'btrfs: send: return EOPNOTSUPP on unknown flags'
+  mainline: f884a9f9e59206a2d41f265e7e403f080d10b493
+  upstream: be548d984286e2d58c3135aa0cf1cbafa0cad8a7
+39be5d7e52744cac421786024357c1c3d7570597:
+  title: 'spi: ppc4xx: Drop write-only variable'
+  mainline: b3aa619a8b4706f35cb62f780c14e68796b37f3f
+  upstream: 80a642c11a91fdff66406b52197097d97685e4e1
+679ed29719be8e945287b4e87a641900507fe003:
+  title: 'ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()'
+  mainline: 6ef5d5b92f7117b324efaac72b3db27ae8bb3082
+  upstream: 3dd2d99e2352903d0e0b8769e6c9b8293c7454b2
+dee976568a7a732baea9b4547a3a601896a32ec8:
+  title: 'Documentation: net-sysfs: describe missing statistics'
+  mainline: e528afb72a481977456bb18345d4e7f6b85fa7b1
+  upstream: b908fdcb6bbc07a3314afb386415b616fa01732f
+7a193babedaf498a625c7b82eea463c89589a2a2:
+  title: 'net: sysfs: Fix /sys/class/net/<iface> path for statistics'
+  mainline: 5b3fbd61b9d1f4ed2db95aaf03f9adae0373784d
+  upstream: e7928873d9ac5a6194f0ffc56549d4262af7e568
+c3be0bd42d8b5436b4f4fc9e2261b3d2a4c738e1:
+  title: 'MIPS: Add ''memory'' clobber to csum_ipv6_magic() inline assembler'
+  mainline: d55347bfe4e66dce2e1e7501e5492f4af3e315f8
+  upstream: 54d186fb5128ea95dbacbe350440208220555039
+1260d580ea28af4201a331f13f5fb5b96da08f94:
+  title: 'i40e: Fix waiting for queues of all VSIs to be disabled'
+  mainline: c73729b64bb692186da080602cd13612783f52ac
+  upstream: 04b9c13dc116af8ad88b98d6a96765e0fa4a2b23
+44ec3b6a27b2d303dced9d70ed708cc8d8ed3784:
+  title: 'tracing/trigger: Fix to return error if failed to alloc snapshot'
+  mainline: 0958b33ef5a04ed91f61cef4760ac412080c4e08
+  upstream: bcf4a115a5068f3331fafb8c176c1af0da3d8b19
+deb218b8416f96a7cb91d0ce311dd3418729c827:
+  title: 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again'
+  mainline: 9319b647902cbd5cc884ac08a8a6d54ce111fc78
+  upstream: c593d26fb5d577ef31b6e49a31e08ae3ebc1bc1e
+3e0c669b2a6d346166ce0c47d1abf45f69046404:
+  title: 'HID: wacom: generic: Avoid reporting a serial of ''0'' to userspace'
+  mainline: ab41a31dd5e2681803642b6d08590b61867840ec
+  upstream: 2303e0b4005c13c0faa6562e32886ebf8ee04f57
+7cf7d8509d54a81f1963ce1fb4346ca851f31ff3:
+  title: 'HID: wacom: Do not register input devices until after hid_hw_start'
+  mainline: c1d6708bf0d3dd976460d435373cf5abf21ce258
+  upstream: d943536197c1a05e377452af4ec7942e11d018f4
+6f2e6123d897f20b9e8ba8e47c2466909dcb5580:
+  title: 'USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT'
+  mainline: f17c34ffc792bbb520e4b61baa16b6cfc7d44b13
+  upstream: 67d96ddb269523ba171b0c6f8582a9f32812447b
+b7b8de89e0c14584f675cf1c1e7ceb648ae1d1e1:
+  title: 'usb: f_mass_storage: forbid async queue when shutdown happen'
+  mainline: b2d2d7ea0dd09802cf5a0545bf54d8ad8987d20c
+  upstream: 68a8f87c9c2e514eb9bded7337044142ff7c1ba0
+5b4d630c61084a0afa27b2d6e45335a84d333be3:
+  title: 'scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"'
+  mainline: 977fe773dcc7098d8eaf4ee6382cb51e13e784cb
+  upstream: 94a600226b6d0ef065ee84024b450b566c5a87d6
+3d027c0afcebe6338e106257e984a69500b9c1f6:
+  title: 'firewire: core: correct documentation of fw_csr_string() kernel API'
+  mainline: 5f9ab17394f831cb7986ec50900fa37507a127f1
+  upstream: cc9e5616a31b3054be3852d41f91592cd21f4f83
+e9ea3b98c3eeb1be14666afce0a52eca86630704:
+  title: 'nfc: nci: free rx_data_reassembly skb on NCI device cleanup'
+  mainline: bfb007aebe6bff451f7f3a4be19f4f286d0d5d9c
+  upstream: 7e9a8498658b398bf11b8e388005fa54e40aed81
+2f07b4feb7344a12863625df46967a3b6990a791:
+  title: 'xen-netback: properly sync TX responses'
+  mainline: 7b55984c96ffe9e236eb9c82a2196e0b1f84990d
+  upstream: 543fc0ea771528b7e2aa793bea1c46952d64d404
+0b85140d50e49360af625aa8ba84de40b18adbb7:
+  title: 'ext4: fix double-free of blocks due to wrong extents moved_len'
+  mainline: 55583e899a5357308274601364741a83e78d6ac4
+  upstream: b4fbb89d722cbb16beaaea234b7230faaaf68c71
+d375940a2f5db7ac750a0c16fc7afeff22f09ddf:
+  title: 'staging: iio: ad5933: fix type mismatch regression'
+  mainline: 6db053cd949fcd6254cea9f2cd5d39f7bd64379c
+  upstream: 4a0efde7875822485ebfd991874d454d2347e1a0
+5e09189142b229f4a7b98b105b89548bb1895b3d:
+  title: 'x86/mm/ident_map: Use gbpages only where full GB page should be mapped.'
+  mainline: d794734c9bbfe22f86686dc2909c25f5ffe1a572
+  upstream: 9149fef02dc1c54d2b4b9a555e11e7482f6ab583
+d24322c6c1cb11ee854b27d53e8f57598f58d906:
+  title: 'ALSA: hda/conexant: Add quirk for SWS JS201D'
+  mainline: 4639c5021029d49fd2f97fa8d74731f167f98919
+  upstream: e0de24ef5b3efe5636668f5090fa0833c6fb5b77
+a53d021d96e27b4e691be9bbf2b0e7e6a971a556:
+  title: 'nilfs2: fix data corruption in dsync block recovery for small block sizes'
+  mainline: 67b8bcbaed4777871bb0dcc888fb02a614a98ab1
+  upstream: 5278c3eb6bf5896417572b52adb6be9d26e92f65
+188292ff815215ff899d45a09e860000e12d53b7:
+  title: 'nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()'
+  mainline: 38296afe3c6ee07319e01bb249aa4bb47c07b534
+  upstream: 228742b2ddfb99dfd71e5a307e6088ab6836272e
+59185e887608415f810273b3d66a7c0a82ab145a:
+  title: 'nfp: use correct macro for LengthSelect in BAR config'
+  mainline: b3d4f7f2288901ed2392695919b3c0e24c1b4084
+  upstream: 09e5ae88b985524cb4f559c81b684f77cb237893
+ab54d44fa99cd6d87b05c7805ca0666c11b1fb36:
+  title: 'irqchip/irq-brcmstb-l2: Add write memory barrier before exit'
+  mainline: b0344d6854d25a8b3b901c778b1728885dd99007
+  upstream: edb943366fe91647079b58fa85781006fbfbe34a
+70bd0bc34ed8b422fb44e5f570cd8923f20f875b:
+  title: 'pmdomain: core: Move the unused cleanup to a _sync initcall'
+  mainline: 741ba0134fa7822fcf4e4a0a537a5c4cfd706b20
+  upstream: 81c0229f34f0e1330789fae616b9e2219ab28477
+072057390d7c127c32d061f52c8255b6e4b77305:
+  title: 'Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"'
+  mainline: bed9e27baf52a09b7ba2a3714f1e24e17ced386d
+  upstream: 1e8c1c2a92692881ac7ec92dcf1c8a846584251b
+edcd4473ab9ae8709bfdad2665bbb1d20f438364:
+  title: 'sched/membarrier: reduce the ability to hammer on sys_membarrier'
+  mainline: 944d5fe50f3f03daacfea16300e656a1691c4a23
+  upstream: 3cd139875e9a7688b3fc715264032620812a5fa3
+9dc394f2da9b2208457484dbcdcf9cdb3ee2d7ed:
+  title: 'nilfs2: fix potential bug in end_buffer_async_write'
+  mainline: 5bc09b397cbf1221f8a8aacb1152650c9195b02b
+  upstream: c4a09fdac625e64abe478dcf88bfa20406616928
+cdb04bf58f0b42afc09c9a9ba1f22e19b432a345:
+  title: 'lsm: new security_file_ioctl_compat() hook'
+  mainline: f1bb47a31dff6d4b34fb14e99850860ee74bb003
+  upstream: f8f51085b4be6132762ce0d8940071ccdcce2504
+141272175d24b1f41c429b0364d5f5852f6daa2d:
+  title: 'netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()'
+  mainline: c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63
+  upstream: fca41e5b687e029f69e3a35a2fa31e2560e538dc

diff --git a/.elts/upstream/4.19.305.yaml b/.elts/upstream/4.19.305.yaml
new file mode 100644
index 0000000..7081073
--- /dev/null
+++ b/.elts/upstream/4.19.305.yaml

@@ -0,0 +1,100 @@
+df02150025a3ac134a29c3a847b334f53d4b0c4a:
+  title: 'nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local'
+  mainline: c95f919567d6f1914f13350af61a1b044ac85014
+  skipped: commit is already present in branch
+e4f367ae64ff2ab90407e21ce0928b749a0c0c50:
+  title: 'i40e: Fix filter input checks to prevent config with invalid values'
+  mainline: 3e48041d9820c17e0a51599d12e66c6e12a8d08d
+  skipped: missing prerequisite
+67188c52c06ad8bf3890d9a2dc8cedc9a707cb61:
+  title: 'net: sched: em_text: fix possible memory leak in em_text_destroy()'
+  mainline: 8fcb0382af6f1ef50936f1be05b8149eb2f88496
+  skipped: commit is already present in branch
+ee49874f862ffa7d155fa4b2ef12a4ad1504c184:
+  title: 'ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init'
+  mainline: 72ad3b772b6d393701df58ba1359b0bb346a19ed
+  skipped: missing prerequisite
+fe7f1685f44bf8c24e3d9d9bb5196c668513aedb:
+  title: 'net: bcmgenet: Fix FCS generation for fragmented skbuffs'
+  mainline: e584f2ff1e6cc9b1d99e8a6b0f3415940d1b3eb3
+  skipped: commit is already present in branch
+0c220aefdb064f4fff02732ecd302f0901b15dc0:
+  title: 'net: Save and restore msg_namelen in sock_sendmsg'
+  mainline: 01b2885d9415152bcb12ff1f7788f500a74ea0ed
+  skipped: missing prerequisite
+af9ec305b68635ae6d8eb957e91e723bfee0d336:
+  title: 'i40e: fix use-after-free in i40e_aqc_add_filters()'
+  mainline: 6a15584e99db8918b60e507539c7446375dcf366
+  skipped: commit is already present in branch
+d94b35454b1ff91f3d1cb12198b00b71ec3341aa:
+  title: 'i40e: Restore VF MSI-X state during PCI reset'
+  mainline: 371e576ff3e8580d91d49026e5d5faebf5565558
+  skipped: missing prerequisite
+4c731d37cdd8bb66e4a6cff0ce69eb6ecf4e7620:
+  title: 'net/qla3xxx: switch from ''pci_'' to ''dma_'' API'
+  mainline: 41fb4c1ba7478fe34c7e094e124e4ee4513b9763
+  backport: ced7e0c8ca4be414095ad46b6363eaf8fb227d07
+39437c89a3074b3e869dab2d0e65148923e327a5:
+  title: 'net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues'
+  mainline: 89f45c30172c80e55c887f32f1af8e184124577b
+  backport: fda9db2ddde56d0a4fa6e08604c5c02ed4656190
+1d267835dadc8cec3bd3da252171bb335f507cd3:
+  title: 'asix: Add check for usbnet_get_endpoints'
+  mainline: eaac6a2d26b65511e164772bec6918fcbc61938e
+  backport: 1aa3bd40236223e2a8404b76d65e0e3c31ab91ba
+b39d97468acf9651ff68e44f0e0c7ebac4ecdca7:
+  title: 'bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()'
+  mainline: e009b2efb7a8850498796b360043ac25c8d3d28f
+  backport: 73a7f8a478ab010be26db513967aacc263263b85
+c6f50413f2aacc919b5de443aa080b94f5ebb21d:
+  title: 'mm/memory-failure: check the mapcount of the precise page'
+  mainline: c79c5a0a00a9457718056b588f312baadf44e471
+  backport: ff510bc907debb02a00d5be80c678fb54042eb01
+50f8b0a96c88f78c2e40cdb93557385c2ce5f5e8:
+  title: 'firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards'
+  mainline: ac9184fbb8478dab4a0724b279f94956b69be827
+  skipped: commit is already present in branch
+2db1c46c3913b8bc92fed235a344de2671fe9d8d:
+  title: 'mm: fix unmap_mapping_range high bits shift bug'
+  mainline: 9eab0421fa94a3dde0d1f7e36ab3294fc306c99d
+  backport: e5e8870a91aa5d8eeae9dfd3d6ab6cc6932a3f2b
+4a2d650b8fb83b0ceb37279dcc7ceafd10b578a3:
+  title: 'mmc: rpmb: fixes pause retune on all RPMB partitions.'
+  mainline: e7794c14fd73e5eb4a3e0ecaa5334d5a17377c50
+  skipped: commit is already present in branch
+74f6bca1532e013ff5745414288088486b4e9251:
+  title: 'mmc: core: Cancel delayed work before releasing host'
+  mainline: 1036f69e251380573e256568cf814506e3fb9988
+  skipped: commit is already present in branch
+437d8898fbf40b92516aef697b5638acccb7a6f9:
+  title: 'fuse: nlookup missing decrement in fuse_direntplus_link'
+  mainline: b8bd342d50cbf606666488488f9fea374aceb2d5
+  backport: 8d576e5e8705890e3f9f2bd0f5fe0de0832ac61f
+087d38ae0fd5a9a41b949e97601b4b0d09336f19:
+  title: 'netfilter: nf_tables: Reject tables of unsupported family'
+  mainline: f1082dd31fe461d482d69da2a8eccfeb7bf07ac2
+  backport: 24f1cf2efb69d6cc0cb5d50291f9eb4c95e6f29c
+5e2cf4c8777cb3fdafecdbce263ba5d975910f03:
+  title: 'PCI: Extract ATS disabling to a helper function'
+  mainline: f18b1137d38c091cc8c16365219f0a1d4a30b3d1
+  skipped: depends on missing commit b48fea52b951f0652c39ea8b3362338d909fca79
+610003d742341dddca03a83beb7c61f1f079b8c5:
+  title: 'PCI: Disable ATS for specific Intel IPU E2000 devices'
+  mainline: a18615b1cfc04f00548c60eb9a77e0ce56e848fd
+  skipped: depends on missing commit b48fea52b951f0652c39ea8b3362338d909fca79
+47468fae2704151503214f4d4327c164118247fd:
+  title: 'net: add a route cache full diagnostic message'
+  mainline: 22c2ad616b74f3de2256b242572ab449d031d941
+  backport: 895547de81e54a04152a30c1dc1de41be55245e5
+9635bd0a5296e2e725c6b33e530d0ef582e2f64e:
+  title: 'net/dst: use a smaller percpu_counter batch for dst entries accounting'
+  mainline: cf86a086a18095e33e0637cb78cda1fcf5280852
+  backport: 2ee1663e55e8977ff4e86354691f47a45ab20acc
+b4cfbeaebeb355dbaefb218470055de2e8a73020:
+  title: 'ipv6: make ip6_rt_gc_expire an atomic_t'
+  mainline: 9cb7c013420f98fa6fd12fc6a5dc055170c108db
+  backport: e0411760af63f47a43cf1971cd2328ec449645cf
+95372b040ae689293c6863b90049f1af68410c8b:
+  title: 'ipv6: remove max_size check inline with ipv4'
+  mainline: af6d10345ca76670c1b7c37799f0d5576ccef277
+  backport: 12cda1d5779e05665140a7e8fc88297e4ef9b418

diff --git a/.elts/upstream/4.19.306.yaml b/.elts/upstream/4.19.306.yaml
new file mode 100644
index 0000000..a33e4d3
--- /dev/null
+++ b/.elts/upstream/4.19.306.yaml

@@ -0,0 +1,592 @@
+16ae3132ff7746894894927c1892493693b89135:
+  title: 'f2fs: explicitly null-terminate the xattr list'
+  mainline: e26b6d39270f5eab0087453d9b544189a38c8564
+  backport: 634e7f82e8c70e7f17de0b0c48fd13f35e569043
+e22bd1d94dccae517c99fcd8b76470733ad45317:
+  title: 'ASoC: Intel: Skylake: mem leak in skl register function'
+  mainline: f8ba14b780273fd290ddf7ee0d7d7decb44cc365
+  skipped: commit did not cherry-pick cleanly
+f35d77a3c58a9be14531185ff47c3f0d867382ad:
+  title: 'ASoC: cs43130: Fix the position of const qualifier'
+  mainline: e7f289a59e76a5890a57bc27b198f69f175f75d9
+  backport: 0e4e1621037f71e6ce79cc4f1c0d76150de207a4
+1e8f3203c494cd382088eb64defed2d116a99c65:
+  title: 'ASoC: cs43130: Fix incorrect frame delay configuration'
+  mainline: aa7e8e5e4011571022dc06e4d7a2f108feb53d1a
+  backport: 92937c54dad3773d96442d1e36bec981fb8d2c7d
+48ce529c83522944f116f03884819051f44f0fb6:
+  title: 'ASoC: rt5650: add mutex to avoid the jack detection failure'
+  mainline: cdba4301adda7c60a2064bf808e48fccd352aaa9
+  backport: e0d5e7495b1562301f7d8afcfb109125d4e39e3e
+dc52503ad3ca93f3bc200b259f8ac56cef05a488:
+  title: 'net/tg3: fix race condition in tg3_reset_task()'
+  mainline: 16b55b1f2269962fb6b5154b8bf43f37c9a96637
+  backport: b2007da41920e3e1506bcae0ea5d67d82deaa1b4
+5324775cab629021225667b4fe0fe9b28cb4b200:
+  title: 'ASoC: da7219: Support low DC impedance headset'
+  mainline: 5f44de697383fcc9a9a1a78f99e09d1838704b90
+  backport: 6a04e427ce1ced4962a1cb607c3beae5639787f9
+edfa0e9b334c3e88953297073835dfa576e1d564:
+  title: 'drm/exynos: fix a potential error pointer dereference'
+  mainline: 73bf1c9ae6c054c53b8e84452c5e46f86dd28246
+  backport: dee75f1cda40e535bb660f6c342ec1a7c3b4b3e1
+9e35336aecd6b82ed29c30d057bd07795ca9876f:
+  title: 'clk: rockchip: rk3128: Fix HCLK_OTG gate register'
+  mainline: c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2
+  backport: fd2a03c0a010e92c62e5a242c8d1ef86cbe5e6b9
+1574191683ca491a382eb120475df573b8a69efe:
+  title: 'jbd2: correct the printing of write_flags in jbd2_write_superblock()'
+  mainline: 85559227211020b270728104c3b89918f7af27ac
+  backport: 9111572de29071a25887bc3ceb20ca794815fca5
+3df929b0b60fd82c58ba5b807bc9bdc77d1550c6:
+  title: 'drm/crtc: Fix uninit-value bug in drm_mode_setcrtc'
+  mainline: 3823119b9c2b5f9e9b760336f75bc989b805cde6
+  backport: ebbce42e84a5b6dd1c08203b22f947e12b5838c5
+fcd96231c7d79c5c03ac2fc73345e552caf7d7b5:
+  title: 'tracing: Have large events show up as ''[LINE TOO BIG]'' instead of nothing'
+  mainline: b55b0a0d7c4aa2dac3579aa7e6802d1f57445096
+  backport: 1e00941f86357671797d8cdaf7a9f96a74e9ee3b
+9a9d6a726688a0ed9fb16458d6918e51aadce9b5:
+  title: 'tracing: Add size check when printing trace_marker output'
+  mainline: 60be76eeabb3d83858cc6577fc65c7d0f36ffd42
+  backport: f4848e88a912d30601968682a2cf7483637b1477
+70887567dd96c2f5b46d853b603de30ea22741a2:
+  title: 'ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI'
+  mainline: 712292308af2265cd9b126aedfa987f10f452a33
+  backport: 76ea9993683668623fbe34e433e64b176941ad11
+8155a089c4a5d9afe6506463537944492b9b2839:
+  title: 'reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning'
+  mainline: b5ec294472794ed9ecba0cb4b8208372842e7e0d
+  backport: 92125c979c109cf2e1c5747b6967e2ea9f82b2bc
+eb59410d1cca3f1223b65e7562dc0d9acae26b39:
+  title: 'Input: atkbd - skip ATKBD_CMD_GETID in translated mode'
+  mainline: 936e4d49ecbc8c404790504386e1422b599dec39
+  backport: f56eab3175dcce9f9a198db019a2460d37bd8e65
+eb9bae96ee0051f21096d02dd765542139a969e9:
+  title: 'Input: i8042 - add nomux quirk for Acer P459-G2-M'
+  mainline: 335fe00319e030d481a54d5e0e68d50c5e672c0e
+  skipped: missing prerequisite 6f9919a8abc8bc5e9f60a8a137d5e910318db6b0
+e695700535c286e4f4f5a7c19e36ff6d61a25a4a:
+  title: 's390/scm: fix virtual vs physical address confusion'
+  mainline: b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c
+  backport: 83363b85a42a78939fead3717f1e5e9c2d088400
+c536440b603111f5fcafa36050d2481f29f23e92:
+  title: 'ARC: fix spare error'
+  mainline: aca02d933f63ba8bc84258bf35f9ffaf6b664336
+  backport: 2fe8f0179e36aab4ec1b75016b1d014476d69c04
+01a92b3c981219d22f16bdc612e9a2afa515a5dd:
+  title: 'Input: xpad - add Razer Wolverine V2 support'
+  mainline: c3d1610345b79cbe29ef6ca04a4780eff0d360c7
+  backport: b2c25c249b8c3bc24dc867b5a0bcd88171eca56b
+54893a9cc2b8a396385799b0c7a4a558db0db9b6:
+  title: 'ARM: sun9i: smp: fix return code check of of_property_match_string'
+  mainline: 643fe70e7bcdcc9e2d96952f7fc2bab56385cce5
+  skipped: missing prerequisite 745373e3d6ee3e398494d3aebe923b57a90ebadf
+c39fa3fb4a7d22b915dfd86fc7e94bfeb03def3e:
+  title: 'drm/crtc: fix uninitialized variable use'
+  mainline: 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf
+  backport: de80986229942606e6c9f0f2d27b0a9697c8ad3a
+6b3996be13ad67e2ea8aeb8810a807dc394b3055:
+  title: 'binder: use EPOLLERR from eventpoll.h'
+  mainline: 6ac061db9c58ca5b9270b1b3940d2464fb3ff183
+  skipped: missing prerequisite 65aaf87b3aa2d049c6b9fd85221858a895df3393
+10cfdc51c399890e535ccc16ed3f58b7c5e8f93e:
+  title: 'binder: fix comment on binder_alloc_new_buf() return value'
+  mainline: e1090371e02b601cbfcea175c2a6cc7c955fa830
+  backport: 40db091e8d96c76059905bd7398ee00f2eb8c042
+3174e0f7de1ba392dc191625da83df02d695b60c:
+  title: 'uio: Fix use-after-free in uio_open'
+  mainline: 0c9ae0b8605078eafc3bea053cc78791e97ba2e2
+  backport: 572879a25b2217fba182dc8504abc783af98217e
+d3408053bdfcb5992fe7ff01627a96e4293ffd21:
+  title: 'coresight: etm4x: Fix width of CCITMIN field'
+  mainline: cc0271a339cc70cae914c3ec20edc2a8058407da
+  backport: 4de569f9413900bfb66722ef06849c6dd08ec042
+cd6382e261952a7c2f1b8326bb9c11b074168d6c:
+  title: 'x86/lib: Fix overflow when counting digits'
+  mainline: a24d61c609813963aacc9f6ec8343f4fcaac7243
+  backport: 08c21102abea6d209abc265063459da3d4ee4750
+71c17ee02538802ceafc830f0736aa35b564e601:
+  title: 'EDAC/thunderx: Fix possible out-of-bounds string access'
+  mainline: 475c58e1a471e9b873e3e39958c64a2d278275c8
+  backport: 34d8bcffbe7c87b98ba9697a0a2b0c82e76ad325
+b7b85ec5ec15d5a3bc72ee1af35919caa91de9cb:
+  title: 'powerpc: add crtsavres.o to always-y instead of extra-y'
+  mainline: 1b1e38002648819c04773647d5242990e2824264
+  backport: 4e40d13cc6bf0a594558125658cd54d7938c0160
+de07ea70ce6f257b8647895b98f4ddc4fee764b0:
+  title: 'powerpc: remove redundant ''default n'' from Kconfig-s'
+  mainline: 719736e1cc12b2fc28eba2122893a449eee66d08
+  backport: a62184e669bcf638ece2811aea8549cff21f1ee6
+cce02fde090c5a828fd487c84433d8abcc36c14e:
+  title: 'powerpc/44x: select I2C for CURRITUCK'
+  mainline: 4a74197b65e69c46fe6e53f7df2f4d6ce9ffe012
+  backport: a75255720ea11b327ceaeaea9cd998bf76f0443c
+fddcaa763b053c5c983907ed6c1a4a141e54f060:
+  title: 'powerpc/pseries/memhotplug: Quieten some DLPAR operations'
+  mainline: 20e9de85edae3a5866f29b6cce87c9ec66d62a1b
+  backport: 4476a80ea1038fb3b93f62b209d0b71657e5669c
+bb79613a9a704469ddb8d6c6029d532a5cea384c:
+  title: 'powerpc/pseries/memhp: Fix access beyond end of drmem array'
+  mainline: bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5
+  backport: 0fe15f7b9cb118f8e1f1e0fbf54a29f812b15605
+ee23d012aea27e6ae6408803c4dd4a7b228667a0:
+  title: 'selftests/powerpc: Fix error handling in FPU/VMX preemption tests'
+  mainline: 9dbd5927408c4a0707de73ae9dd9306b184e8fee
+  backport: 5007064eca0329d3b10635e6e79682ffee1a7ecf
+8422d179cf46889c15ceff9ede48c5bfa4e7f0b4:
+  title: 'powerpc/powernv: Add a null pointer check in opal_event_init()'
+  mainline: 8649829a1dd25199bbf557b2621cedb4bf9b3050
+  backport: 78080fd925adc07e20d346105ae760ebe0565764
+75fc599bcdcb1de093c9ced2e3cccc832f3787f3:
+  title: 'powerpc/imc-pmu: Add a null pointer check in update_events_in_group()'
+  mainline: 0a233867a39078ebb0f575e2948593bbff5826b3
+  backport: 228d1909628f30b8d08476e5d95cc42299106eca
+238f46e6bbe689fb70d3933ffc2b9b7b0caf38b9:
+  title: 'mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response'
+  mainline: 923fb6238cb3ac529aa2bf13b3b1e53762186a8b
+  backport: e18751caa633cdd72d12c0cc18b0ff031164ba8b
+556f02699d33c1f40b1b31bd25828ce08fa165d8:
+  title: 'ACPI: video: check for error while searching for backlight device parent'
+  mainline: ccd45faf4973746c4f30ea41eec864e5cf191099
+  backport: 607acc13f86bf0acb33fef6aa25b3d5a02964566
+647d1d50c31e60ef9ccb9756a8fdf863329f7aee:
+  title: 'ACPI: LPIT: Avoid u32 multiplication overflow'
+  mainline: 56d2eeda87995245300836ee4dbd13b002311782
+  skipped: missing prerequisite
+d717dc44f3ae18cb8524c6fd727836efe53ec8ad:
+  title: 'net: netlabel: Fix kerneldoc warnings'
+  mainline: 294ea29113104487a905d0f81c00dfd64121b3d9
+  backport: 96a4f056a48e452dd59358613be23937b3fa60e1
+eb9743bdb23da4136fe3a39b61f3c2fa7f8276d8:
+  title: 'netlabel: remove unused parameter in netlbl_netlink_auditinfo()'
+  mainline: f7e0318a314f9271b0f0cdd4bfdc691976976d8c
+  backport: c3eb5ab095b46e82564541f4b5bfcc28786a9aec
+9a8f811a146aa2a0230f8edb2e9f4b6609aab8da:
+  title: 'calipso: fix memory leak in netlbl_calipso_add_pass()'
+  mainline: ec4e9d630a64df500641892f4e259e8149594a99
+  backport: 1456753483efd25769fdac097c4d4cf3c0deb949
+aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022:
+  title: 'mtd: Fix gluebi NULL pointer dereference caused by ftl notifier'
+  mainline: a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6
+  backport: 27f0c87acc3e816ba6f969888334c8c72f491b25
+993fc7a5b3119d82e5ae048b8b776c044540d8f4:
+  title: 'selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket'
+  mainline: bbf5a1d0e5d0fb3bdf90205aa872636122692a50
+  skipped: missing prerequisite
+96be18c8fff9d57e29621386e2fa17268383ea27:
+  title: 'crypto: virtio - Handle dataq logic with tasklet'
+  mainline: fed93fb62e05c38152b0fc1dc9609639e63eed76
+  backport: bd4fe044189e5e33e38f681a7eba5e862160e3f7
+063f6c37b06c115b1d8336d5dac7ea4f7c9ffe53:
+  title: 'crypto: ccp - fix memleak in ccp_init_dm_workarea'
+  mainline: a1c95dd5bc1d6a5d7a75a376c2107421b7d6240d
+  backport: 3d1343b49d7b745740609c97bbd1459fb05a2db8
+19af0310c8767c993f2a5d5261e4df3f9f465ce1:
+  title: 'crypto: af_alg - Disallow multiple in-flight AIO requests'
+  mainline: 67b164a871af1d736f131fd6fe78a610909f06f3
+  backport: 1371d1aac1d6b88b0aff31013be162b0caf13d26
+6ccb0052254f97e5f4c4b98befdb15de7efcde8d:
+  title: 'crypto: sahara - remove FLAGS_NEW_KEY logic'
+  mainline: 8fd183435728b139248a77978ea3732039341779
+  backport: cb2e4d4c3197d8f2ab3e295bee5273bdb0f50bd3
+9c241bed6d321355b41dce62e2c527fc1788c403:
+  title: 'crypto: sahara - fix ahash selftest failure'
+  mainline: afffcf3db98b9495114b79d5381f8cc3f69476fb
+  backport: 726ac2c4fa83c53364a57d7479b0ac42f9057aa6
+6aff781a57751247c3bc51dce2a3038ca0d31c36:
+  title: 'crypto: sahara - fix processing requests with cryptlen < sg->length'
+  mainline: 5b8668ce3452827d27f8c34ff6ba080a8f983ed0
+  backport: e7d1a334957ed6f85ff14bc20124a0f7472c656e
+71ba0d44a741640a962d4a6092afc84e976379bc:
+  title: 'crypto: sahara - fix error handling in sahara_hw_descriptor_create()'
+  mainline: ee6e6f0a7f5b39d50a5ef5fcc006f4f693db18a7
+  backport: e4adbef4abb98a739765ed95a33453bf10f7c1c8
+3b333cded94fbe5ce30d699b316c4715151268ae:
+  title: 'pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()'
+  mainline: 86222a8fc16ec517de8da2604d904c9df3a08e5d
+  backport: 6e45fa30b4b1a531d8867ee85baec327dd6602d6
+9cef719eefbc3956016f701cc026d7eb9834ffcb:
+  title: 'crypto: virtio - Wait for tasklet to complete on device remove'
+  mainline: 67cc511e8d436456cc98033e6d4ba83ebfc8e672
+  backport: 120738293f95e68c8eca2ab81c768b7f45389929
+dff90a1b4c980b6ddf4ec6cb5167eb08e5026e82:
+  title: 'crypto: sahara - fix ahash reqsize'
+  mainline: efcb50f41740ac55e6ccc4986c1a7740e21c62b4
+  backport: e62a797c5d8d58f318c17ec81c0ecbc6dec2f6f0
+882eba76746aa86d3295112fbb140829bd1145db:
+  title: 'crypto: sahara - fix wait_for_completion_timeout() error handling'
+  mainline: 2dba8e1d1a7957dcbe7888846268538847b471d1
+  backport: 49816cb9a0a59fd5293841ec0fb43cd795882133
+4532bf0aaedae56a9a0313f6a8e19f1536a076ae:
+  title: 'crypto: sahara - improve error handling in sahara_sha_process()'
+  mainline: 5deff027fca49a1eb3b20359333cf2ae562a2343
+  backport: 3f01b32b887839e9884e6c73137383647578d491
+8bb4be72f74b13d51e5e460441b97618252ce481:
+  title: 'crypto: sahara - fix processing hash requests with req->nbytes < sg->length'
+  mainline: 7bafa74d1ba35dcc173e1ce915e983d65905f77e
+  backport: 81a7245bbae96e94e99775f9ed7816c56d44ec62
+28076a1a44407a15442589780b1d06579504adc3:
+  title: 'crypto: sahara - do not resize req->src when doing hash operations'
+  mainline: a3c6f4f4d249cecaf2f34471aadbfb4f4ef57298
+  backport: ab2940679b406a2cd07178e5e0178cf9a6546e39
+1915874d67287ba1ab71825ae6a4efbb2a0e2b11:
+  title: 'crypto: scompress - return proper error code for allocation failure'
+  mainline: 6a4d1b18ef00a7b182740b7b4d8a0fcd317368f8
+  backport: fb0e9e3f0e7837698efe7070fc875db673901c05
+f8f261f9ade28894f5b547d1ec2a905308990f28:
+  title: 'crypto: scompress - Use per-CPU struct instead multiple variables'
+  mainline: 71052dcf4be70be4077817297dcde7b155e745f2
+  backport: 8b5ecff755cbfa45a1215921bf4e5782547f2f0b
+1142d65c5b881590962ad763f94505b6dd67d2fe:
+  title: 'crypto: scomp - fix req->dst buffer overflow'
+  mainline: 744e1885922a9943458954cfea917b31064b4131
+  backport: 17c8b716fd42226a901eeb0dfb1ff00347e9f588
+62a70167bf88dc6dff160a9d222356a68daab916:
+  title: 'blocklayoutdriver: Fix reference leak of pnfs_device_node'
+  mainline: 1530827b90025cdf80c9b0d07a166d045a0a7b81
+  skipped: missing prerequisite
+1b297c8879954e09b1b8fbdd77a58f01fc4618a1:
+  title: 'NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT'
+  mainline: 037e56a22ff37f9a9c2330b66cff55d3d1ff9b90
+  backport: 72daedd6e82587cc8988ddea958dea2838b01cb4
+1b653d866e0fe86e424fe4b8fa743d716eee71b6:
+  title: 'bpf, lpm: Fix check prefixlen before walking trie'
+  mainline: 9b75dbeb36fcd9fc7ed51d370310d0518a387769
+  backport: 26459b2b58fa2eba9f12275d7e2d8d1dc9794677
+a4087ece661fe2d4f95c2625a0b7d5dd0080229b:
+  title: 'wifi: libertas: stop selecting wext'
+  mainline: 8170b04c2c92eee52ea50b96db4c54662197e512
+  backport: bd06c9590761e3ff8827d9a1c8581625be0b9c79
+654d53e853e01f41d35156c956923dc5b6f3d21f:
+  title: 'ARM: dts: qcom: apq8064: correct XOADC register address'
+  mainline: 554557542e709e190eff8a598f0cde02647d533a
+  skipped: missing prerequisite
+3cb8ac9da29fac5ee4e6813f2c3e12690ee84a98:
+  title: 'ncsi: internal.h: Fix a spello'
+  mainline: 195a8ec4033b4124f6864892e71dcef24ba74a5a
+  backport: fdf6985a539e1435a5ef7b4de9cf15a2c1c8406d
+80a3ca0918eed409291a816fbed6b44678d01641:
+  title: 'net/ncsi: Fix netlink major/minor version numbers'
+  mainline: 3084b58bfd0b9e4b5e034f31f31b42977db35f12
+  backport: 05fd39a024db3af5ea78291dcf24af261e8a68d1
+fbdc266ebf438e711ebd48d9b1370e30f4e31096:
+  title: 'firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()'
+  mainline: 964946b88887089f447a9b6a28c39ee97dc76360
+  backport: c2b0d1feb5b926fc9ba0c386454570de69dde649
+a9386c2f247611bfad7510b64eb2932e2c555a5a:
+  title: 'rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift'
+  mainline: 6c1d61913570d4255548ac598cfbef6f1e3c3eee
+  backport: 897f298f90efb10cf81393cd7e0190b37c2ebbc9
+6b08b1e6d85f67f5782a49daf4725dc281ed9be7:
+  title: 'wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior'
+  mainline: bc8263083af60e7e57c6120edbc1f75d6c909a35
+  backport: bd03ed76b048543b7401018196dc0526caa00ec9
+637ba33605a51112aa46804f02548d78ed6f083e:
+  title: 'scsi: hisi_sas: Replace with standard error code return value'
+  mainline: d34ee535705eb43885bc0f561c63046f697355ad
+  skipped: missing prerequisite
+5ef6f81c326a1c0c7799a823a5510b74f958ac32:
+  title: 'dma-mapping: clear dev->dma_mem to NULL after freeing it'
+  mainline: b07bc2347672cc8c7293c64499f1488278c5ca3d
+  skipped: missing prerequisite
+09ceb7f1710717628488f5686cc083314c693e54:
+  title: 'wifi: rtlwifi: add calculate_bit_shift()'
+  mainline: 52221dfddbbfb5b4e029bb2efe9bb7da33ec1e46
+  backport: 88d5a3786e5cb6a10065d7e26c250bb8c848a2a2
+ad3d745248c04faa6e60abb9d2dee9555faa470c:
+  title: 'wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()'
+  mainline: 969bc926f04b438676768aeffffffb050e480b62
+  backport: 2128cf6809ee76d13a74481b5985e30ec5485a45
+29e2ecd3fdeb952696f9267d49257e93dca32321:
+  title: 'wifi: rtlwifi: rtl8192c: using calculate_bit_shift()'
+  mainline: 1dedc3a6699d827d345019e921b8d8f37f694333
+  backport: e393571a6bd85fd5ffec367d11483d52b0c80718
+1d5fd854141a1a073381f3356109ebba8709b4c6:
+  title: 'wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()'
+  mainline: f4088c8fcbabadad9dd17d17ae9ba24e9e3221ec
+  backport: 4d6a0f73aba3e60b208083788b48f92c13608888
+8f79e8a983010ac6e31e2ce6bde6d00e2c9a4e4e:
+  title: 'wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()'
+  mainline: 3d03e8231031bcc65a48cd88ef9c71b6524ce70b
+  backport: 60ca01685d4eb09fd2705165e9def96b64dc7da5
+86cd6555b79b22b64bf49a031bc056c4d4c447bd:
+  title: 'rtlwifi: rtl8192de: make arrays static const, makes object smaller'
+  mainline: b05897ca8c821a16ac03850c4704fe460b3f21a0
+  backport: 915183b8e7402ad215ba4a3d7b034ca1b25bd70f
+9f1500e8c3a50be139e87d71394d5109e46e3dad:
+  title: 'wifi: rtlwifi: rtl8192de: using calculate_bit_shift()'
+  mainline: b8b2baad2e652042cf8b6339939ac2f4e6f53de4
+  backport: 08b7dd75bc7b17d784e8e765225d24d7158f5aeb
+6642a375aa95f4344ab1fc7332f2d45c20ea2d63:
+  title: 'wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()'
+  mainline: 63526897fc0d086069bcab67c3a112caaec751cb
+  backport: 3ab28359e0eb80b57a58893db84412b5e85d7777
+9e50da7d71796c662bb39dada2d3ca44c2bf2362:
+  title: 'wifi: rtlwifi: rtl8192se: using calculate_bit_shift()'
+  mainline: ac32b9317063b101a8ff3d3e885f76f87a280419
+  backport: a25a56719d96f567cb73dba6bddc2f4b5e7ef420
+f7f627ac761b2fb0c487e5aaff1585f1014ab9a6:
+  title: 'Bluetooth: Fix bogus check for re-auth no supported with non-ssp'
+  mainline: d03376c185926098cb4d668d6458801eb785c0a5
+  backport: 6ba5a14ad6f87a7d610a96c08cf1100b11583c7e
+8b47d12e350ea5a8c1cbe94094a9319c4bc9b9bf:
+  title: 'Bluetooth: btmtkuart: fix recv_buf() return value'
+  mainline: 64057f051f20c2a2184b9db7f8037d928d68a4f4
+  skipped: missing prerequisite
+135414f300c5db995e2a2f3bf0f455de9d014aee:
+  title: 'ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()'
+  mainline: d375b98e0248980681e5e56b712026174d617198
+  backport: 6d5e17b3543373963fda337744203edf8e4f5c40
+ef87ffe5e8093ea540803811b1496238d778069c:
+  title: 'RDMA/usnic: Silence uninitialized symbol smatch warnings'
+  mainline: b9a85e5eec126d6ae6c362f94b447c223e8fe6e4
+  backport: 8f07604e4630933aeb436be46c38b7240725a2eb
+ec36c134dd020d28e312c2f1766f85525e747aab:
+  title: 'media: pvrusb2: fix use after free on context disconnection'
+  mainline: ded85b0c0edd8f45fec88783d7555a5b982449c1
+  backport: faf2ca73bc2b927d4ba2f830d57de1662ce77852
+d1992dd1ba7a9b4353cc2c673233be297c8d5c96:
+  title: 'drm/bridge: Fix typo in post_disable() description'
+  mainline: 288b039db225676e0c520c981a1b5a2562d893a3
+  backport: 27d74baf1b5b0f7fe7659b1359c29efdf1915982
+02160112e6d45c2610b049df6eb693d7a2e57b46:
+  title: 'f2fs: fix to avoid dirent corruption'
+  mainline: 53edb549565f55ccd0bdf43be3d66ce4c2d48b28
+  backport: bbf60e5c55914a70605910a108192c9eaf502907
+f55536f3377690f9e1b8f7fba5d19e371b73d20f:
+  title: 'drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()'
+  mainline: 39c960bbf9d9ea862398759e75736cfb68c3446f
+  backport: 2a37830abde108247bac114a185b5661ad69eb82
+98d47b927d85a4151d048a41b950d92e1b01e88f:
+  title: 'drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()'
+  mainline: b5c5baa458faa5430c445acd9a17481274d77ccf
+  backport: c465f32956eead2b3a38259c31d0e811d2b96f40
+4d8d372eb7e865053b954f04ee34eeb1fed1da39:
+  title: 'drm/radeon: check return value of radeon_ring_lock()'
+  mainline: 71225e1c930942cb1e042fc08c5cc0c4ef30e95e
+  backport: 31655ae29f5b0ad9fc6bf1b0d79032bb7f08dbae
+c03156a046ae69f1abc2d93b57d6f410729d2c84:
+  title: 'ASoC: cs35l33: Fix GPIO name and drop legacy include'
+  mainline: 50678d339d670a92658e5538ebee30447c88ccb3
+  backport: 5eeba65918540f2e0cd6b8c09ffafd49436ecf0a
+b02d4b488da9830762611dd07d206fd49cfd72cb:
+  title: 'ASoC: cs35l34: Fix GPIO name and drop legacy include'
+  mainline: a6122b0b4211d132934ef99e7b737910e6d54d2f
+  backport: ec3ed7b8f8f728621c66e1e29b6b281b3a76ed39
+f7133b078dbe8e5973d5b569b9fd58b5ff068f2c:
+  title: 'drm/msm/mdp4: flush vblank event on disable'
+  mainline: c6721b3c6423d8a348ae885a0f4c85e14f9bf85c
+  backport: 6af25088ade37074893cb9dbb9d515e4807739d6
+f6f65dac6c1b18f3a4fff214f80e08f92f873fed:
+  title: 'drm/drv: propagate errors from drm_modeset_register_all()'
+  mainline: 5f8dec200923a76dc57187965fd59c1136f5d085
+  backport: d25d4a3bbb225f6f6a5e13396b33d8f51d736d10
+21b1645660717d6126dd4866c850fcc5c4703a41:
+  title: 'drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()'
+  mainline: 7a2464fac80d42f6f8819fed97a553e9c2f43310
+  backport: b7e655dc8c70d3267aabf18fef0214a17fd10403
+a8b530d665fb6a0af23f94f7cca175a2122b3ed2:
+  title: 'drm/radeon/dpm: fix a memleak in sumo_parse_power_table'
+  mainline: 0737df9ed0997f5b8addd6e2b9699a8c6edba2e4
+  backport: e7d18b4f0386f969ea7962389c04afeb3ff6feb1
+afb2be8f4279799aee6f2451287bd6f594b2e1cd:
+  title: 'drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table'
+  mainline: 28c28d7f77c06ac2c0b8f9c82bc04eba22912b3b
+  backport: 1bfe8303ba10f5bedc81d22675d4449e16ca0cba
+68d7d5923f8a2f03193b27297252d0e7cc7045fc:
+  title: 'media: cx231xx: fix a memleak in cx231xx_init_isoc'
+  mainline: 5d3c8990e2bbf929cb211563dadd70708f42e4e6
+  backport: 1755d5eb6e59ad98a24166819c2495a376aa42ae
+782a58a14de9f6551dc0e82c19e0caa6f7cc419c:
+  title: 'media: dvbdev: drop refcount on error path in dvb_device_open()'
+  mainline: a2dd235df435a05d389240be748909ada91201d2
+  backport: d4030a0f227463e56c947b32329c9921f6540e71
+94dae1e058fba76a01989ef07d1d4aab2f8f62a3:
+  title: 'drm/amdgpu/debugfs: fix error code when smc register accessors are NULL'
+  mainline: afe58346d5d3887b3e49ff623d2f2e471f232a8d
+  skipped: missing prerequisite
+afe9f5b871f86d58ecdc45b217b662227d7890d0:
+  title: 'drm/amd/pm: fix a double-free in si_dpm_init'
+  mainline: ac16667237a82e2597e329eb9bc520d1cf9dff30
+  backport: 792d62725c643e5f7638ea7b515c99a14c8e3737
+8a27d9d9fc9b5564b8904c3a77a7dea482bfa34e:
+  title: 'drivers/amd/pm: fix a use-after-free in kv_parse_power_table'
+  mainline: 28dd788382c43b330480f57cd34cde0840896743
+  backport: a6e7ea708763a4cbe3d71042c9d3f3c595f379d7
+aa2bcb8cddd990e37a0c750a04a8bc3fbc1e0710:
+  title: 'gpu/drm/radeon: fix two memleaks in radeon_vm_init'
+  mainline: c2709b2d6a537ca0fa0f1da36fdaf07e48ef447d
+  backport: 99afdfa5464efb18504ec34b1770ea1a3f45cde9
+c0a529ab2af0bbe06dc278655d2ad67725ee04bc:
+  title: 'watchdog: set cdev owner before adding'
+  mainline: 38d75297745f04206db9c29bdd75557f0344c7cc
+  backport: 5b38ec02c46daabc1e4c2437a97b01ced82fc186
+0bbeb932bd0a44abebc8c0e137d2eac98f1ff32d:
+  title: 'watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO'
+  mainline: dced0b3e51dd2af3730efe14dd86b5e3173f0a65
+  skipped: missing prerequisite
+3f30085bd96cbb0a6d9a7c70989d6fcae7b9b651:
+  title: 'watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling'
+  mainline: f33f5b1fd1be5f5106d16f831309648cb0f1c31d
+  backport: 070a50e21971a395ea35e22ba5145c90bf6aca7b
+4d42d3bf480113fe463044a0f675979f8bb0fbb7:
+  title: 'mmc: sdhci_omap: Fix TI SoC dependencies'
+  mainline: 09f164d393a6671e5ff8342ba6b3cb7fe3f20208
+  skipped: missing prerequisite
+26b4d702c44f9e5cf3c5c001ae619a4a001889db:
+  title: 'of: Fix double free in of_parse_phandle_with_args_map'
+  mainline: 4dde83569832f9377362e50f7748463340c5db6b
+  skipped: missing prerequisite
+d35bdf57d4c1ea706d0a23712611ab97a556611d:
+  title: 'of: unittest: Fix of_count_phandle_with_args() expected value message'
+  mainline: 716089b417cf98d01f0dc1b39f9c47e1d7b4c965
+  skipped: missing prerequisite
+05088b886fea59cc827e5b5cedb66165cf532f72:
+  title: 'binder: fix async space check for 0-sized buffers'
+  mainline: 3091c21d3e9322428691ce0b7a0cfa9c0b239eeb
+  backport: d0bbd4afe43cd08a408c737ad9d3d826deeb09ea
+6c42ba1fc7d39b1d72c1adc43ea2e519f5450b3c:
+  title: 'Input: atkbd - use ab83 as id when skipping the getid command'
+  mainline: 58f65f9db7e0de366a5a115c2e2c0703858bba69
+  backport: 8f95561662745f6212e830179c4dcf3e8f90e232
+c2d22841d5f7a2010f7848b10d8158cfffef1a1f:
+  title: 'Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"'
+  mainline: c775cbf62ed4911e4f0f23880f01815753123690
+  skipped: missing prerequisite
+5bb8270789c88c0e4ad78c0de2f274f2275c7f6c:
+  title: 'xen-netback: don''t produce zero-size SKB frags'
+  mainline: c7ec4f2d684e17d69bbdd7c4324db0ef5daac26a
+  backport: 98b497bbb72b5c745556a05985241d55ecf93df6
+95b1d336b0642198b56836b89908d07b9a0c9608:
+  title: 'binder: fix race between mmput() and do_exit()'
+  mainline: 9a9ab0d963621d9d12199df9817e66982582d5a5
+  backport: 553b9fbf5d0dc52038c1845033e0d0919cdc72ec
+e2425a67b5ed67496959d0dfb99816f5757164b0:
+  title: 'binder: fix unused alloc->free_async_space'
+  mainline: c6d05e0762ab276102246d24affd1e116a46aa0c
+  backport: 09f65d968ecc015e036d03f6edc697ed6d317855
+98654bc44cfe00f1dfc8caf48079c504c473fdc3:
+  title: 'tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug'
+  mainline: 71fee48fb772ac4f6cfa63dbebc5629de8b4cc09
+  backport: e3ff741c08a574f4a541ca15781a76c8faacc15a
+21ee23b1b0c36b032eb44f3492151e924832f33d:
+  title: 'usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()'
+  mainline: ff2b89de471da942a4d853443688113a44fd35ed
+  backport: 848d134a5b0b0139ae89155936f6f0009f418aac
+35efd8f23709cda8cf17cdf607645c1e92362150:
+  title: 'usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart'
+  mainline: e9d40b215e38480fd94c66b06d79045717a59e9c
+  backport: 3b3fc47ec4e2ab45ad6193fa5f768af07a3aed39
+4e3fc0e8aa6dcd01dd3130640ee2bc184de8c3cb:
+  title: 'Revert "usb: dwc3: Soft reset phy on probe for host"'
+  mainline: 7059fbebcb00554c3f31e5b5d93ef6d2d96dc7b4
+  skipped: missing prerequisite
+b19938dc9188f8505296a45e34114b626d23d6b7:
+  title: 'Revert "usb: dwc3: don''t reset device side if dwc3 was configured as host-only"'
+  mainline: afe28cd686aeb77e8d9140d50fb1cf06a7ecb731
+  skipped: missing prerequisite
+744c753fe43a01c4ba74441f3367ce56e7c24dbb:
+  title: 'usb: chipidea: wait controller resume finished for wakeup irq'
+  mainline: 128d849074d05545becf86e713715ce7676fc074
+  backport: f2860da15f7c3d6fbb7d7736bc6f9e5401328661
+f4e842c40582bf801ba827818e09470919e7cb59:
+  title: 'Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"'
+  mainline: 9c6b789e954fae73c548f39332bcc56bdf0d4373
+  skipped: missing prerequisite
+de099c9a3011451b5d0562f31f47aa29a38d0a44:
+  title: 'usb: typec: class: fix typec_altmode_put_partner to put plugs'
+  mainline: 5962ded777d689cd8bf04454273e32228d7fb71f
+  skipped: missing prerequisite
+c9fe83c03d64e60e3bdf4ec118dd391ced800125:
+  title: 'usb: mon: Fix atomicity violation in mon_bin_vma_fault'
+  mainline: 2dd23cc4d0e6aa55cf9fb3b05f2f4165b01de81c
+  backport: f68f3eb091d0f045aa79a6101593eb8d81eaeea5
+2d412772b60b435611f2bdf9ae66d284b1e4581c:
+  title: 'ALSA: oxygen: Fix right channel of capture volume mixer'
+  mainline: a03cfad512ac24a35184d7d87ec0d5489e1cb763
+  backport: af21cdde8b15d3432699c214e0970ddac152f539
+14b84d9a230b69084dc967a2e837e8f77f16e239:
+  title: 'fbdev: flush deferred work in fb_deferred_io_fsync()'
+  mainline: 15e4c1f462279b4e128f27de48133e0debe9e0df
+  backport: e9dc3538ec3195a260e630bb807dcd1c59141b3c
+fef91b68a7a1ce6fe250c823f9eac0a8a4b86d67:
+  title: 'wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code'
+  mainline: b3943b3c2971444364e03224cfc828c5789deada
+  backport: 72900b18da7e387b139b435d58968f2fbf1922df
+a0aa5c8bacad6f5a6f5cd0aeba459b54f4f01c0f:
+  title: 'wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors'
+  mainline: 5894d0089cbc146063dcc0239a78ede0a8142efb
+  backport: e68bf9e612fc65950931a48e191d5bbdf3321db8
+99f3aa8c515deb19b25056a2e9f589ba43098260:
+  title: 'wifi: mwifiex: configure BSSID consistently when starting AP'
+  mainline: f0dd488e11e71ac095df7638d892209c629d9af2
+  backport: d1a47b4a12ca2b93fda76fea730b12b677ad2cf1
+9fb6c2fd168add72754c8633e9d857f109d26c79:
+  title: 'HID: wacom: Correct behavior when processing some confidence == false touches'
+  mainline: 502296030ec6b0329e00f9fb15018e170cc63037
+  backport: 5ce237ebadbd8ba81f08f349159a0e7d14aaa853
+c6d7d05b5180b508b589c37820aafa76698f9c2c:
+  title: 'MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()'
+  mainline: 89c4b588d11e9acf01d604de4b0c715884f59213
+  backport: e890afc067e68597bca534724a9c034c406a679d
+8e16eb8d75597a2bc1747e4fe4bd48cd219e0c08:
+  title: 'MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()'
+  mainline: 3c1e5abcda64bed0c7bffa65af2316995f269a61
+  backport: e46223e9fa8f7dc8beb87d13cab9117150e4c7d0
+d60ab2f871564fa4cfe721e321002d490e885cdc:
+  title: 'acpi: property: Let args be NULL in __acpi_node_get_property_reference'
+  mainline: bef52aa0f3de1b7d8c258c13b16e577361dabf3a
+  skipped: missing prerequisite
+8b55ba542da96c9eb28f97c2aaa7b5f6f3cac1ab:
+  title: 'perf genelf: Set ELF program header addresses properly'
+  mainline: 1af478903fc48c1409a8dd6b698383b62387adf1
+  skipped: missing prerequisite
+9286ee97aa4803d99185768735011d0d65827c9e:
+  title: 'apparmor: avoid crash when parsed profile name is empty'
+  mainline: 55a8210c9e7d21ff2644809699765796d4bfb200
+  backport: 9f63fb12c2ed40fbec3472326ccaa66f842f895e
+e6e09a88789b818f970ab9eba427dee23f82f007:
+  title: 'serial: imx: Correct clock error message in function probe()'
+  mainline: 3e189470cad27d41a3a9dc02649f965b7ed1c90f
+  backport: 2690f9764726feaa9616353bf3c44689d5743c88
+093dab655808207f7a9f54cf156240aeafc70590:
+  title: 'net: qualcomm: rmnet: fix global oob in rmnet_policy'
+  mainline: b33fb5b801c6db408b774a68e7c8722796b59ecc
+  skipped: missing prerequisite
+83fabba372ea78f9d0caaf15fe0b10b1704d84e0:
+  title: 'net: ravb: Fix dma_addr_t truncation in error case'
+  mainline: e327b2372bc0f18c30433ac40be07741b59231c5
+  backport: df281fb15750e6711a272493cfe73b175e74ff7f
+368770bfd05fcb16e5f3ee0857176ccea00e462b:
+  title: 'net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe'
+  mainline: 776dac5a662774f07a876b650ba578d0a62d20db
+  skipped: missing prerequisite
+614235859d46cae23af6120f48bca9c4250a5392:
+  title: 'ipvs: avoid stat macros calls from preemptible context'
+  mainline: d6938c1c76c64f42363d0d1f051e1b4641c2ad40
+  backport: 4dcf29c0ff8acca60293aee99bc256e4f5215fe1
+b06507c19c19199534c14e73a85c3a2c1cef0a36:
+  title: 'kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ'
+  mainline: ad99b5105c0823ff02126497f4366e6a8009453e
+  backport: dd39912acd0b28dec249a9466db430d2b32f53c7
+e7c31af67b6c8afa5e917520a61bc0d79d86db68:
+  title: 'kdb: Fix a potential buffer overflow in kdb_local()'
+  mainline: 4f41d30cd6dc865c3cbc1a852372321eba6d4e4c
+  backport: 5b7a52eb9c1d0dfa92d90e668646565c6293904f
+47028cccbd01b6f540b0ab289c37dc0b8b46c561:
+  title: 'i2c: s3c24xx: fix read transfers in polling mode'
+  mainline: 0d9cf23ed55d7ba3ab26d617a3ae507863674c8f
+  backport: fcbf91b1a3630d288b639ac39b1ab10529ea1c4e
+0646c260c4b4b827b3e73ebe146cd06a4c11b09d:
+  title: 'i2c: s3c24xx: fix transferring more than one message in polling mode'
+  mainline: 990489e1042c6c5d6bccf56deca68f8dbeed8180
+  backport: ce27684d192649d7048f579ebf7d641095503f72
+10d75984495f7fe62152c3b0dbfa3f0a6b739c9b:
+  title: 'Revert "NFSD: Fix possible sleep during nfsd4_release_lockowner()"'
+  mainline: ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b
+  backport: 1b29cdadfd7b1c8199fb02f4308cf4ae3dd166b7
+a132ff91717c28498c602e62824f0684a02c8832:
+  title: 'crypto: scompress - initialize per-CPU variables on each CPU'
+  mainline: 8c3fffe3993b06dd1955a79bd2f0f3b143d259b3
+  backport: be892379d02565cc7ee9c36a4efce9e19f2bf349

diff --git a/.elts/upstream/4.19.307.yaml b/.elts/upstream/4.19.307.yaml
new file mode 100644
index 0000000..63a0ade
--- /dev/null
+++ b/.elts/upstream/4.19.307.yaml

@@ -0,0 +1,792 @@
+fd110f42e3679af082c427b7a2eeb942d5af470f:
+  title: 'PCI: mediatek: Clear interrupt status before dispatching handler'
+  mainline: 4e11c29873a8a296a20f99b3e03095e65ebf897d
+  backport: 7641f759ca67017f4c30a592499e57880eaff71f
+cde2b87517dcf1e2aa887ad8a327b022e663dcea:
+  title: 'include/linux/units.h: add helpers for kelvin to/from Celsius conversion'
+  mainline: 23331e4893614deb555c65cdf115c8a28ed32471
+  backport: efb9a9043e383cc61ee11c500879b095c0ac69b4
+0e7f574162e2f15f4b63f9892906f6a9afe4429f:
+  title: 'units: Add Watt units'
+  mainline: 2ee5f8f05949735fa2f4c463a5e13fcb3660c719
+  backport: 7fa3ad8fce867983af62f56e43a3a2e9d3b6b3ed
+08333e4c4f3ffe6f9d916cc111d9f3429a6aa6c2:
+  title: 'units: change from ''L'' to ''UL'''
+  mainline: c9221919a2d2df5741ab074dfec5bdfc6f1e043b
+  backport: c87d7d3960d2b5393160f7cff6d2044bb092f3aa
+fe79b37c6a59c623c9e64e53d5d9a0fffcfe977f:
+  title: 'units: add the HZ macros'
+  mainline: e2c77032fcbe515194107994d12cd72ddb77b022
+  backport: a86917709d63eed8549377e273ed49aaf6f0fe85
+5733959d6770324020e30dd9313cbeac0aec07ef:
+  title: 'serial: sc16is7xx: set safe default SPI clock frequency'
+  mainline: 3ef79cd1412236d884ab0c46b4d1921380807b48
+  backport: 43f2c1d0c3164fa36be2176c14471487612cc7d4
+b0465a4897047ece1e4275fefc88a66ee41c5379:
+  title: 'driver core: add device probe log helper'
+  mainline: a787e5400a1ceeb0ef92d71ec43aeb35b1fa1334
+  backport: baa039a424b919c35e14d292209e6eb1c75a56ae
+93d63ccd20b55ae704d2c89664375e6f98552ee6:
+  title: 'spi: introduce SPI_MODE_X_MASK macro'
+  mainline: 029b42d8519cef70c4fb5fcaccd08f1053ed2bf0
+  backport: 5691ddf6d4ceb137c3411a02d3c1e8ec04dd63f3
+cccdd04643a7d21d0ca5d8205b15ec0ea1be1c6b:
+  title: 'serial: sc16is7xx: add check for unsupported SPI modes during probe'
+  mainline: 6d710b769c1f5f0d55c9ad9bb49b7dce009ec103
+  backport: 6b48b4b203794e7f13aa0f97451bad4acbae2cae
+5b6a7f323b533e5ab07e93633ad9644b41b6df42:
+  title: 'ext4: allow for the last group to be marked as trimmed'
+  mainline: 7c784d624819acbeefb0018bac89e632467cca5a
+  skipped: missing prerequisite
+15a67115d487ea5cb8213915a4f75f58adb87cbc:
+  title: 'crypto: api - Disallow identical driver names'
+  mainline: 27016f75f5ed47e2d8e0ca75a8ff1f40bc1a5e27
+  backport: 545e2955bf5596fac2adf3a7857fa459c544c148
+489506a2a0cbbfc7065d4d18ec6bb9baa3818c62:
+  title: 'PM: hibernate: Enforce ordering during image compression/decompression'
+  mainline: 71cd7e80cfde548959952eac7063aeaea1f2e1c6
+  backport: ea24848bab92c13dbf6ab1b2174f9d036487d253
+eafd83b92f6c044007a3591cbd476bcf90455990:
+  title: 'hwrng: core - Fix page fault dead lock on mmap-ed hwrng'
+  mainline: 78aafb3884f6bc6636efcc1760c891c8500b9922
+  backport: 581445afd04cac92963d8b56b3eea08b320d6330
+229ce47cbfdc7d3a9415eb676abbfb77d676cb08:
+  title: 'rpmsg: virtio: Free driver_override when rpmsg_remove()'
+  mainline: d5362c37e1f8a40096452fc201c30e705750e687
+  backport: 669cd9318ec5d236f24973f8ca3faad5f31d4b6d
+63cc5eb9b4102474423c4d6563fdf2ebbedf437f:
+  title: 'parisc/firmware: Fix F-extend for PDC addresses'
+  mainline: 735ae74f73e55c191d48689bd11ff4a06ea0508f
+  backport: ea4d137035293e76e164c462a2fedfb4287924cf
+98fcd3b663835bc7518d65d053419c640f3515a3:
+  title: 'nouveau/vmm: don''t set addr on the fail path to avoid warning'
+  mainline: cacea81390fd8c8c85404e5eb2adeb83d87a912e
+  skipped: missing prerequisite 24e8375b1bfdf7f6014b9e3d7903d6a8f81aa249
+d2d0b95ca1b5fefa3deed444a803c9f809db66cf:
+  title: 'block: Remove special-casing of compound pages'
+  mainline: 1b151e2435fc3a9b10c8946c6aebe9f3e1938c55
+  backport: c0ec35dc112eab077896d9f5b4c0a290b778c38a
+4ce844d0f50f789cc70de7bd02511df0f40c64b6:
+  title: 'powerpc: Use always instead of always-y in for crtsavres.o'
+771df0145297a1a9f1e7f799da43f8b0f8850e7c:
+  title: 'x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum'
+d31978bfec1d251a75d4a038e564ef2ff9d8be40:
+  title: 'driver core: Annotate dev_err_probe() with __must_check'
+  mainline: e1f82a0dcf388d98bcc7ad195c03bd812405e6b2
+  backport: 72a6d97e54e06db480e8cdbdab3cd0110295251b
+b715d543d42e8e4ddd645193410cd4511fc46d6c:
+  title: 'Revert "driver core: Annotate dev_err_probe() with __must_check"'
+  mainline: f601e8f37c2c1c52f2923fffc48204a7f7dc023d
+  backport: 8a65f3d70ff92f689506357203bfa8fef42ed031
+cf07cb793264fd3c459918dda7e839d6a279493c:
+  title: 'driver code: print symbolic error code'
+  mainline: 693a8e936590f93451e6f5a3d748616f5a59c80b
+  backport: 4fa22d4f07a2ab952ca8005d816b1eb7b4ae7bb8
+4d61ff79b439fe9cd5eaa3363a25853f230e2026:
+  title: 'drivers: core: fix kernel-doc markup for dev_err_probe()'
+  mainline: 074b3aad307de6126fbac1fff4996d1034b48fee
+  backport: 7fa4477471e885e41d5272987d399084f8a90d72
+27aea64838914c6122db5b8bd4bed865c9736f22:
+  title: 'net/smc: fix illegal rmb_desc access in SMC-D connection dump'
+  mainline: dbc153fd3c142909e564bb256da087e13fbf239c
+  skipped: missing prerequisite
+91759822dd336c20f817e6fd59cccee3952599f7:
+  title: 'vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING'
+  mainline: 6c21660fe221a15c789dee2bc2fd95516bc5aeaf
+  backport: b2d336bd83e5129931108606348fe6d64b2ea95d
+84e9d10419f6f4f3f3cd8f9aaf44a48719aa4b1b:
+  title: 'llc: make llc_ui_sendmsg() more robust against bonding changes'
+  mainline: dad555c816a50c6a6a8a86be1f9177673918c647
+  backport: f99b9736c1b4642c7694718ff2e559060e102460
+165ad1e22779685c3ed3dd349c6c4c632309cc62:
+  title: 'llc: Drop support for ETH_P_TR_802_2.'
+  mainline: e3f9bed9bee261e3347131764e42aeedf1ffea61
+  backport: dc5870e21f3001b3ec8576e6f54031a8cba164f5
+344350bfa3b4b37d7c3d5a00536e6fbf0e953fbf:
+  title: 'net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv'
+  mainline: 13e788deb7348cc88df34bed736c3b3b9927ea52
+  backport: e5ac391f7644fa947a50c342ea44829eaecddedd
+5022b331c041e8c54b9a6a3251579bd1e8c0fc0b:
+  title: 'tracing: Ensure visibility when inserting an element into tracing_map'
+  mainline: 2b44760609e9eaafc9d234a6883d042fc21132a7
+  skipped: missing prerequisite
+52c46caf283bfa3016a5e41363df93c02037f788:
+  title: 'tcp: Add memory barrier to tcp_push()'
+  mainline: 7267e8dcad6b2f9fce05a6a06335d7040acbc2b6
+  backport: 6a3e1d9862f94de4bee1e33e16f05038f5389a2b
+d53a2b227d0fd0ca1404cddec607d32154a7259f:
+  title: 'netlink: fix potential sleeping issue in mqueue_flush_file'
+  mainline: 234ec0b6034b16869d45128b8cd2dc6ffe596f04
+  backport: ef58e1caae5c94a09529c65681dad1fd4e8fb0ee
+af3bf8e9a72fbd173e06b688039c3f6fbde45315:
+  title: 'net/mlx5: Use kfree(ft->g) in arfs_create_groups()'
+  mainline: 360000b26e37a75b3000bf0585b263809d96ffd3
+  backport: 43a2aef972f44aa2b326fa198bdf8dfabb943956
+e3d3ed8c152971dbe64c92c9ecb98fdb52abb629:
+  title: 'net/mlx5e: fix a double-free in arfs_create_groups'
+  mainline: 3c6d5189246f590e4e1f167991558bdb72a4738b
+  backport: c68c6c612420fbc4d139aae2815f9cb4b4477ee0
+de19690509d3fe9374922b36bb5f2de25d76f75c:
+  title: 'netfilter: nf_tables: restrict anonymous set and map names to 16 bytes'
+  mainline: b462579b2b86a8f5230543cadd3a4836be27baf7
+  backport: aa81ef3caf4be77e37974492532e649a2fcb19f8
+3dfd95c03c387368f519339499b27e2de5aeb998:
+  title: 'fjes: fix memleaks in fjes_hw_setup'
+  mainline: f6cc4b6a3ae53df425771000e9c9540cce9b7bb1
+  backport: c655c5bcecd961e52b149f6ca3931ccb3fea68c4
+ba33e0ab29dab25e63b1e2d0c8200798729bb759:
+  title: 'net: fec: fix the unhandled context fault from smmu'
+  mainline: 5e344807735023cd3a67c37a1852b849caa42620
+  backport: 6fa5ff53b288d8a31412cbf775292e5355d2aa62
+e50c68c5202041af6e5e8f6917f9b9bb8dcadbcc:
+  title: 'btrfs: don''t warn if discard range is not aligned to sector'
+  mainline: a208b3f132b48e1f94f620024e66fea635925877
+  backport: 762a825fada9668d550eddd794000c7f2caccdfa
+f084057282bc5f45e5f50a4b226244a30666422d:
+  title: 'btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args'
+  mainline: 173431b274a9a54fc10b273b46e67f46bcf62d2e
+  backport: 7b51f7d4004c09506c8b18d952ac742f27a3ef61
+8365e9d92b85fda975a5ece7a3a139cb964018c8:
+  title: 'netfilter: nf_tables: reject QUEUE/DROP verdict parameters'
+  mainline: f342de4e2f33e0e39165d8639387aa6c19dff660
+  backport: 0d987a601a2677d5d2632e82dcaa3fd47eda8d5e
+c8bd34e256d33bf1ccce1540fbfe3e4dbd3d2c8e:
+  title: 'gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04'
+  mainline: 805c74eac8cb306dc69b87b6b066ab4da77ceaf1
+  backport: 64ae55163661acf809649c0635c6b21e5d028ae6
+376e21a9e4c2c63ee5d8d3aa74be5082c3882229:
+  title: 'drm: Don''t unref the same fb many times by mistake due to deadlock handling'
+  mainline: cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c
+  backport: c8c5f7898fcca7d74c44b655d176277efb9fea24
+80cb196c51aaf67c29f7fc59ae8d5d77f13d650b:
+  title: 'drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking'
+  mainline: 914437992876838662c968cb416f832110fb1093
+  backport: c08fbf9dc1f387f205d5bcc50e015e63b4c9e0a4
+245c7e59073add7c4bec107a7abb5f473fbb6762:
+  title: 'drm/bridge: nxp-ptn3460: simplify some error checking'
+  mainline: 28d3d0696688154cc04983f343011d07bf0508e4
+  backport: a763a5bff50097dc988f3ac6a4e39aba8cfa1c1c
+8480240c551f51529f4bfc7447e8177f35b4efc5:
+  title: 'drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume'
+  mainline: 4050957c7c2c14aa795dbf423b4180d5ac04e113
+  skipped: missing prerequisite
+9bc5b61ea590de57e4c82038b183e634bc4519c9:
+  title: 'gpio: eic-sprd: Clear interrupt after set the interrupt type'
+  mainline: 84aef4ed59705585d629e81d633a83b7d416f5fb
+  skipped: missing prerequisite
+4f5ce9429566979ea623f6f3b897d0d1bebd6b46:
+  title: 'mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan'
+  mainline: 59be5c35850171e307ca5d3d703ee9ff4096b948
+  backport: 33922b26c79b28d52cdd80634cef19adfc8af24d
+7c0fdf4485c7bb02a1c7d7a4a68c3686d6ac5d53:
+  title: 'tick/sched: Preserve number of idle sleeps across CPU hotplug events'
+  mainline: 9a574ea9069be30b835a3da772c039993c43369b
+  backport: fd36c0072c50e2198c71ffcdf773f3a80efb4d86
+d20c05fc2f18651d19ef881d403a0ccf8ce8b8e1:
+  title: 'x86/entry/ia32: Ensure s32 is sign extended to s64'
+  mainline: 56062d60f117dccfb5281869e0ab61e090baf864
+  skipped: missing prerequisite
+bbd8e460c478adbc88e2ec4e2414931a59791348:
+  title: 'net/sched: cbs: Fix not adding cbs instance to list'
+  mainline: 3e8b9bfa110896f95d602d8c98d5f9d67e41d78c
+  skipped: missing prerequisite
+21e45a7b08d7cd98d6a53c5fc5111879f2d96611:
+  title: 'powerpc/mm: Fix null-pointer dereference in pgtable_cache_add'
+  mainline: f46c8a75263f97bda13c739ba1c90aced0d3b071
+  backport: 3acd7d14ab042ec3180ad82f70f02c1640d70c0b
+8dc842cd56b541d8f82daa2dd0d178add07ed384:
+  title: 'powerpc: Fix build error due to is_valid_bugaddr()'
+  mainline: f8d3555355653848082c351fa90775214fb8a4fa
+  backport: 985b459da1516795390094540cd97bbea8263903
+d30f1f01acd2a4bcd819c346770ec0344b325bc1:
+  title: 'powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()'
+  mainline: d8c3f243d4db24675b653f0568bb65dae34e6455
+  backport: 74b8b0d494bf916399a7d32153e2234299bce7cb
+42084a428a139f1a429f597d44621e3a18f3e414:
+  title: 'powerpc/lib: Validate size for vector operations'
+  mainline: 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59
+  backport: 20d558564e788fe68498849aafc685f7beeaa85d
+ee56b48a402f37f239cb0ab94ae0a2fa7dd31eb9:
+  title: 'audit: Send netlink ACK before setting connection in auditd_set'
+  mainline: 022732e3d846e197539712e51ecada90ded0572a
+  backport: 309b71479dd509d167afbf01830396412b280494
+a4d8109395c1ab519ac9b421cc4ebe95cb75b64d:
+  title: 'ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop'
+  mainline: 143176a46bdd3bfbe9ba2462bf94458e80d65ebf
+  backport: 15378f86c8f6fd91b5c159500e13bd46a3b15a7e
+1f850064aeccaaa45a62285df4c227dcd90c852c:
+  title: 'PNP: ACPI: fix fortify warning'
+  mainline: ba3f5058db437d919f8468db50483dd9028ff688
+  backport: 6137fbdcc97d6e46ab81b911e0dd963423c9ac64
+b7b33627be0626b16ca321b982d6a2261ef7f703:
+  title: 'ACPI: extlog: fix NULL pointer dereference check'
+  mainline: 72d9b9747e78979510e9aafdd32eb99c7aa30dd1
+  backport: 93c7bcddd0ab070061059a25c7c776ad0a7c6e19
+e3e95c6850661c77e6dab079d9b5374a618ebb15:
+  title: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
+  mainline: 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68
+  backport: dffbd4f7153e15063036c40c39c6f4162cdaacce
+e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af:
+  title: 'UBSAN: array-index-out-of-bounds in dtSplitRoot'
+  mainline: 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16
+  backport: b55d66744550c1de80b8e7d070f3d0ea112102da
+ce8bc22e948634a5c0a3fa58a179177d0e3f3950:
+  title: 'jfs: fix slab-out-of-bounds Read in dtSearch'
+  mainline: fa5492ee89463a7590a1449358002ff7ef63529f
+  backport: 83cbf9397419353ed0c7db735f115cd919f226a3
+3d3898b4d72c677d47fe3cb554449f2df5c12555:
+  title: 'jfs: fix array-index-out-of-bounds in dbAdjTree'
+  mainline: 74ecdda68242b174920fe7c6133a856fb7d8559b
+  backport: 90cde898a4c41373b7c416d69815e9d7896b347a
+81b4249ef37297fb17ba102a524039a05c6c5d35:
+  title: 'jfs: fix uaf in jfs_evict_inode'
+  mainline: e0e1958f4c365e380b17ccb35617345b31ef7bf3
+  backport: 364aa896131c66f247c842cce51c85f1cdcfe45f
+8b69c30f4e8b69131d92096cb296dc1f217101e4:
+  title: 'pstore/ram: Fix crash when setting number of cpus to an odd number'
+  mainline: d49270a04623ce3c0afddbf3e984cb245aa48e9c
+  backport: 8bd89028a322d70b0858c38060c0a5b3084d91f5
+0ca44249ad08ff59354cd06a9148cf024f7bbe54:
+  title: 'crypto: stm32/crc32 - fix parsing list of devices'
+  mainline: 0eaef675b94c746900dcea7f6c41b9a103ed5d53
+  skipped: missing prerequisite 06bd7d87ab25e72a5e9314b5009bd19ae4ca21e0
+36f1e250b5966adb2536f2b1ee86f8d231fadec7:
+  title: 'afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()'
+  mainline: 1702e0654ca9a7bcd7c7619c8a5004db58945b71
+  skipped: missing prerequisite 06bd7d87ab25e72a5e9314b5009bd19ae4ca21e0
+1ba072b2f552823c3070dde7909f7615b131f956:
+  title: 'rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()'
+  mainline: bad1a11c0f061aa073bab785389fe04f19ba02e1
+  backport: 96c5817c65966bcdcdec5ff419eb31c42ad9046d
+f423528488e4f9606cef858eceea210bf1163f41:
+  title: 'jfs: fix array-index-out-of-bounds in diNewExt'
+  mainline: 49f9637aafa6e63ba686c13cb8549bf5e6920402
+  backport: 7e68d5085eb75299c781f7014ef6947822e30686
+6ccf904aac0292e1f6b1a1be6c407c414f7cf713:
+  title: 's390/ptrace: handle setting of fpc register correctly'
+  mainline: 8b13601d19c541158a6e18b278c00ba69ae37829
+  backport: 4208eff2d2a4e2fdc740c7e74cb1ed97a955d4ee
+3a04410b0bc7e056e0843ac598825dd359246d18:
+  title: 'KVM: s390: fix setting of fpc register'
+  mainline: b988b1bb0053c0dcd26187d29ef07566a565cf55
+  backport: 1f85aac19a14227a6885559b4b4cdd0dcd175fa1
+fece80a2a6718ed58487ce397285bb1b83a3e54e:
+  title: 'SUNRPC: Fix a suspicious RCU usage warning'
+  mainline: 31b62908693c90d4d07db597e685d9f25a120073
+  backport: 3d8aee1169f45a8ea3015adafd87b73f603fbdeb
+51be5ada42310c9b476965599cb9cffe71a3d102:
+  title: 'ext4: fix inconsistent between segment fstrim and full fstrim'
+  mainline: 68da4c44b994aea797eb9821acb3a4a36015293e
+  skipped: missing prerequisites, risky backports required
+17c04def41743d01067a4c347b2d429f847c28c3:
+  title: 'ext4: unify the type of flexbg_size to unsigned int'
+  mainline: 658a52344fb139f9531e7543a6e0015b630feb38
+  backport: 38f20840ac95180eccf512780f7454f85b2bf99e
+b92f5db0fb2c8e666dcd1c41be2c38eae5d50898:
+  title: 'ext4: remove unnecessary check from alloc_flex_gd()'
+  mainline: b099eb87de105cf07cad731ded6fb40b2675108b
+  skipped: precondition for patch is not satisfied
+cd1f93ca97a9136989f3bd2bf90696732a2ed644:
+  title: 'ext4: avoid online resizing failures due to oversized flex bg'
+  mainline: 5d1935ac02ca5aee364a449a35e2977ea84509b0
+  skipped: missing prerequisites, risky backports required
+273700c2b94ffe7da97cee356f826d1d3f525b1d:
+  title: 'scsi: lpfc: Fix possible file string name overflow when updating firmware'
+  mainline: f5779b529240b715f0e358489ad0ed933bf77c97
+  backport: 13df229677abd27615136f5c763c3a476b6ad5fd
+07f181ed637a9867712f6a13f536453125b024ad:
+  title: 'PCI: Add no PM reset quirk for NVIDIA Spectrum devices'
+  mainline: 3ed48c80b28d8dcd584d6ddaf00c75b7673e1a05
+  backport: bb52b4b4fc58efa71970b07a27c918d0250cffa8
+0fee6850e1b0a032580ef2af3c9eb6f68e57d9d0:
+  title: 'bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk'
+  mainline: d6b83f1e3707c4d60acfa58afd3515e17e5d5384
+  backport: 98bddfaba61e706ba3198d9f791cd66bba6103cb
+27e147bd10bdca40b504644b536561fdb46f42e0:
+  title: 'ARM: dts: imx7s: Fix lcdif compatible'
+  mainline: 5f55da4cc37051cda600ea870ce8cf29f1297715
+  backport: 0ac0f96f90a5a03d0f2e4ac73257d5874c9aed24
+b90391b6bfd67d81e6126a4d07bf29da7af36eb4:
+  title: 'ARM: dts: imx7s: Fix nand-controller #size-cells'
+  mainline: 4aadb841ed49bada1415c48c44d21f5b69e01299
+  backport: 647e4506427c48a511e3b67b12eef2645bc61301
+f44f073c78112ff921a220d01b86d09f2ace59bc:
+  title: 'wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()'
+  mainline: 2adc886244dff60f948497b59affb6c6ebb3c348
+  backport: d64a7edab1b9eb618164ee97ba6ca2e0c2c39410
+5aa1e7d3f6d0db96c7139677d9e898bbbd6a7dcf:
+  title: 'bpf: Add map and need_defer parameters to .map_fd_put_ptr()'
+  mainline: 20c20bd11a0702ce4dc9300c3da58acf551d9725
+  backport: 7474abe2c012625b0cc7f08d5089c1510d92a608
+debaf1600843a98fe794923781d731c2ccf5a1e8:
+  title: 'scsi: libfc: Don''t schedule abort twice'
+  mainline: b57c4db5d23b9df0118a25e2441c9288edd73710
+  backport: f3402b957fdf478a6f115e958f514e61c64cb846
+1cfcd5845f6141ea6580d13fc021fce7de324d3e:
+  title: 'scsi: libfc: Fix up timeout error in fc_fcp_rec_error()'
+  mainline: 53122a49f49796beb2c4a1bb702303b66347e29f
+  backport: d49f575f0871d9008dbc471e24bb06afd954e336
+281c16796d60e713cb86c08e09200d290232c6d3:
+  title: 'ARM: dts: rockchip: fix rk3036 hdmi ports node'
+  mainline: 27ded76ef0fcfcf939914532aae575cf23c221b4
+  backport: 2bcbb1bff89713910536e9aec5f42ce8d106a86b
+26633c330ad956bf3878057f88395a5aae89240f:
+  title: 'ARM: dts: imx25/27-eukrea: Fix RTC node name'
+  mainline: 68c711b882c262e36895547cddea2c2d56ce611d
+  backport: 131b53e398cd5cdd930d6b5c404953142b0ee046
+9c5dc6b0e2d37b8e718cf3ef66c4a2f771dee20e:
+  title: 'ARM: dts: imx: Use flash@0,0 pattern'
+  mainline: 1e1d7cc478fb16816de09740e3c323c0c188d58f
+  backport: 7c4c3abbd88ea0d578de393487684dadd026c0f1
+0ab77b773ebcc5aa5087fdd18deb851a7ed6a3a6:
+  title: 'ARM: dts: imx27: Fix sram node'
+  mainline: 2fb7b2a2f06bb3f8321cf26c33e4e820c5b238b6
+  backport: f6bc8318f88aae9883253889f9e36bda8841e891
+9d3aeecaac3030a1d95ed0483ecbf16c89e403f0:
+  title: 'ARM: dts: imx1: Fix sram node'
+  mainline: c248e535973088ba7071ff6f26ab7951143450af
+  backport: 9fc574b8c1464071d8319710708885ccc0a431b4
+6296b2c41f0bca9e1308d4d7a85800245b486ad9:
+  title: 'ARM: dts: imx27-apf27dev: Fix LED name'
+  mainline: dc35e253d032b959d92e12f081db5b00db26ae64
+  backport: a85363dccc0d0d632635e01c29fe341129125f9f
+cf146a95be04e40b317c38b116b2efd4b043c3dd:
+  title: 'ARM: dts: imx23-sansa: Use preferred i2c-gpios properties'
+  mainline: e3aa1a82fb20ee97597022f6528823a8ab82bde6
+  backport: c462fbab07ab0f93ec19d7a6d907685ea1a06d54
+3d8e8afe1de475ab4d9470c6d731a1c0cf29deee:
+  title: 'ARM: dts: imx23/28: Fix the DMA controller node name'
+  mainline: 858d83ca4b50bbc8693d95cc94310e6d791fb2e6
+  backport: 7e7a432ac9ea935be11a15fea46457de63f7e112
+81ca80caa3c5c2e4e5d1da2dca42cc11964c1e9f:
+  title: 'md: Whenassemble the array, consult the superblock of the freshest device'
+  mainline: dc1cc22ed58f11d58d8553c5ec5f11cbfc3e3039
+  backport: da94a28d1bdc83ef21d12a68ed91787db4fa3b1e
+099b8d44c6a0ab899600f6ece6737ce8b527dbc7:
+  title: 'wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices'
+  mainline: 4e87ca403e2008b9e182239e1abbf6876a55eb33
+  backport: d68481e8bff48e47200f68c0f58b20891791c91d
+93aab385375ddd03a83f5b8444c665ee2c2b6d88:
+  title: 'wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()'
+  mainline: 5c16618bc06a41ad68fd8499a21d35ef57ca06c2
+  backport: a1351ac1cf686629cd1eb5b7a1065b3683611007
+fc736ef2b3b2e535c2ba46966bd8083365c96a11:
+  title: 'wifi: cfg80211: free beacon_ies when overridden from hidden BSS'
+  mainline: 32af9a9e1069e55bc02741fb00ac9d0ca1a2eaef
+  backport: b656f1f1849b925cd68ab74a777a9cc75f8d774a
+bc1fb291f36dd1d9d667241d9fe30b835dbb8ee8:
+  title: 'f2fs: fix to check return value of f2fs_reserve_new_block()'
+  mainline: 956fa1ddc132e028f3b7d4cf17e6bfc8cb36c7fd
+  skipped: missing prerequisites, risky backports required
+bbb3342c6343688fb673d7c6b51cbf8d184565d2:
+  title: 'ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument'
+  mainline: 67c7666fe808c3a7af3cc6f9d0a3dd3acfd26115
+  backport: edbe2c53887737af65f496c2265285f74a4768cd
+fabeeafdab5e1239e794b8ce72df02503d0ced83:
+  title: 'fast_dput(): handle underflows gracefully'
+  mainline: 504e08cebe1d4e1efe25f915234f646e74a364a8
+  backport: 658d3409acede1f86abdcfa706919570144a0b55
+c6d9287ebe4ed77ea34fa450a5d70f4984824181:
+  title: 'RDMA/IPoIB: Fix error code return in ipoib_mcast_join'
+  mainline: 753fff78f430704548f45eda52d6d55371a52c0f
+  backport: 4b7f4e14cc08eacfa5ca86eacc05a8271b28d889
+803bd61b474d6dbffc8c5418c61e8da586c94450:
+  title: 'drm/drm_file: fix use of uninitialized variable'
+  mainline: 1d3062fad9c7313fff9970a88e0538a24480ffb8
+  backport: abd23fc2b176740252f577b29693fbae20c1c8f5
+081d55ccd15d7edd3786c285866cdd06a28f2c6f:
+  title: 'drm/framebuffer: Fix use of uninitialized variable'
+  mainline: f9af8f0c1dc567a5a6a6318ff324c45d80d4a60f
+  backport: 99467f7e403930a41f8bea2542279956188c128d
+9eef5de467f413e14c9b145aa41914334c29f8a7:
+  title: 'drm/mipi-dsi: Fix detach call without attach'
+  mainline: 90d50b8d85834e73536fdccd5aa913b30494fef0
+  backport: d6660003336dbf23b039bcb0601dff7a42f14f0d
+3f61c5b5bb53a842d683680c347366b9c431c3b4:
+  title: 'media: stk1160: Fixed high volume of stk1160_dbg messages'
+  mainline: b3695e86d25aafbe175dd51f6aaf6f68d341d590
+  backport: edc53e8e2a27c8774234a5e3b143fdd6c3136644
+c72698ef0ff2fbc4baa73fa1030dbe6dd8fd3f48:
+  title: 'media: rockchip: rga: fix swizzling for RGB formats'
+  mainline: 9e7dc39260edac180c206bb6149595a40eabae3e
+  skipped: file/driver does not exist
+a6265345461f1580efd7e38ba6b9506dda987d23:
+  title: 'PCI: add INTEL_HDA_ARL to pci_ids.h'
+  mainline: 5ec42bf04d72fd6d0a6855810cc779e0ee31dfd7
+  backport: 3590c7ea1d2a0882c4e8969300159543fda974aa
+fa7eb2295f5fb213b4c5583bd1a3be6fdb682185:
+  title: 'ALSA: hda: Intel: add HDA_ARL PCI ID support'
+  mainline: a31014ebad617868c246d3985ff80d891f03711e
+  backport: e3d7a6fbda19cd9d3d62c61f0557b2ddcbc86c4f
+8ab9b22151400c549f40f2390f1d101d80ec089e:
+  title: 'drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time'
+  mainline: 16ac5b21b31b439f03cdf44c153c5f5af94fb3eb
+  backport: c5e1693a823b9baaba503fd12531f9b7ae802a8d
+4c8922ae8eb8dcc1e4b7d1059d97a8334288d825:
+  title: 'IB/ipoib: Fix mcast list locking'
+  mainline: 4f973e211b3b1c6d36f7c6a19239d258856749f9
+  backport: f1a52361385cf56587f45df0e419270b476fb717
+7fe1190951cf4f45ff602250b29c4665c264b78e:
+  title: 'media: ddbridge: fix an error code problem in ddb_probe'
+  mainline: 09b4195021be69af1e1936cca995712a6d0f2562
+  backport: a113f3ea4415f689541d9452c474ae03fc2e38d4
+db86a8d0d5ca6a3ca59f00a64ca4293fa9ff3a31:
+  title: 'drm/msm/dpu: Ratelimit framedone timeout msgs'
+  mainline: 2b72e50c62de60ad2d6bcd86aa38d4ccbdd633f2
+  skipped: file/driver does not exist
+c807df25c33f1365fda042b11085a4861ec6e4f9:
+  title: 'clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()'
+  mainline: bfbea9e5667cfa9552c3d88f023386f017f6c308
+  backport: 9b68e07d9da7ee0571e1bdd80bf64f631345fedb
+15b51ad774214f9bd9a969bf4880ebeb4dbd4868:
+  title: 'clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()'
+  mainline: 2fbabea626b6467eb4e6c4cb7a16523da12e43b4
+  backport: 96bc3d1b305d5d5fe2b95d94b86b46a902bd146b
+b5e7f9e6d604f80e93ecc0873f1d2bce56d965a2:
+  title: 'drm/amdgpu: Let KFD sync with VM fences'
+  mainline: ec9ba4821fa52b5efdbc4cdf0a77497990655231
+  skipped: missing prerequisite d8d019ccffb838bb0dd98e583b5c25ccc0bc6ece
+7291c4e2f8cf0f9c29a390f6f49fe03c3835c13f:
+  title: 'drm/amdgpu: Drop ''fence'' check in ''to_amdgpu_amdkfd_fence()'''
+  mainline: bf2ad4fb8adca89374b54b225d494e0b1956dbea
+  skipped: missing prerequisite d8d019ccffb838bb0dd98e583b5c25ccc0bc6ece
+6c0a90374357d7bc3fde5fc096ae996699e4eb22:
+  title: 'leds: trigger: panic: Don''t register panic notifier if creating the trigger failed'
+  mainline: afacb21834bb02785ddb0c3ec197208803b74faa
+  backport: c33e46a8972e0956bf361ede13f448eaa042181a
+7ad082147c5d4e74b06ee5d9fd992fcdc1bf75bb:
+  title: 'um: Fix naming clash between UML and scheduler'
+  mainline: 541d4e4d435c8b9bfd29f70a1da4a2db97794e0a
+  backport: d7d0f5e11bb0b6145733eb2cb28b3639388f84f6
+e0fe0da96187d485633cdcfe4ae41ca4d15dd412:
+  title: 'um: Don''t use vfprintf() for os_info()'
+  mainline: 236f9fe39b02c15fa5530b53e9cca48354394389
+  backport: 9b93ed7199417436eb33dc11cd20fc5d4964f693
+af95ebc8ed68503602b0490faca91df4a844b223:
+  title: 'um: net: Fix return type of uml_net_start_xmit()'
+  mainline: 7d748f60a4b82b50bf25fad1bd42d33f049f76aa
+  backport: a0b367d347123053abb1b97bc22154dab9ae22f3
+bad080a74ac807a1dac93c9db96156a434bb5cb4:
+  title: 'mfd: ti_am335x_tscadc: Fix TI SoC dependencies'
+  mainline: 284d16c456e5d4b143f375b8ccc4038ab3f4ee0f
+  backport: 7a559ea7d22e2523c0c38d7597c79e8f5c663823
+a17d6ef61d1615851dbf0111ce1e61af4a897804:
+  title: 'PCI: Only override AMD USB controller if required'
+  mainline: e585a37e5061f6d5060517aed1ca4ccb2e56a34c
+  backport: 79a5e39dee6e10829a945d9f6a5761bdb46c3803
+2ba7f86b8703af8ace1a011b041c2bd654409e3d:
+  title: 'usb: hub: Replace hardcoded quirk value with BIT() macro'
+  mainline: 6666ea93d2c422ebeb8039d11e642552da682070
+  backport: 2b84420be156e351f2e9d5975ed7679bdda1ff19
+0d143f52174d588228fa73275de701d58b62ea4a:
+  title: 'libsubcmd: Fix memory leak in uniq()'
+  mainline: ad30469a841b50dbb541df4d6971d891f703c297
+  backport: 56552e5cf5d1e10d74d67c2b9a5adc4f258faee5
+7840b2e4ba3e9288df84dac1417102a174c71229:
+  title: "virtio_net: Fix \"\u2018%d\u2019 directive writing between 1 and 11 bytes into a region of size 10\" warnings"
+  mainline: e3fe8d28c67bf6c291e920c6d04fa22afa14e6e4
+  backport: 7f727e04636fa507a472cd48c5b7822fd92fa973
+9525b38180e2753f0daa1a522b7767a2aa969676:
+  title: 'blk-mq: fix IO hang from sbitmap wakeup race'
+  mainline: 5266caaf5660529e3da53004b8b7174cab6374ed
+  skipped: missing prerequisites, risky backports required
+eb55ba8aa7fb7aad54f40fbf4d8dcdfdba0bebf6:
+  title: 'ceph: fix deadlock or deadcode of misusing dget()'
+  mainline: b493ad718b1f0357394d2cdecbf00a44a36fa085
+  backport: 7da16dee92cf04281c2b9ba054ed1277bdef0745
+616053201f939cb326836316d8afcd1e3d2df18b:
+  title: 'drm/amdgpu: Release ''adev->pm.fw'' before return in ''amdgpu_device_need_post()'''
+  mainline: 8a44fdd3cf91debbd09b43bd2519ad2b2486ccf4
+  backport: f6292d4326aea4ef58ca1b9e0050d4531b09b656
+e01d8d01ba197cac99bef2495fbf5640f0bc5a72:
+  title: 'wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update'
+  mainline: 1184950e341c11b6f82bc5b59564411d9537ab27
+  backport: 4a8a10a1d1379bb73f929d2ff61c91cd50fa76e1
+86ca4cb47d8213773044b151e6861784d646ee35:
+  title: 'scsi: isci: Fix an error code problem in isci_io_request_build()'
+  mainline: 658365c6b0857e6a306436e315a8633937e3af42
+  backport: 9b0dce0699b0cff330f26757170390e60beecc2f
+b2460d9640b13afd691f35b075d16f7fc179c7cb:
+  title: 'net: remove unneeded break'
+  mainline: 7ebb9db011088f9bd357791f49cb7012e66f29e2
+  backport: 287b49e9dddc421e7cbcf2ce9ded277dcd7bb385
+aba0ff77fce0db42a45de1dca5d34aa717d5415c:
+  title: 'ixgbe: Remove non-inclusive language'
+  mainline: 93b067f154b3edfd3d75a272fd9433bf787e2e1d
+  backport: 6c59597adc4da77a4c79730b2d0d2f6bb5103f07
+e7e9a533e87d1e545e9ea2bed74037acd430f639:
+  title: 'ixgbe: Refactor returning internal error codes'
+  mainline: 5795f533f30a80aa0473652876296ebc9129e33a
+  skipped: missing prerequisites, risky backports required
+d9ffeffbc43250255f087adb55b1a99cd4fe0c43:
+  title: 'ixgbe: Refactor overtemp event handling'
+  mainline: 6c1b4af8c1b20c70dde01e58381685d6a4a1d2c8
+  backport: 12a1e3ffea01766734037b0fe1369d278b669d88
+b74c5d0d164efc6a9ebd5e880234987e1e8970d1:
+  title: 'ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()'
+  mainline: bbc404d20d1b46d89b461918bc44587620eda200
+  backport: 0fad6add2e903cf769f5d922a43c6616fce2d590
+e6b0f4f7e3b2429d78a54ad5ec705b4119010c32:
+  title: 'ipv6: Ensure natural alignment of const ipv6 loopback and router addresses'
+  mainline: 60365049ccbacd101654a66ddcb299abfabd4fc5
+  backport: e0ffb3925dba851417d00745b2ce9c4b314589c3
+6b950c712a9a05cdda4aea7fcb2848766576c11b:
+  title: 'llc: call sock_orphan() at release time'
+  mainline: aa2b2eb3934859904c287bf5434647ba72e14c1c
+  backport: 86c1617a51a7e041f7b3106e796f5dd4177a53e2
+b0b2937fda85f1eaf885527518993a035cfa13bc:
+  title: 'netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger'
+  mainline: 259eb32971e9eb24d1777a28d82730659f50fdcb
+  backport: a0373ec83347192d0bc2f3352c074e8b023c42a5
+3241813266b623a1153db37f0204cf4225bd6864:
+  title: 'net: ipv4: fix a memleak in ip_setup_cork'
+  mainline: 5dee6d6923458e26966717f2a3eae7d09fc10bf6
+  backport: f4e1df41128d009e3eb57658e1304d2f35109b50
+875f31aaa67e306098befa5e798a049075910fa7:
+  title: 'af_unix: fix lockdep positive in sk_diag_dump_icons()'
+  mainline: 4d322dce82a1d44f8c83f0f54f95dd1b8dcf46c9
+  backport: fc4e079263f4dc3afed7beef32f09e11cfdb83ff
+3dc7b3ffd5c539124ee8fc42a32a91b5df13717d:
+  title: 'net: sysfs: Fix /sys/class/net/<iface> path'
+  mainline: ae3f4b44641dfff969604735a0dcbf931f383285
+  backport: 17fe0fd15062dc03aedcf4bb6572a4a9592807b6
+adfbe479c1b60c4e97734dfbeeb483fe37a9df71:
+  title: 'HID: apple: Add support for the 2021 Magic Keyboard'
+  mainline: 0cd3be51733febb4f8acb92bcf55b75fe824dd05
+  backport: 7412effbe212ef6ccdf8e42b1c40364e6c369a17
+f27e9a72c1079449474ab6b4858bd30ec3d9ec89:
+  title: 'HID: apple: Swap the Fn and Left Control keys on Apple keyboards'
+  mainline: 346338ef00d35bf8338ded171f9abeb9b10b43df
+  backport: 985d3a3dd71c81ab2012fd3b8f0a769c71a19237
+0802f8e32b0212b3e5f14eb729c96e6d90a47934:
+  title: 'HID: apple: Add 2021 magic keyboard FN key mapping'
+  mainline: 531cb56972f2773c941499fcfb639cd5128dfb27
+  backport: e42213c7c7b015e6b41fb27d9b6264309042a750
+9bb3bf598f4b0f5481dbc585db2d5021304ac1b5:
+  title: 'bonding: remove print in bond_verify_device_path'
+  mainline: 486058f42a4728053ae69ebbf78e9731d8ce6f8b
+  backport: e827391d4767cbb6a25f85d1e17c05799f6f81f6
+743259cc178aee41626f5929ed9ea6f63bb0c631:
+  title: 'dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV'
+  mainline: a22fe1d6dec7e98535b97249fdc95c2be79120bb
+  backport: 7f0c76f847575a92100f05495514a3464534d593
+486218c11e8d1c8f515a3bdd70d62203609d4b6b:
+  title: 'phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP'
+  mainline: 7104ba0f1958adb250319e68a15eff89ec4fd36d
+  backport: 24288c6c65f514b98d7b1c1feb237b51a56ab054
+bd70b7541b30213829ca7a2d02e428a4449821ff:
+  title: 'atm: idt77252: fix a memleak in open_card_ubr0'
+  mainline: f3616173bf9be9bf39d131b120d6eea4e6324cb5
+  backport: 56dc4afb9fa67af5b158a6b184216302e793a0b7
+52830e218a4d5e38c6a781c7912da777252f8c40:
+  title: 'hwmon: (aspeed-pwm-tacho) mutex for tach reading'
+  mainline: 1168491e7f53581ba7b6014a39a49cfbbb722feb
+  backport: 2214d04c620940a739fa5a5ce070a3c785aa0cd5
+93f0f4e846fcb682c3ec436e3b2e30e5a3a8ee6a:
+  title: 'hwmon: (coretemp) Fix out-of-bounds memory access'
+  mainline: 4e440abc894585a34c2904a32cd54af1742311b3
+  skipped: missing prerequisite
+8726dfd0ff7e2c595d3ae29bda59099868274cdd:
+  title: 'hwmon: (coretemp) Fix bogus core_id to attr name mapping'
+  mainline: fdaf0c8629d4524a168cb9e4ad4231875749b28c
+  skipped: missing prerequisite
+caa064c3c2394d03e289ebd6b0be5102eb8a5b40:
+  title: 'inet: read sk->sk_family once in inet_recv_error()'
+  mainline: eef00a82c568944f113f2de738156ac591bbd5cd
+  backport: 2ac57567eda95eb1a9c39e819eab709767452dfe
+16d97ffdca5515fccc7c969b6025d1551e84fe34:
+  title: 'rxrpc: Fix response to PING RESPONSE ACKs to a dead call'
+  mainline: 6f769f22822aa4124b556339781b04d810f0e038
+  backport: 5a9a22f2873e63cd857c7a6659f3d38484ac2e70
+24ec8f0da93b8a9fba11600be8a90f0d73fb46f1:
+  title: 'tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()'
+  mainline: 3871aa01e1a779d866fa9dfdd5a836f342f4eb87
+  backport: 96d352f660e2e222dc1bab6b2c4740237dd3b305
+4fdb14ba89faff6e6969a4dffdc8e54235d6e5ed:
+  title: 'ppp_async: limit MRU to 64K'
+  mainline: cb88cb53badb8aeb3955ad6ce80b07b598e310b8
+  backport: de3d17a308ceded0363dffa3b2ee69b9fbfbb6cc
+56fb2bf4ab8c91a2e078553497b6c5b2f1dac699:
+  title: 'netfilter: nft_compat: reject unused compat flag'
+  mainline: 292781c3c5485ce33bd22b2ef1b2bed709b4d672
+  backport: a057d02cf808c2c042d13aa9ada37a250fe329f2
+1d769e2dc5444c3ab3010887d7c3cda76a0310e7:
+  title: 'netfilter: nft_compat: restrict match/target protocol to u16'
+  mainline: d694b754894c93fb4d71a7f3699439dec111decc
+  backport: 990506c3102a4016f10a7b705a3f95a2dba0e567
+8811188205406ce59c34fabc18e2421b38c03fdd:
+  title: 'net/af_iucv: clean up a try_then_request_module()'
+  mainline: 4eb9eda6ba64114d98827e2870e024d5ab7cd35b
+  backport: 700f4e9ff1bac4b1bc1780bcc9cf5695e4392028
+e3cd866fcbeb03b13f6fc7b6133cb542c8484c4a:
+  title: 'USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e'
+  mainline: 129690fb229a20b6e563a77a2c85266acecf20bc
+  backport: 6716f2f7d44fa8420f77009a11593525ae9255b2
+9c83c6116f5dde982e1f33a1b47bde2991ac8ac5:
+  title: 'USB: serial: option: add Fibocom FM101-GL variant'
+  mainline: b4a1f4eaf1d798066affc6ad040f76eb1a16e1c9
+  backport: 39a732c5a779ddbfbc3e662856dfcaa717af4a26
+80af54d045296bab4e2fe8704b4b9fc1f533e47b:
+  title: 'USB: serial: cp210x: add ID for IMST iM871A-USB'
+  mainline: 12b17b4eb82a41977eb848048137b5908d52845c
+  backport: b30273541bae7aaec17a09c2780e4a4c395edde1
+0be65249b72efb7d6eec6aabbb9901f22b4c9856:
+  title: 'Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID'
+  mainline: 683cd8259a9b883a51973511f860976db2550a6e
+  backport: eebb66beca62cded341b539533c7c7a91da8ac95
+95eab1039625d54d1770665756dd34e9fe926638:
+  title: 'vhost: use kzalloc() instead of kmalloc() followed by memset()'
+  mainline: 4d8df0f5f79f747d75a7d356d9b9ea40a4e4c8a9
+  backport: 7d25e28ce6dc61080ffcab293998214b86a14b11
+1aa4f696306dfe4f0d453eeb1e90f26cd10d8ed5:
+  title: 'hrtimer: Report offline hrtimer enqueue'
+  mainline: dad6a09f3148257ac1773cd90934d721d68ab595
+  skipped: missing prerequisite
+3f50c451215884639659b77ab7f33d98c40fced3:
+  title: 'btrfs: forbid creating subvol qgroups'
+  mainline: 0c309d66dacddf8ce939b891d9ead4a8e21ad6f0
+  skipped: missing prerequisite
+be548d984286e2d58c3135aa0cf1cbafa0cad8a7:
+  title: 'btrfs: send: return EOPNOTSUPP on unknown flags'
+  mainline: f884a9f9e59206a2d41f265e7e403f080d10b493
+  backport: 6a49558f890e67f40142f23305b2b6dbffee6931
+80a642c11a91fdff66406b52197097d97685e4e1:
+  title: 'spi: ppc4xx: Drop write-only variable'
+  mainline: b3aa619a8b4706f35cb62f780c14e68796b37f3f
+  backport: 39be5d7e52744cac421786024357c1c3d7570597
+3dd2d99e2352903d0e0b8769e6c9b8293c7454b2:
+  title: 'ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()'
+  mainline: 6ef5d5b92f7117b324efaac72b3db27ae8bb3082
+  backport: 679ed29719be8e945287b4e87a641900507fe003
+b908fdcb6bbc07a3314afb386415b616fa01732f:
+  title: 'Documentation: net-sysfs: describe missing statistics'
+  mainline: e528afb72a481977456bb18345d4e7f6b85fa7b1
+  backport: dee976568a7a732baea9b4547a3a601896a32ec8
+e7928873d9ac5a6194f0ffc56549d4262af7e568:
+  title: 'net: sysfs: Fix /sys/class/net/<iface> path for statistics'
+  mainline: 5b3fbd61b9d1f4ed2db95aaf03f9adae0373784d
+  backport: 7a193babedaf498a625c7b82eea463c89589a2a2
+54d186fb5128ea95dbacbe350440208220555039:
+  title: 'MIPS: Add ''memory'' clobber to csum_ipv6_magic() inline assembler'
+  mainline: d55347bfe4e66dce2e1e7501e5492f4af3e315f8
+  backport: c3be0bd42d8b5436b4f4fc9e2261b3d2a4c738e1
+04b9c13dc116af8ad88b98d6a96765e0fa4a2b23:
+  title: 'i40e: Fix waiting for queues of all VSIs to be disabled'
+  mainline: c73729b64bb692186da080602cd13612783f52ac
+  backport: 1260d580ea28af4201a331f13f5fb5b96da08f94
+bcf4a115a5068f3331fafb8c176c1af0da3d8b19:
+  title: 'tracing/trigger: Fix to return error if failed to alloc snapshot'
+  mainline: 0958b33ef5a04ed91f61cef4760ac412080c4e08
+  backport: 44ec3b6a27b2d303dced9d70ed708cc8d8ed3784
+c593d26fb5d577ef31b6e49a31e08ae3ebc1bc1e:
+  title: 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again'
+  mainline: 9319b647902cbd5cc884ac08a8a6d54ce111fc78
+  backport: deb218b8416f96a7cb91d0ce311dd3418729c827
+2303e0b4005c13c0faa6562e32886ebf8ee04f57:
+  title: 'HID: wacom: generic: Avoid reporting a serial of ''0'' to userspace'
+  mainline: ab41a31dd5e2681803642b6d08590b61867840ec
+  backport: 3e0c669b2a6d346166ce0c47d1abf45f69046404
+d943536197c1a05e377452af4ec7942e11d018f4:
+  title: 'HID: wacom: Do not register input devices until after hid_hw_start'
+  mainline: c1d6708bf0d3dd976460d435373cf5abf21ce258
+  backport: 7cf7d8509d54a81f1963ce1fb4346ca851f31ff3
+67d96ddb269523ba171b0c6f8582a9f32812447b:
+  title: 'USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT'
+  mainline: f17c34ffc792bbb520e4b61baa16b6cfc7d44b13
+  backport: 6f2e6123d897f20b9e8ba8e47c2466909dcb5580
+68a8f87c9c2e514eb9bded7337044142ff7c1ba0:
+  title: 'usb: f_mass_storage: forbid async queue when shutdown happen'
+  mainline: b2d2d7ea0dd09802cf5a0545bf54d8ad8987d20c
+  backport: b7b8de89e0c14584f675cf1c1e7ceb648ae1d1e1
+94a600226b6d0ef065ee84024b450b566c5a87d6:
+  title: 'scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"'
+  mainline: 977fe773dcc7098d8eaf4ee6382cb51e13e784cb
+  backport: 5b4d630c61084a0afa27b2d6e45335a84d333be3
+cc9e5616a31b3054be3852d41f91592cd21f4f83:
+  title: 'firewire: core: correct documentation of fw_csr_string() kernel API'
+  mainline: 5f9ab17394f831cb7986ec50900fa37507a127f1
+  backport: 3d027c0afcebe6338e106257e984a69500b9c1f6
+7e9a8498658b398bf11b8e388005fa54e40aed81:
+  title: 'nfc: nci: free rx_data_reassembly skb on NCI device cleanup'
+  mainline: bfb007aebe6bff451f7f3a4be19f4f286d0d5d9c
+  backport: e9ea3b98c3eeb1be14666afce0a52eca86630704
+543fc0ea771528b7e2aa793bea1c46952d64d404:
+  title: 'xen-netback: properly sync TX responses'
+  mainline: 7b55984c96ffe9e236eb9c82a2196e0b1f84990d
+  backport: 2f07b4feb7344a12863625df46967a3b6990a791
+dd64bb8329ce0ea27bc557e4160c2688835402ac:
+  title: 'binder: signal epoll threads of self-work'
+  mainline: 97830f3c3088638ff90b20dfba2eb4d487bf14d7
+  skipped: missing prerequisites, risky backports required
+b4fbb89d722cbb16beaaea234b7230faaaf68c71:
+  title: 'ext4: fix double-free of blocks due to wrong extents moved_len'
+  mainline: 55583e899a5357308274601364741a83e78d6ac4
+  backport: 0b85140d50e49360af625aa8ba84de40b18adbb7
+4a0efde7875822485ebfd991874d454d2347e1a0:
+  title: 'staging: iio: ad5933: fix type mismatch regression'
+  mainline: 6db053cd949fcd6254cea9f2cd5d39f7bd64379c
+  backport: d375940a2f5db7ac750a0c16fc7afeff22f09ddf
+8eed2abb51082d5363879b1090f5f5de654ee259:
+  title: 'ring-buffer: Clean ring_buffer_poll_wait() error return'
+  mainline: 66bbea9ed6446b8471d365a22734dc00556c4785
+  skipped: missing prerequisite ecf927000ce3265e9871c79d43c10ceed8bd61c9
+1b766291dda83cd077f784057c272b7c9cbd5647:
+  title: 'serial: max310x: set default value when reading clock ready bit'
+  mainline: 0419373333c2f2024966d36261fd82a453281e80
+  skipped: missing prerequisite
+d34c6d8add30a6d01f312f6ab1ba966828e882b8:
+  title: 'serial: max310x: improve crystal stable clock detection'
+  mainline: 93cd256ab224c2519e7c4e5f58bb4f1ac2bf0965
+  skipped: missing prerequisite
+360570fdd7a72b0bfd6dc6d47028a26927dff67f:
+  title: 'x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6'
+  mainline: f6a1892585cd19e63c4ef2334e26cd536d5b678d
+  skipped: missing prerequisite
+9149fef02dc1c54d2b4b9a555e11e7482f6ab583:
+  title: 'x86/mm/ident_map: Use gbpages only where full GB page should be mapped.'
+  mainline: d794734c9bbfe22f86686dc2909c25f5ffe1a572
+  backport: 5e09189142b229f4a7b98b105b89548bb1895b3d
+e0de24ef5b3efe5636668f5090fa0833c6fb5b77:
+  title: 'ALSA: hda/conexant: Add quirk for SWS JS201D'
+  mainline: 4639c5021029d49fd2f97fa8d74731f167f98919
+  backport: d24322c6c1cb11ee854b27d53e8f57598f58d906
+5278c3eb6bf5896417572b52adb6be9d26e92f65:
+  title: 'nilfs2: fix data corruption in dsync block recovery for small block sizes'
+  mainline: 67b8bcbaed4777871bb0dcc888fb02a614a98ab1
+  backport: a53d021d96e27b4e691be9bbf2b0e7e6a971a556
+228742b2ddfb99dfd71e5a307e6088ab6836272e:
+  title: 'nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()'
+  mainline: 38296afe3c6ee07319e01bb249aa4bb47c07b534
+  backport: 188292ff815215ff899d45a09e860000e12d53b7
+09e5ae88b985524cb4f559c81b684f77cb237893:
+  title: 'nfp: use correct macro for LengthSelect in BAR config'
+  mainline: b3d4f7f2288901ed2392695919b3c0e24c1b4084
+  backport: 59185e887608415f810273b3d66a7c0a82ab145a
+edb943366fe91647079b58fa85781006fbfbe34a:
+  title: 'irqchip/irq-brcmstb-l2: Add write memory barrier before exit'
+  mainline: b0344d6854d25a8b3b901c778b1728885dd99007
+  backport: ab54d44fa99cd6d87b05c7805ca0666c11b1fb36
+81c0229f34f0e1330789fae616b9e2219ab28477:
+  title: 'pmdomain: core: Move the unused cleanup to a _sync initcall'
+  mainline: 741ba0134fa7822fcf4e4a0a537a5c4cfd706b20
+  backport: 70bd0bc34ed8b422fb44e5f570cd8923f20f875b
+1e8c1c2a92692881ac7ec92dcf1c8a846584251b:
+  title: 'Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"'
+  mainline: bed9e27baf52a09b7ba2a3714f1e24e17ced386d
+  backport: 072057390d7c127c32d061f52c8255b6e4b77305
+3cd139875e9a7688b3fc715264032620812a5fa3:
+  title: 'sched/membarrier: reduce the ability to hammer on sys_membarrier'
+  mainline: 944d5fe50f3f03daacfea16300e656a1691c4a23
+  backport: edcd4473ab9ae8709bfdad2665bbb1d20f438364
+c4a09fdac625e64abe478dcf88bfa20406616928:
+  title: 'nilfs2: fix potential bug in end_buffer_async_write'
+  mainline: 5bc09b397cbf1221f8a8aacb1152650c9195b02b
+  backport: 9dc394f2da9b2208457484dbcdcf9cdb3ee2d7ed
+f8f51085b4be6132762ce0d8940071ccdcce2504:
+  title: 'lsm: new security_file_ioctl_compat() hook'
+  mainline: f1bb47a31dff6d4b34fb14e99850860ee74bb003
+  backport: cdb04bf58f0b42afc09c9a9ba1f22e19b432a345
+fca41e5b687e029f69e3a35a2fa31e2560e538dc:
+  title: 'netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()'
+  mainline: c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63
+  backport: 141272175d24b1f41c429b0364d5f5852f6daa2d

diff --git a/Documentation/ABI/testing/sysfs-class-net-queues b/Documentation/ABI/testing/sysfs-class-net-queues
index 0c0df91..2734cd9 100644
--- a/Documentation/ABI/testing/sysfs-class-net-queues
+++ b/Documentation/ABI/testing/sysfs-class-net-queues

@@ -1,4 +1,4 @@
-What:		/sys/class/<iface>/queues/rx-<queue>/rps_cpus
+What:		/sys/class/net/<iface>/queues/rx-<queue>/rps_cpus
 Date:		March 2010
 KernelVersion:	2.6.35
 Contact:	netdev@vger.kernel.org
@@ -8,7 +8,7 @@
 		network device queue. Possible values depend on the number
 		of available CPU(s) in the system.
 
-What:		/sys/class/<iface>/queues/rx-<queue>/rps_flow_cnt
+What:		/sys/class/net/<iface>/queues/rx-<queue>/rps_flow_cnt
 Date:		April 2010
 KernelVersion:	2.6.35
 Contact:	netdev@vger.kernel.org
@@ -16,7 +16,7 @@
 		Number of Receive Packet Steering flows being currently
 		processed by this particular network device receive queue.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/tx_timeout
+What:		/sys/class/net/<iface>/queues/tx-<queue>/tx_timeout
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org
@@ -24,7 +24,7 @@
 		Indicates the number of transmit timeout events seen by this
 		network interface transmit queue.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/tx_maxrate
+What:		/sys/class/net/<iface>/queues/tx-<queue>/tx_maxrate
 Date:		March 2015
 KernelVersion:	4.1
 Contact:	netdev@vger.kernel.org
@@ -32,7 +32,7 @@
 		A Mbps max-rate set for the queue, a value of zero means disabled,
 		default is disabled.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/xps_cpus
+What:		/sys/class/net/<iface>/queues/tx-<queue>/xps_cpus
 Date:		November 2010
 KernelVersion:	2.6.38
 Contact:	netdev@vger.kernel.org
@@ -42,7 +42,7 @@
 		network device transmit queue. Possible vaules depend on the
 		number of available CPU(s) in the system.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/hold_time
+What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/hold_time
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org
@@ -51,7 +51,7 @@
 		of this particular network device transmit queue.
 		Default value is 1000.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/inflight
+What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/inflight
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org
@@ -59,7 +59,7 @@
 		Indicates the number of bytes (objects) in flight on this
 		network device transmit queue.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit
+What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org
@@ -68,7 +68,7 @@
 		on this network device transmit queue. This value is clamped
 		to be within the bounds defined by limit_max and limit_min.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit_max
+What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit_max
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org
@@ -77,7 +77,7 @@
 		queued on this network device transmit queue. See
 		include/linux/dynamic_queue_limits.h for the default value.
 
-What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit_min
+What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit_min
 Date:		November 2011
 KernelVersion:	3.3
 Contact:	netdev@vger.kernel.org

diff --git a/Documentation/ABI/testing/sysfs-class-net-statistics b/Documentation/ABI/testing/sysfs-class-net-statistics
index 397118d..53e508c 100644
--- a/Documentation/ABI/testing/sysfs-class-net-statistics
+++ b/Documentation/ABI/testing/sysfs-class-net-statistics

@@ -1,4 +1,4 @@
-What:		/sys/class/<iface>/statistics/collisions
+What:		/sys/class/net/<iface>/statistics/collisions
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -6,7 +6,7 @@
 		Indicates the number of collisions seen by this network device.
 		This value might not be relevant with all MAC layers.
 
-What:		/sys/class/<iface>/statistics/multicast
+What:		/sys/class/net/<iface>/statistics/multicast
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -14,7 +14,7 @@
 		Indicates the number of multicast packets received by this
 		network device.
 
-What:		/sys/class/<iface>/statistics/rx_bytes
+What:		/sys/class/net/<iface>/statistics/rx_bytes
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -23,7 +23,7 @@
 		See the network driver for the exact meaning of when this
 		value is incremented.
 
-What:		/sys/class/<iface>/statistics/rx_compressed
+What:		/sys/class/net/<iface>/statistics/rx_compressed
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -32,7 +32,7 @@
 		network device. This value might only be relevant for interfaces
 		that support packet compression (e.g: PPP).
 
-What:		/sys/class/<iface>/statistics/rx_crc_errors
+What:		/sys/class/net/<iface>/statistics/rx_crc_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -41,7 +41,7 @@
 		by this network device. Note that the specific meaning might
 		depend on the MAC layer used by the interface.
 
-What:		/sys/class/<iface>/statistics/rx_dropped
+What:		/sys/class/net/<iface>/statistics/rx_dropped
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -51,7 +51,15 @@
 		packet processing. See the network driver for the exact
 		meaning of this value.
 
-What:		/sys/class/<iface>/statistics/rx_fifo_errors
+What:		/sys/class/net/<iface>/statistics/rx_errors
+Date:		April 2005
+KernelVersion:	2.6.12
+Contact:	netdev@vger.kernel.org
+Description:
+		Indicates the number of receive errors on this network device.
+		See the network driver for the exact meaning of this value.
+
+What:		/sys/class/net/<iface>/statistics/rx_fifo_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -60,7 +68,7 @@
 		network device. See the network driver for the exact
 		meaning of this value.
 
-What:		/sys/class/<iface>/statistics/rx_frame_errors
+What:		/sys/class/net/<iface>/statistics/rx_frame_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -70,7 +78,7 @@
 		on the MAC layer protocol used. See the network driver for
 		the exact meaning of this value.
 
-What:		/sys/class/<iface>/statistics/rx_length_errors
+What:		/sys/class/net/<iface>/statistics/rx_length_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -79,7 +87,7 @@
 		error, oversized or undersized. See the network driver for the
 		exact meaning of this value.
 
-What:		/sys/class/<iface>/statistics/rx_missed_errors
+What:		/sys/class/net/<iface>/statistics/rx_missed_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -88,7 +96,15 @@
 		due to lack of capacity in the receive side. See the network
 		driver for the exact meaning of this value.
 
-What:		/sys/class/<iface>/statistics/rx_over_errors
+What:		/sys/class/net/<iface>/statistics/rx_nohandler
+Date:		February 2016
+KernelVersion:	4.6
+Contact:	netdev@vger.kernel.org
+Description:
+		Indicates the number of received packets that were dropped on
+		an inactive device by the network core.
+
+What:		/sys/class/net/<iface>/statistics/rx_over_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -98,7 +114,7 @@
 		(e.g: larger than MTU). See the network driver for the exact
 		meaning of this value.
 
-What:		/sys/class/<iface>/statistics/rx_packets
+What:		/sys/class/net/<iface>/statistics/rx_packets
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -106,7 +122,7 @@
 		Indicates the total number of good packets received by this
 		network device.
 
-What:		/sys/class/<iface>/statistics/tx_aborted_errors
+What:		/sys/class/net/<iface>/statistics/tx_aborted_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -116,7 +132,7 @@
 		a medium collision). See the network driver for the exact
 		meaning of this value.
 
-What:		/sys/class/<iface>/statistics/tx_bytes
+What:		/sys/class/net/<iface>/statistics/tx_bytes
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -127,7 +143,7 @@
 		transmitted packets or all packets that have been queued for
 		transmission.
 
-What:		/sys/class/<iface>/statistics/tx_carrier_errors
+What:		/sys/class/net/<iface>/statistics/tx_carrier_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -136,7 +152,7 @@
 		because of carrier errors (e.g: physical link down). See the
 		network driver for the exact meaning of this value.
 
-What:		/sys/class/<iface>/statistics/tx_compressed
+What:		/sys/class/net/<iface>/statistics/tx_compressed
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -145,7 +161,7 @@
 		this might only be relevant for devices that support
 		compression (e.g: PPP).
 
-What:		/sys/class/<iface>/statistics/tx_dropped
+What:		/sys/class/net/<iface>/statistics/tx_dropped
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -154,7 +170,7 @@
 		See the driver for the exact reasons as to why the packets were
 		dropped.
 
-What:		/sys/class/<iface>/statistics/tx_errors
+What:		/sys/class/net/<iface>/statistics/tx_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -163,7 +179,7 @@
 		a network device. See the driver for the exact reasons as to
 		why the packets were dropped.
 
-What:		/sys/class/<iface>/statistics/tx_fifo_errors
+What:		/sys/class/net/<iface>/statistics/tx_fifo_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -172,7 +188,7 @@
 		FIFO error. See the driver for the exact reasons as to why the
 		packets were dropped.
 
-What:		/sys/class/<iface>/statistics/tx_heartbeat_errors
+What:		/sys/class/net/<iface>/statistics/tx_heartbeat_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -181,7 +197,7 @@
 		reported as heartbeat errors. See the driver for the exact
 		reasons as to why the packets were dropped.
 
-What:		/sys/class/<iface>/statistics/tx_packets
+What:		/sys/class/net/<iface>/statistics/tx_packets
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org
@@ -190,7 +206,7 @@
 		device. See the driver for whether this reports the number of all
 		attempted or successful transmissions.
 
-What:		/sys/class/<iface>/statistics/tx_window_errors
+What:		/sys/class/net/<iface>/statistics/tx_window_errors
 Date:		April 2005
 KernelVersion:	2.6.12
 Contact:	netdev@vger.kernel.org

diff --git a/Documentation/sound/soc/dapm.rst b/Documentation/sound/soc/dapm.rst
index 8e44107..c3154ce 100644
--- a/Documentation/sound/soc/dapm.rst
+++ b/Documentation/sound/soc/dapm.rst

@@ -234,7 +234,7 @@
 a virtual widget - a widget with no control bits e.g.
 ::
 
-  SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_DAPM_NOPM, 0, 0, NULL, 0),
+  SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_NOPM, 0, 0, NULL, 0),
 
 This can be used to merge to signal paths together in software.
 

diff --git a/Makefile b/Makefile
index 97b82790..b2e10f9 100644
--- a/Makefile
+++ b/Makefile

@@ -1,8 +1,8 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 14
-SUBLEVEL = 336
-EXTRAVERSION =
+SUBLEVEL = 339
+EXTRAVERSION = -openela
 NAME = Petit Gorille
 
 # *DOCUMENTATION*

diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
index 68901f6..c36e642 100644
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c

@@ -64,7 +64,7 @@ struct rt_sigframe {
 	unsigned int sigret_magic;
 };
 
-static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
+static int save_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs)
 {
 	int err = 0;
 #ifndef CONFIG_ISA_ARCOMPACT
@@ -77,12 +77,12 @@ static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
 #else
 	v2abi.r58 = v2abi.r59 = 0;
 #endif
-	err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi));
+	err = __copy_to_user(&mctx->v2abi, (void const *)&v2abi, sizeof(v2abi));
 #endif
 	return err;
 }
 
-static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
+static int restore_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs)
 {
 	int err = 0;
 #ifndef CONFIG_ISA_ARCOMPACT

diff --git a/arch/arm/boot/dts/imx1-ads.dts b/arch/arm/boot/dts/imx1-ads.dts
index 5ea28ee..c2ee0a6 100644
--- a/arch/arm/boot/dts/imx1-ads.dts
+++ b/arch/arm/boot/dts/imx1-ads.dts

@@ -81,7 +81,7 @@
 	pinctrl-0 = <&pinctrl_weim>;
 	status = "okay";
 
-	nor: nor@0,0 {
+	nor: flash@0,0 {
 		compatible = "cfi-flash";
 		reg = <0 0x00000000 0x02000000>;
 		bank-width = <4>;

diff --git a/arch/arm/boot/dts/imx1-apf9328.dts b/arch/arm/boot/dts/imx1-apf9328.dts
index e8b4b52c..001984d 100644
--- a/arch/arm/boot/dts/imx1-apf9328.dts
+++ b/arch/arm/boot/dts/imx1-apf9328.dts

@@ -50,7 +50,7 @@
 	pinctrl-0 = <&pinctrl_weim>;
 	status = "okay";
 
-	nor: nor@0,0 {
+	nor: flash@0,0 {
 		compatible = "cfi-flash";
 		reg = <0 0x00000000 0x02000000>;
 		bank-width = <2>;

diff --git a/arch/arm/boot/dts/imx1.dtsi b/arch/arm/boot/dts/imx1.dtsi
index 38d712b..65e27c8 100644
--- a/arch/arm/boot/dts/imx1.dtsi
+++ b/arch/arm/boot/dts/imx1.dtsi

@@ -269,9 +269,12 @@
 			status = "disabled";
 		};
 
-		esram: esram@00300000 {
+		esram: sram@300000 {
 			compatible = "mmio-sram";
 			reg = <0x00300000 0x20000>;
+			ranges = <0 0x00300000 0x20000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 		};
 	};
 };

diff --git a/arch/arm/boot/dts/imx23-sansa.dts b/arch/arm/boot/dts/imx23-sansa.dts
index 221fd55..3e532f4 100644
--- a/arch/arm/boot/dts/imx23-sansa.dts
+++ b/arch/arm/boot/dts/imx23-sansa.dts

@@ -174,10 +174,8 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		compatible = "i2c-gpio";
-		gpios = <
-			&gpio1 24 0		/* SDA */
-			&gpio1 22 0		/* SCL */
-		>;
+		sda-gpios = <&gpio1 24 0>;
+		scl-gpios = <&gpio1 22 0>;
 		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
 	};
 
@@ -185,10 +183,8 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 		compatible = "i2c-gpio";
-		gpios = <
-			&gpio0 31 0		/* SDA */
-			&gpio0 30 0		/* SCL */
-		>;
+		sda-gpios = <&gpio0 31 0>;
+		scl-gpios = <&gpio0 30 0>;
 		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
 
 		touch: touch@20 {

diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
index 10d57f9..7a16132 100644
--- a/arch/arm/boot/dts/imx23.dtsi
+++ b/arch/arm/boot/dts/imx23.dtsi

@@ -413,7 +413,7 @@
 				status = "disabled";
 			};
 
-			dma_apbx: dma-apbx@80024000 {
+			dma_apbx: dma-controller@80024000 {
 				compatible = "fsl,imx23-dma-apbx";
 				reg = <0x80024000 0x2000>;
 				interrupts = <7 5 9 26

diff --git a/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi b/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
index d6f2764..8676a28 100644
--- a/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
+++ b/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi

@@ -34,7 +34,7 @@
 	pinctrl-0 = <&pinctrl_i2c1>;
 	status = "okay";
 
-	pcf8563@51 {
+	rtc@51 {
 		compatible = "nxp,pcf8563";
 		reg = <0x51>;
 	};

diff --git a/arch/arm/boot/dts/imx27-apf27dev.dts b/arch/arm/boot/dts/imx27-apf27dev.dts
index 5f84b59..167f214 100644
--- a/arch/arm/boot/dts/imx27-apf27dev.dts
+++ b/arch/arm/boot/dts/imx27-apf27dev.dts

@@ -53,7 +53,7 @@
 		pinctrl-names = "default";
 		pinctrl-0 = <&pinctrl_gpio_leds>;
 
-		user {
+		led-user {
 			label = "Heartbeat";
 			gpios = <&gpio6 14 GPIO_ACTIVE_HIGH>;
 			linux,default-trigger = "heartbeat";

diff --git a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
index 2cf896c..546b054 100644
--- a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+++ b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi

@@ -45,7 +45,7 @@
 	pinctrl-0 = <&pinctrl_i2c1>;
 	status = "okay";
 
-	pcf8563@51 {
+	rtc@51 {
 		compatible = "nxp,pcf8563";
 		reg = <0x51>;
 	};
@@ -102,7 +102,7 @@
 &weim {
 	status = "okay";
 
-	nor: nor@0,0 {
+	nor: flash@0,0 {
 		#address-cells = <1>;
 		#size-cells = <1>;
 		compatible = "cfi-flash";

diff --git a/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi b/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
index c973c5d..1cd3251 100644
--- a/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
+++ b/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi

@@ -326,7 +326,7 @@
 &weim {
 	status = "okay";
 
-	nor: nor@0,0 {
+	nor: flash@0,0 {
 		compatible = "cfi-flash";
 		reg = <0 0x00000000 0x02000000>;
 		bank-width = <2>;

diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
index 15d85f1..507159b 100644
--- a/arch/arm/boot/dts/imx27.dtsi
+++ b/arch/arm/boot/dts/imx27.dtsi

@@ -600,6 +600,9 @@
 		iram: iram@ffff4c00 {
 			compatible = "mmio-sram";
 			reg = <0xffff4c00 0xb400>;
+			ranges = <0 0xffff4c00 0xb400>;
+			#address-cells = <1>;
+			#size-cells = <1>;
 		};
 	};
 };

diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
index 2f4ebe0..e489c48 100644
--- a/arch/arm/boot/dts/imx28.dtsi
+++ b/arch/arm/boot/dts/imx28.dtsi

@@ -985,7 +985,7 @@
 				status = "disabled";
 			};
 
-			dma_apbx: dma-apbx@80024000 {
+			dma_apbx: dma-controller@80024000 {
 				compatible = "fsl,imx28-dma-apbx";
 				reg = <0x80024000 0x2000>;
 				interrupts = <78 79 66 0

diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
index 836550f..1d15870 100644
--- a/arch/arm/boot/dts/imx7s.dtsi
+++ b/arch/arm/boot/dts/imx7s.dtsi

@@ -674,7 +674,7 @@
 			};
 
 			lcdif: lcdif@30730000 {
-				compatible = "fsl,imx7d-lcdif", "fsl,imx28-lcdif";
+				compatible = "fsl,imx7d-lcdif", "fsl,imx6sx-lcdif";
 				reg = <0x30730000 0x10000>;
 				interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>,
@@ -1039,7 +1039,7 @@
 		gpmi: gpmi-nand@33002000{
 			compatible = "fsl,imx7d-gpmi-nand";
 			#address-cells = <1>;
-			#size-cells = <1>;
+			#size-cells = <0>;
 			reg = <0x33002000 0x2000>, <0x33004000 0x4000>;
 			reg-names = "gpmi-nand", "bch";
 			interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;

diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
index 03cf0c8..b1ede7a 100644
--- a/arch/arm/boot/dts/rk3036.dtsi
+++ b/arch/arm/boot/dts/rk3036.dtsi

@@ -353,12 +353,20 @@
 		pinctrl-0 = <&hdmi_ctl>;
 		status = "disabled";
 
-		hdmi_in: port {
+		ports {
 			#address-cells = <1>;
 			#size-cells = <0>;
-			hdmi_in_vop: endpoint@0 {
+
+			hdmi_in: port@0 {
 				reg = <0>;
-				remote-endpoint = <&vop_out_hdmi>;
+
+				hdmi_in_vop: endpoint {
+					remote-endpoint = <&vop_out_hdmi>;
+				};
+			};
+
+			hdmi_out: port@1 {
+				reg = <1>;
 			};
 		};
 	};

diff --git a/arch/mips/alchemy/devboards/db1200.c b/arch/mips/alchemy/devboards/db1200.c
index ae81e05..fe827f9 100644
--- a/arch/mips/alchemy/devboards/db1200.c
+++ b/arch/mips/alchemy/devboards/db1200.c

@@ -858,7 +858,7 @@ int __init db1200_dev_setup(void)
 	i2c_register_board_info(0, db1200_i2c_devs,
 				ARRAY_SIZE(db1200_i2c_devs));
 	spi_register_board_info(db1200_spi_devs,
-				ARRAY_SIZE(db1200_i2c_devs));
+				ARRAY_SIZE(db1200_spi_devs));
 
 	/* SWITCHES:	S6.8 I2C/SPI selector  (OFF=I2C	 ON=SPI)
 	 *		S6.7 AC97/I2S selector (OFF=AC97 ON=I2S)

diff --git a/arch/mips/alchemy/devboards/db1550.c b/arch/mips/alchemy/devboards/db1550.c
index 7d3dfaa..aaee46f 100644
--- a/arch/mips/alchemy/devboards/db1550.c
+++ b/arch/mips/alchemy/devboards/db1550.c

@@ -581,7 +581,7 @@ int __init db1550_dev_setup(void)
 	i2c_register_board_info(0, db1550_i2c_devs,
 				ARRAY_SIZE(db1550_i2c_devs));
 	spi_register_board_info(db1550_spi_devs,
-				ARRAY_SIZE(db1550_i2c_devs));
+				ARRAY_SIZE(db1550_spi_devs));
 
 	c = clk_get(NULL, "psc0_intclk");
 	if (!IS_ERR(c)) {

diff --git a/arch/mips/include/asm/checksum.h b/arch/mips/include/asm/checksum.h
index 77cad23..d7f673a 100644
--- a/arch/mips/include/asm/checksum.h
+++ b/arch/mips/include/asm/checksum.h

@@ -276,7 +276,8 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
 	"	.set	pop"
 	: "=&r" (sum), "=&r" (tmp)
 	: "r" (saddr), "r" (daddr),
-	  "0" (htonl(len)), "r" (htonl(proto)), "r" (sum));
+	  "0" (htonl(len)), "r" (htonl(proto)), "r" (sum)
+	: "memory");
 
 	return csum_fold(sum);
 }

diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c
index 731325a..d7d0a48 100644
--- a/arch/mips/kernel/elf.c
+++ b/arch/mips/kernel/elf.c

@@ -15,6 +15,7 @@
 
 #include <asm/cpu-features.h>
 #include <asm/cpu-info.h>
+#include <asm/fpu.h>
 
 /* Whether to accept legacy-NaN and 2008-NaN user binaries.  */
 bool mips_use_nan_legacy;
@@ -311,6 +312,11 @@ void mips_set_personality_nan(struct arch_elf_state *state)
 	struct cpuinfo_mips *c = &boot_cpu_data;
 	struct task_struct *t = current;
 
+	/* Do this early so t->thread.fpu.fcr31 won't be clobbered in case
+	 * we are preempted before the lose_fpu(0) in start_thread.
+	 */
+	lose_fpu(0);
+
 	t->thread.fpu.fcr31 = c->fpu_csr31;
 	switch (state->nan_2008) {
 	case 0:

diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c
index 906b7c8..82f2646 100644
--- a/arch/parisc/kernel/firmware.c
+++ b/arch/parisc/kernel/firmware.c

@@ -127,10 +127,10 @@ static unsigned long f_extend(unsigned long address)
 #ifdef CONFIG_64BIT
 	if(unlikely(parisc_narrow_firmware)) {
 		if((address & 0xff000000) == 0xf0000000)
-			return 0xf0f0f0f000000000UL | (u32)address;
+			return (0xfffffff0UL << 32) | (u32)address;
 
 		if((address & 0xf0000000) == 0xf0000000)
-			return 0xffffffff00000000UL | (u32)address;
+			return (0xffffffffUL << 32) | (u32)address;
 	}
 #endif
 	return address;

diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 3fcfa85..ff7a860 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig

@@ -281,12 +281,10 @@
 
 config PPC_UDBG_16550
 	bool
-	default n
 
 config GENERIC_TBSYNC
 	bool
 	default y if PPC32 && SMP
-	default n
 
 config AUDIT_ARCH
 	bool
@@ -305,13 +303,11 @@
 	bool
 	help
 	  Used to allow a board to specify it wants an ePAPR compliant wrapper.
-	default n
 
 config DEFAULT_UIMAGE
 	bool
 	help
 	  Used to allow a board to specify it wants a uImage built by default
-	default n
 
 config ARCH_HIBERNATION_POSSIBLE
 	bool
@@ -325,11 +321,9 @@
 
 config PPC_DCR_NATIVE
 	bool
-	default n
 
 config PPC_DCR_MMIO
 	bool
-	default n
 
 config PPC_DCR
 	bool
@@ -340,7 +334,6 @@
 	bool
 	depends on PCI
 	depends on PPC64 # not supported on 32 bits yet
-	default n
 
 config ARCH_SUPPORTS_DEBUG_PAGEALLOC
 	depends on PPC32 || PPC_STD_MMU_64
@@ -449,14 +442,12 @@
        depends on SMP
        select ALTIVEC
        select VSX
-       default n
        ---help---
          Support user-mode Transactional Memory on POWERPC.
 
 config LD_HEAD_STUB_CATCH
 	bool "Reserve 256 bytes to cope with linker stubs in HEAD text" if EXPERT
 	depends on PPC64
-	default n
 	help
 	  Very large kernels can cause linker branch stubs to be generated by
 	  code in head_64.S, which moves the head text sections out of their
@@ -583,7 +574,6 @@
 config RELOCATABLE_TEST
 	bool "Test relocatable kernel"
 	depends on (PPC64 && RELOCATABLE)
-	default n
 	help
 	  This runs the relocatable kernel at the address it was initially
 	  loaded at, which tends to be non-zero and therefore test the
@@ -797,7 +787,6 @@
 
 config PPC_COPRO_BASE
 	bool
-	default n
 
 config SCHED_SMT
 	bool "SMT (Hyperthreading) scheduler support"
@@ -911,7 +900,6 @@
 	bool
 	depends on PCI
 	default y if 40x || 44x
-	default n
 
 config EISA
 	bool
@@ -1008,7 +996,6 @@
 
 config HAS_RAPIDIO
 	bool
-	default n
 
 config RAPIDIO
 	tristate "RapidIO support"
@@ -1044,7 +1031,6 @@
 
 config NONSTATIC_KERNEL
 	bool
-	default n
 
 menu "Advanced setup"
 	depends on PPC32

diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
index 6c60cc0..a185e7c 100644
--- a/arch/powerpc/Kconfig.debug
+++ b/arch/powerpc/Kconfig.debug

@@ -5,7 +5,6 @@
 
 config PPC_DISABLE_WERROR
 	bool "Don't build arch/powerpc code with -Werror"
-	default n
 	help
 	  This option tells the compiler NOT to build the code under
 	  arch/powerpc with the -Werror flag (which means warnings
@@ -59,7 +58,6 @@
 config CODE_PATCHING_SELFTEST
 	bool "Run self-tests of the code-patching code"
 	depends on DEBUG_KERNEL
-	default n
 
 config JUMP_LABEL_FEATURE_CHECKS
 	bool "Enable use of jump label for cpu/mmu_has_feature()"
@@ -73,7 +71,6 @@
 config JUMP_LABEL_FEATURE_CHECK_DEBUG
 	bool "Do extra check on feature fixup calls"
 	depends on DEBUG_KERNEL && JUMP_LABEL_FEATURE_CHECKS
-	default n
 	help
 	  This tries to catch incorrect usage of cpu_has_feature() and
 	  mmu_has_feature() in the code.
@@ -83,12 +80,10 @@
 config FTR_FIXUP_SELFTEST
 	bool "Run self-tests of the feature-fixup code"
 	depends on DEBUG_KERNEL
-	default n
 
 config MSI_BITMAP_SELFTEST
 	bool "Run self-tests of the MSI bitmap code"
 	depends on DEBUG_KERNEL
-	default n
 
 config XMON
 	bool "Include xmon kernel debugger"

diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
index 6364f5c..2cc99f5 100644
--- a/arch/powerpc/include/asm/mmu.h
+++ b/arch/powerpc/include/asm/mmu.h

@@ -332,5 +332,9 @@ static inline void mmu_early_init_devtree(void) { }
 #  include <asm/mmu-8xx.h>
 #endif
 
+#if defined(CONFIG_FA_DUMP) || defined(CONFIG_PRESERVE_FA_DUMP)
+#define __HAVE_ARCH_RESERVED_KERNEL_PAGES
+#endif
+
 #endif /* __KERNEL__ */
 #endif /* _ASM_POWERPC_MMU_H_ */

diff --git a/arch/powerpc/include/asm/mmzone.h b/arch/powerpc/include/asm/mmzone.h
index 91c69ff..50c2198 100644
--- a/arch/powerpc/include/asm/mmzone.h
+++ b/arch/powerpc/include/asm/mmzone.h

@@ -42,9 +42,6 @@ u64 memory_hotplug_max(void);
 #else
 #define memory_hotplug_max() memblock_end_of_DRAM()
 #endif /* CONFIG_NEED_MULTIPLE_NODES */
-#ifdef CONFIG_FA_DUMP
-#define __HAVE_ARCH_RESERVED_KERNEL_PAGES
-#endif
 
 #endif /* __KERNEL__ */
 #endif /* _ASM_MMZONE_H_ */

diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index a507a68..f70799f 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c

@@ -1070,10 +1070,12 @@ static int emulate_instruction(struct pt_regs *regs)
 	return -EINVAL;
 }
 
+#ifdef CONFIG_GENERIC_BUG
 int is_valid_bugaddr(unsigned long addr)
 {
 	return is_kernel_addr(addr);
 }
+#endif
 
 #ifdef CONFIG_MATH_EMULATION
 static int emulate_math(struct pt_regs *regs)

diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index 00c34be..41491eb 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile

@@ -21,8 +21,8 @@
 # 64-bit linker creates .sfpr on demand for final link (vmlinux),
 # so it is only needed for modules, and only for older linkers which
 # do not support --save-restore-funcs
-ifeq ($(call ld-ifversion, -lt, 225000000, y),y)
-extra-$(CONFIG_PPC64)	+= crtsavres.o
+ifeq ($(call ld-ifversion, -lt, 225000000, y)$(CONFIG_PPC64),yy)
+always	+= crtsavres.o
 endif
 
 obj64-y	+= copypage_64.o copyuser_64.o mem_64.o hweight_64.o \

diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index e9bfd975..331f3d0 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c

@@ -471,6 +471,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea,
 	} u;
 
 	nb = GETSIZE(op->type);
+	if (nb > sizeof(u))
+		return -EINVAL;
 	if (!address_ok(regs, ea, nb))
 		return -EFAULT;
 	rn = op->reg;
@@ -521,6 +523,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea,
 	} u;
 
 	nb = GETSIZE(op->type);
+	if (nb > sizeof(u))
+		return -EINVAL;
 	if (!address_ok(regs, ea, nb))
 		return -EFAULT;
 	rn = op->reg;
@@ -565,6 +569,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea,
 		u8 b[sizeof(__vector128)];
 	} u = {};
 
+	if (size > sizeof(u))
+		return -EINVAL;
+
 	if (!address_ok(regs, ea & ~0xfUL, 16))
 		return -EFAULT;
 	/* align to multiple of size */
@@ -592,6 +599,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea,
 		u8 b[sizeof(__vector128)];
 	} u;
 
+	if (size > sizeof(u))
+		return -EINVAL;
+
 	if (!address_ok(regs, ea & ~0xfUL, 16))
 		return -EFAULT;
 	/* align to multiple of size */

diff --git a/arch/powerpc/mm/init-common.c b/arch/powerpc/mm/init-common.c
index eb8c6c8..c8515de 100644
--- a/arch/powerpc/mm/init-common.c
+++ b/arch/powerpc/mm/init-common.c

@@ -65,7 +65,7 @@ void pgtable_cache_add(unsigned shift, void (*ctor)(void *))
 	 * as to leave enough 0 bits in the address to contain it. */
 	unsigned long minalign = max(MAX_PGTABLE_INDEX_SIZE + 1,
 				     HUGEPD_SHIFT_MASK + 1);
-	struct kmem_cache *new;
+	struct kmem_cache *new = NULL;
 
 	/* It would be nice if this was a BUILD_BUG_ON(), but at the
 	 * moment, gcc doesn't seem to recognize is_power_of_2 as a
@@ -78,7 +78,8 @@ void pgtable_cache_add(unsigned shift, void (*ctor)(void *))
 
 	align = max_t(unsigned long, align, minalign);
 	name = kasprintf(GFP_KERNEL, "pgtable-2^%d", shift);
-	new = kmem_cache_create(name, table_size, align, 0, ctor);
+	if (name)
+		new = kmem_cache_create(name, table_size, align, 0, ctor);
 	if (!new)
 		panic("Could not allocate pgtable cache for order %d", shift);
 

diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
index a0b4c22..0b785c6 100644
--- a/arch/powerpc/perf/imc-pmu.c
+++ b/arch/powerpc/perf/imc-pmu.c

@@ -246,6 +246,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
 	attr_group->attrs = attrs;
 	do {
 		ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i]->value);
+		if (!ev_val_str)
+			continue;
 		dev_str = device_str_attr_create(pmu->events[i]->name, ev_val_str);
 		if (!dev_str)
 			continue;
@@ -253,6 +255,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
 		attrs[j++] = dev_str;
 		if (pmu->events[i]->scale) {
 			ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale",pmu->events[i]->name);
+			if (!ev_scale_str)
+				continue;
 			dev_str = device_str_attr_create(ev_scale_str, pmu->events[i]->scale);
 			if (!dev_str)
 				continue;
@@ -262,6 +266,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
 
 		if (pmu->events[i]->unit) {
 			ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit",pmu->events[i]->name);
+			if (!ev_unit_str)
+				continue;
 			dev_str = device_str_attr_create(ev_unit_str, pmu->events[i]->unit);
 			if (!dev_str)
 				continue;

diff --git a/arch/powerpc/platforms/40x/Kconfig b/arch/powerpc/platforms/40x/Kconfig
index 60254a3..2a9d662 100644
--- a/arch/powerpc/platforms/40x/Kconfig
+++ b/arch/powerpc/platforms/40x/Kconfig

@@ -2,7 +2,6 @@
 config ACADIA
 	bool "Acadia"
 	depends on 40x
-	default n
 	select PPC40x_SIMPLE
 	select 405EZ
 	help
@@ -11,7 +10,6 @@
 config EP405
 	bool "EP405/EP405PC"
 	depends on 40x
-	default n
 	select 405GP
 	select PCI
 	help
@@ -20,7 +18,6 @@
 config HOTFOOT
         bool "Hotfoot"
 	depends on 40x
-	default n
 	select PPC40x_SIMPLE
 	select PCI
         help
@@ -29,7 +26,6 @@
 config KILAUEA
 	bool "Kilauea"
 	depends on 40x
-	default n
 	select 405EX
 	select PPC40x_SIMPLE
 	select PPC4xx_PCI_EXPRESS
@@ -41,7 +37,6 @@
 config MAKALU
 	bool "Makalu"
 	depends on 40x
-	default n
 	select 405EX
 	select PCI
 	select PPC4xx_PCI_EXPRESS
@@ -62,7 +57,6 @@
 config XILINX_VIRTEX_GENERIC_BOARD
 	bool "Generic Xilinx Virtex board"
 	depends on 40x
-	default n
 	select XILINX_VIRTEX_II_PRO
 	select XILINX_VIRTEX_4_FX
 	select XILINX_INTC
@@ -80,7 +74,6 @@
 config OBS600
 	bool "OpenBlockS 600"
 	depends on 40x
-	default n
 	select 405EX
 	select PPC40x_SIMPLE
 	help
@@ -90,7 +83,6 @@
 config PPC40x_SIMPLE
 	bool "Simple PowerPC 40x board support"
 	depends on 40x
-	default n
 	help
 	  This option enables the simple PowerPC 40x platform support.
 
@@ -156,7 +148,6 @@
 config APM8018X
 	bool "APM8018X"
 	depends on 40x
-	default n
 	select PPC40x_SIMPLE
 	help
 	  This option enables support for the AppliedMicro APM8018X evaluation

diff --git a/arch/powerpc/platforms/44x/Kconfig b/arch/powerpc/platforms/44x/Kconfig
index a601142..5595770 100644
--- a/arch/powerpc/platforms/44x/Kconfig
+++ b/arch/powerpc/platforms/44x/Kconfig

@@ -2,7 +2,6 @@
 config PPC_47x
 	bool "Support for 47x variant"
 	depends on 44x
-	default n
 	select MPIC
 	help
 	  This option enables support for the 47x family of processors and is
@@ -11,7 +10,6 @@
 config BAMBOO
 	bool "Bamboo"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 440EP
 	select PCI
@@ -21,7 +19,6 @@
 config BLUESTONE
 	bool "Bluestone"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select APM821xx
 	select PCI_MSI
@@ -44,7 +41,6 @@
 config SAM440EP
         bool "Sam440ep"
 	depends on 44x
-        default n
         select 440EP
         select PCI
         help
@@ -53,7 +49,6 @@
 config SEQUOIA
 	bool "Sequoia"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 440EPX
 	help
@@ -62,7 +57,6 @@
 config TAISHAN
 	bool "Taishan"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 440GX
 	select PCI
@@ -73,7 +67,6 @@
 config KATMAI
 	bool "Katmai"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 440SPe
 	select PCI
@@ -86,7 +79,6 @@
 config RAINIER
 	bool "Rainier"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 440GRX
 	select PCI
@@ -96,7 +88,6 @@
 config WARP
 	bool "PIKA Warp"
 	depends on 44x
-	default n
 	select 440EP
 	help
 	  This option enables support for the PIKA Warp(tm) Appliance. The Warp
@@ -109,7 +100,6 @@
 config ARCHES
 	bool "Arches"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 460EX # Odd since it uses 460GT but the effects are the same
 	select PCI
@@ -120,7 +110,6 @@
 config CANYONLANDS
 	bool "Canyonlands"
 	depends on 44x
-	default n
 	select 460EX
 	select PCI
 	select PPC4xx_PCI_EXPRESS
@@ -134,7 +123,6 @@
 config GLACIER
 	bool "Glacier"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 460EX # Odd since it uses 460GT but the effects are the same
 	select PCI
@@ -147,7 +135,6 @@
 config REDWOOD
 	bool "Redwood"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 460SX
 	select PCI
@@ -160,7 +147,6 @@
 config EIGER
 	bool "Eiger"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 460SX
 	select PCI
@@ -172,7 +158,6 @@
 config YOSEMITE
 	bool "Yosemite"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 440EP
 	select PCI
@@ -182,7 +167,6 @@
 config ISS4xx
 	bool "ISS 4xx Simulator"
 	depends on (44x || 40x)
-	default n
 	select 405GP if 40x
 	select 440GP if 44x && !PPC_47x
 	select PPC_FPU
@@ -193,7 +177,7 @@
 config CURRITUCK
 	bool "IBM Currituck (476fpe) Support"
 	depends on PPC_47x
-	default n
+	select I2C
 	select SWIOTLB
 	select 476FPE
 	select PPC4xx_PCI_EXPRESS
@@ -203,7 +187,6 @@
 config FSP2
 	bool "IBM FSP2 (476fpe) Support"
 	depends on PPC_47x
-	default n
 	select 476FPE
 	select IBM_EMAC_EMAC4 if IBM_EMAC
 	select IBM_EMAC_RGMII if IBM_EMAC
@@ -215,7 +198,6 @@
 config AKEBONO
 	bool "IBM Akebono (476gtr) Support"
 	depends on PPC_47x
-	default n
 	select SWIOTLB
 	select 476FPE
 	select PPC4xx_PCI_EXPRESS
@@ -241,7 +223,6 @@
 config ICON
 	bool "Icon"
 	depends on 44x
-	default n
 	select PPC44x_SIMPLE
 	select 440SPe
 	select PCI
@@ -252,7 +233,6 @@
 config XILINX_VIRTEX440_GENERIC_BOARD
 	bool "Generic Xilinx Virtex 5 FXT board support"
 	depends on 44x
-	default n
 	select XILINX_VIRTEX_5_FXT
 	select XILINX_INTC
 	help
@@ -280,7 +260,6 @@
 config PPC44x_SIMPLE
 	bool "Simple PowerPC 44x board support"
 	depends on 44x
-	default n
 	help
 	  This option enables the simple PowerPC 44x platform support.
 

diff --git a/arch/powerpc/platforms/82xx/Kconfig b/arch/powerpc/platforms/82xx/Kconfig
index 6e04099..1947a88 100644
--- a/arch/powerpc/platforms/82xx/Kconfig
+++ b/arch/powerpc/platforms/82xx/Kconfig

@@ -51,7 +51,6 @@
 
 config PQ2ADS
 	bool
-	default n
 
 config 8260
 	bool

diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index e06ccba..7cf557c 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig

@@ -23,7 +23,6 @@
 
 config KVM_GUEST
 	bool "KVM Guest support"
-	default n
 	select EPAPR_PARAVIRT
 	---help---
 	  This option enables various optimizations for running under the KVM
@@ -34,7 +33,6 @@
 
 config EPAPR_PARAVIRT
 	bool "ePAPR para-virtualization support"
-	default n
 	help
 	  Enables ePAPR para-virtualization support for guests.
 
@@ -74,7 +72,6 @@
 config UDBG_RTAS_CONSOLE
 	bool "RTAS based debug console"
 	depends on PPC_RTAS
-	default n
 
 config PPC_SMP_MUXED_IPI
 	bool
@@ -86,16 +83,13 @@
 
 config IPIC
 	bool
-	default n
 
 config MPIC
 	bool
-	default n
 
 config MPIC_TIMER
 	bool "MPIC Global Timer"
 	depends on MPIC && FSL_SOC
-	default n
 	help
 	  The MPIC global timer is a hardware timer inside the
 	  Freescale PIC complying with OpenPIC standard. When the
@@ -107,7 +101,6 @@
 config FSL_MPIC_TIMER_WAKEUP
 	tristate "Freescale MPIC global timer wakeup driver"
 	depends on FSL_SOC &&  MPIC_TIMER && PM
-	default n
 	help
 	  The driver provides a way to wake up the system by MPIC
 	  timer.
@@ -115,43 +108,35 @@
 
 config PPC_EPAPR_HV_PIC
 	bool
-	default n
 	select EPAPR_PARAVIRT
 
 config MPIC_WEIRD
 	bool
-	default n
 
 config MPIC_MSGR
 	bool "MPIC message register support"
 	depends on MPIC
-	default n
 	help
 	  Enables support for the MPIC message registers.  These
 	  registers are used for inter-processor communication.
 
 config PPC_I8259
 	bool
-	default n
 
 config U3_DART
 	bool
 	depends on PPC64
-	default n
 
 config PPC_RTAS
 	bool
-	default n
 
 config RTAS_ERROR_LOGGING
 	bool
 	depends on PPC_RTAS
-	default n
 
 config PPC_RTAS_DAEMON
 	bool
 	depends on PPC_RTAS
-	default n
 
 config RTAS_PROC
 	bool "Proc interface to RTAS"
@@ -164,11 +149,9 @@
 
 config MMIO_NVRAM
 	bool
-	default n
 
 config MPIC_U3_HT_IRQS
 	bool
-	default n
 
 config MPIC_BROKEN_REGREAD
 	bool
@@ -187,15 +170,12 @@
 
 config PPC_MPC106
 	bool
-	default n
 
 config PPC_970_NAP
 	bool
-	default n
 
 config PPC_P7_NAP
 	bool
-	default n
 
 config PPC_INDIRECT_PIO
 	bool
@@ -301,7 +281,6 @@
 
 config FSL_ULI1575
 	bool
-	default n
 	select GENERIC_ISA_DMA
 	help
 	  Supports for the ULI1575 PCIe south bridge that exists on some

diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
index 3ce376b..267cc8f 100644
--- a/arch/powerpc/platforms/Kconfig.cputype
+++ b/arch/powerpc/platforms/Kconfig.cputype

@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 config PPC64
 	bool "64-bit kernel"
-	default n
 	select ZLIB_DEFLATE
 	help
 	  This option selects whether a 32-bit or a 64-bit kernel
@@ -326,7 +325,6 @@
 	bool
 	default y if PPC_STD_MMU_64
 	default y if PPC_8xx && HUGETLB_PAGE
-	default n
 
 config PPC_HAVE_PMU_SUPPORT
        bool
@@ -340,7 +338,6 @@
 config FORCE_SMP
 	# Allow platforms to force SMP=y by selecting this
 	bool
-	default n
 	select SMP
 
 config SMP
@@ -381,7 +378,6 @@
 
 config PPC_DOORBELL
 	bool
-	default n
 
 endmenu
 

diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig
index 741a8fa..3ad4207 100644
--- a/arch/powerpc/platforms/cell/Kconfig
+++ b/arch/powerpc/platforms/cell/Kconfig

@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 config PPC_CELL
 	bool
-	default n
 
 config PPC_CELL_COMMON
 	bool
@@ -22,7 +21,6 @@
 	select IBM_EMAC_RGMII if IBM_EMAC
 	select IBM_EMAC_ZMII if IBM_EMAC #test only
 	select IBM_EMAC_TAH if IBM_EMAC  #test only
-	default n
 
 config PPC_IBM_CELL_BLADE
 	bool "IBM Cell Blade"
@@ -55,7 +53,6 @@
 
 config SPU_BASE
 	bool
-	default n
 	select PPC_COPRO_BASE
 
 config CBE_RAS

diff --git a/arch/powerpc/platforms/maple/Kconfig b/arch/powerpc/platforms/maple/Kconfig
index 376d0be..2601fac 100644
--- a/arch/powerpc/platforms/maple/Kconfig
+++ b/arch/powerpc/platforms/maple/Kconfig

@@ -13,7 +13,6 @@
 	select PPC_RTAS
 	select MMIO_NVRAM
 	select ATA_NONSTANDARD if ATA
-	default n
 	help
           This option enables support for the Maple 970FX Evaluation Board.
 	  For more information, refer to <http://www.970eval.com>

diff --git a/arch/powerpc/platforms/pasemi/Kconfig b/arch/powerpc/platforms/pasemi/Kconfig
index d458a79..98e3bc2 100644
--- a/arch/powerpc/platforms/pasemi/Kconfig
+++ b/arch/powerpc/platforms/pasemi/Kconfig

@@ -2,7 +2,6 @@
 config PPC_PASEMI
 	depends on PPC64 && PPC_BOOK3S && CPU_BIG_ENDIAN
 	bool "PA Semi SoC-based platforms"
-	default n
 	select MPIC
 	select PCI
 	select PPC_UDBG_16550

diff --git a/arch/powerpc/platforms/powernv/Kconfig b/arch/powerpc/platforms/powernv/Kconfig
index f8dc98d..05ee7b6 100644
--- a/arch/powerpc/platforms/powernv/Kconfig
+++ b/arch/powerpc/platforms/powernv/Kconfig

@@ -35,7 +35,6 @@
 config PPC_MEMTRACE
 	bool "Enable removal of RAM from kernel mappings for tracing"
 	depends on PPC_POWERNV && MEMORY_HOTREMOVE
-	default n
 	help
 	  Enabling this option allows for the removal of memory (RAM)
 	  from the kernel mappings to be used for hardware tracing.

diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c
index ecdcba9..bd37ff2 100644
--- a/arch/powerpc/platforms/powernv/opal-irqchip.c
+++ b/arch/powerpc/platforms/powernv/opal-irqchip.c

@@ -253,6 +253,8 @@ int __init opal_event_init(void)
 		else
 			name = kasprintf(GFP_KERNEL, "opal");
 
+		if (!name)
+			continue;
 		/* Install interrupt handler */
 		rc = request_irq(virq, opal_interrupt, IRQF_TRIGGER_LOW,
 				 name, NULL);

diff --git a/arch/powerpc/platforms/ps3/Kconfig b/arch/powerpc/platforms/ps3/Kconfig
index 6f75255..24864b8 100644
--- a/arch/powerpc/platforms/ps3/Kconfig
+++ b/arch/powerpc/platforms/ps3/Kconfig

@@ -49,7 +49,6 @@
 config PS3_DYNAMIC_DMA
 	depends on PPC_PS3
 	bool "PS3 Platform dynamic DMA page table management"
-	default n
 	help
 	  This option will enable kernel support to take advantage of the
 	  per device dynamic DMA page table management provided by the Cell
@@ -89,7 +88,6 @@
 config PS3_REPOSITORY_WRITE
 	bool "PS3 Repository write support" if PS3_ADVANCED
 	depends on PPC_PS3
-	default n
 	help
 	  Enables support for writing to the PS3 System Repository.
 

diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index 0c698fd..39032d9 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig

@@ -28,7 +28,6 @@
 config PPC_SPLPAR
 	depends on PPC_PSERIES
 	bool "Support for shared-processor logical partitions"
-	default n
 	help
 	  Enabling this option will make the kernel run more efficiently
 	  on logically-partitioned pSeries systems which use shared
@@ -99,7 +98,6 @@
 	bool "Support for shared-memory logical partitions"
 	depends on PPC_PSERIES
 	select LPARCFG
-	default n
 	help
 	  Select this option to enable shared memory partition support.
 	  With this option a system running in an LPAR can be given more

diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 1a3cffd..3187727 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c

@@ -573,7 +573,7 @@ static int dlpar_memory_remove_by_index(u32 drc_index, struct property *prop)
 	int lmb_found;
 	int i, rc;
 
-	pr_info("Attempting to hot-remove LMB, drc index %x\n", drc_index);
+	pr_debug("Attempting to hot-remove LMB, drc index %x\n", drc_index);
 
 	p = prop->value;
 	num_lmbs = *p++;
@@ -591,14 +591,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index, struct property *prop)
 		}
 	}
 
-	if (!lmb_found)
+	if (!lmb_found) {
+		pr_debug("Failed to look up LMB for drc index %x\n", drc_index);
 		rc = -EINVAL;
-
-	if (rc)
-		pr_info("Failed to hot-remove memory at %llx\n",
-			lmbs[i].base_addr);
-	else
-		pr_info("Memory at %llx was hot-removed\n", lmbs[i].base_addr);
+	} else if (rc) {
+		pr_debug("Failed to hot-remove memory at %llx\n",
+			 lmbs[i].base_addr);
+	} else {
+		pr_debug("Memory at %llx was hot-removed\n", lmbs[i].base_addr);
+	}
 
 	return rc;
 }
@@ -875,8 +876,8 @@ static int dlpar_memory_add_by_count(u32 lmbs_to_add, struct property *prop)
 			if (!lmbs[i].reserved)
 				continue;
 
-			pr_info("Memory at %llx (drc index %x) was hot-added\n",
-				lmbs[i].base_addr, lmbs[i].drc_index);
+			pr_debug("Memory at %llx (drc index %x) was hot-added\n",
+				 lmbs[i].base_addr, lmbs[i].drc_index);
 			lmbs[i].reserved = 0;
 		}
 		rc = 0;

diff --git a/arch/powerpc/sysdev/Kconfig b/arch/powerpc/sysdev/Kconfig
index bcef2ac..e0dbec7 100644
--- a/arch/powerpc/sysdev/Kconfig
+++ b/arch/powerpc/sysdev/Kconfig

@@ -6,19 +6,16 @@
 config PPC4xx_PCI_EXPRESS
 	bool
 	depends on PCI && 4xx
-	default n
 
 config PPC4xx_HSTA_MSI
 	bool
 	depends on PCI_MSI
 	depends on PCI && 4xx
-	default n
 
 config PPC4xx_MSI
 	bool
 	depends on PCI_MSI
 	depends on PCI && 4xx
-	default n
 
 config PPC_MSI_BITMAP
 	bool
@@ -37,11 +34,9 @@
 config SCOM_DEBUGFS
 	bool "Expose SCOM controllers via debugfs"
 	depends on PPC_SCOM && DEBUG_FS
-	default n
 
 config GE_FPGA
 	bool
-	default n
 
 config FSL_CORENET_RCPM
 	bool

diff --git a/arch/powerpc/sysdev/xive/Kconfig b/arch/powerpc/sysdev/xive/Kconfig
index 70ee976..785c292 100644
--- a/arch/powerpc/sysdev/xive/Kconfig
+++ b/arch/powerpc/sysdev/xive/Kconfig

@@ -1,17 +1,14 @@
 # SPDX-License-Identifier: GPL-2.0
 config PPC_XIVE
 	bool
-	default n
 	select PPC_SMP_MUXED_IPI
 	select HARDIRQS_SW_RESEND
 
 config PPC_XIVE_NATIVE
 	bool
-	default n
 	select PPC_XIVE
 	depends on PPC_POWERNV
 
 config PPC_XIVE_SPAPR
 	bool
-	default n
 	select PPC_XIVE

diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 7c635e4..60050ba 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c

@@ -411,6 +411,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
 		/*
 		 * floating point control reg. is in the thread structure
 		 */
+		save_fpu_regs();
 		if ((unsigned int) data != 0 ||
 		    test_fp_ctl(data >> (BITS_PER_LONG - 32)))
 			return -EINVAL;
@@ -771,6 +772,7 @@ static int __poke_user_compat(struct task_struct *child,
 		/*
 		 * floating point control reg. is in the thread structure
 		 */
+		save_fpu_regs();
 		if (test_fp_ctl(tmp))
 			return -EINVAL;
 		child->thread.fpu.fpc = data;
@@ -999,9 +1001,7 @@ static int s390_fpregs_set(struct task_struct *target,
 	int rc = 0;
 	freg_t fprs[__NUM_FPRS];
 
-	if (target == current)
-		save_fpu_regs();
-
+	save_fpu_regs();
 	if (MACHINE_HAS_VX)
 		convert_vx_to_fp(fprs, target->thread.fpu.vxrs);
 	else

diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 05bd517..ee822b4 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c

@@ -2788,8 +2788,6 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
 
 int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
 {
-	if (test_fp_ctl(fpu->fpc))
-		return -EINVAL;
 	vcpu->run->s.regs.fpc = fpu->fpc;
 	if (MACHINE_HAS_VX)
 		convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs,

diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c
index 1669240..f107c95 100644
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c

@@ -207,7 +207,7 @@ static int uml_net_close(struct net_device *dev)
 	return 0;
 }
 
-static int uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct uml_net_private *lp = netdev_priv(dev);
 	unsigned long flags;

diff --git a/arch/um/include/shared/kern_util.h b/arch/um/include/shared/kern_util.h
index 35ab97e..f2da834 100644
--- a/arch/um/include/shared/kern_util.h
+++ b/arch/um/include/shared/kern_util.h

@@ -49,7 +49,7 @@ extern void do_uml_exitcalls(void);
  * Are we disallowed to sleep? Used to choose between GFP_KERNEL and
  * GFP_ATOMIC.
  */
-extern int __cant_sleep(void);
+extern int __uml_cant_sleep(void);
 extern int get_current_pid(void);
 extern int copy_from_user_proc(void *to, void *from, int size);
 extern int cpu(void);

diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index 691b83b..c9d09d0 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c

@@ -210,7 +210,7 @@ void arch_cpu_idle(void)
 	local_irq_enable();
 }
 
-int __cant_sleep(void) {
+int __uml_cant_sleep(void) {
 	return in_atomic() || irqs_disabled() || in_interrupt();
 	/* Is in_interrupt() really needed? */
 }

diff --git a/arch/um/os-Linux/helper.c b/arch/um/os-Linux/helper.c
index 3f02d42..53d450e 100644
--- a/arch/um/os-Linux/helper.c
+++ b/arch/um/os-Linux/helper.c

@@ -45,7 +45,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)
 	unsigned long stack, sp;
 	int pid, fds[2], ret, n;
 
-	stack = alloc_stack(0, __cant_sleep());
+	stack = alloc_stack(0, __uml_cant_sleep());
 	if (stack == 0)
 		return -ENOMEM;
 
@@ -69,7 +69,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)
 	data.pre_data = pre_data;
 	data.argv = argv;
 	data.fd = fds[1];
-	data.buf = __cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) :
+	data.buf = __uml_cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) :
 					uml_kmalloc(PATH_MAX, UM_GFP_KERNEL);
 	pid = clone(helper_child, (void *) sp, CLONE_VM, &data);
 	if (pid < 0) {
@@ -116,7 +116,7 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
 	unsigned long stack, sp;
 	int pid, status, err;
 
-	stack = alloc_stack(0, __cant_sleep());
+	stack = alloc_stack(0, __uml_cant_sleep());
 	if (stack == 0)
 		return -ENOMEM;
 

diff --git a/arch/um/os-Linux/util.c b/arch/um/os-Linux/util.c
index 8cc8b26..0436cc9 100644
--- a/arch/um/os-Linux/util.c
+++ b/arch/um/os-Linux/util.c

@@ -166,23 +166,38 @@ __uml_setup("quiet", quiet_cmd_param,
 "quiet\n"
 "    Turns off information messages during boot.\n\n");
 
+/*
+ * The os_info/os_warn functions will be called by helper threads. These
+ * have a very limited stack size and using the libc formatting functions
+ * may overflow the stack.
+ * So pull in the kernel vscnprintf and use that instead with a fixed
+ * on-stack buffer.
+ */
+int vscnprintf(char *buf, size_t size, const char *fmt, va_list args);
+
 void os_info(const char *fmt, ...)
 {
+	char buf[256];
 	va_list list;
+	int len;
 
 	if (quiet_info)
 		return;
 
 	va_start(list, fmt);
-	vfprintf(stderr, fmt, list);
+	len = vscnprintf(buf, sizeof(buf), fmt, list);
+	fwrite(buf, len, 1, stderr);
 	va_end(list);
 }
 
 void os_warn(const char *fmt, ...)
 {
+	char buf[256];
 	va_list list;
+	int len;
 
 	va_start(list, fmt);
-	vfprintf(stderr, fmt, list);
+	len = vscnprintf(buf, sizeof(buf), fmt, list);
+	fwrite(buf, len, 1, stderr);
 	va_end(list);
 }

diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 9630527..9ffb0cc 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c

@@ -198,15 +198,6 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
 		return;
 	}
 #endif
-	/*
-	 * Work around Erratum 1386.  The XSAVES instruction malfunctions in
-	 * certain circumstances on Zen1/2 uarch, and not all parts have had
-	 * updated microcode at the time of writing (March 2023).
-	 *
-	 * Affected parts all have no supervisor XSAVE states, meaning that
-	 * the XSAVEC instruction (which works fine) is equivalent.
-	 */
-	clear_cpu_cap(c, X86_FEATURE_XSAVES);
 }
 
 static void init_amd_k7(struct cpuinfo_x86 *c)
@@ -880,6 +871,17 @@ static void init_amd_zn(struct cpuinfo_x86 *c)
 		if (c->x86 == 0x19 && !cpu_has(c, X86_FEATURE_BTC_NO))
 			set_cpu_cap(c, X86_FEATURE_BTC_NO);
 	}
+
+	/*
+	 * Work around Erratum 1386.  The XSAVES instruction malfunctions in
+	 * certain circumstances on Zen1/2 uarch, and not all parts have had
+	 * updated microcode at the time of writing (March 2023).
+	 *
+	 * Affected parts all have no supervisor XSAVE states, meaning that
+	 * the XSAVEC instruction (which works fine) is equivalent.
+	 */
+	if (c->x86 == 0x17)
+		clear_cpu_cap(c, X86_FEATURE_XSAVES);
 }
 
 static void init_amd(struct cpuinfo_x86 *c)

diff --git a/arch/x86/lib/misc.c b/arch/x86/lib/misc.c
index a018ec4..c97be9a 100644
--- a/arch/x86/lib/misc.c
+++ b/arch/x86/lib/misc.c

@@ -6,7 +6,7 @@
  */
 int num_digits(int val)
 {
-	int m = 10;
+	long long m = 10;
 	int d = 1;
 
 	if (val < 0) {

diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
index 407fa1d..50c537a 100644
--- a/arch/x86/mm/ident_map.c
+++ b/arch/x86/mm/ident_map.c

@@ -26,18 +26,31 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page,
 	for (; addr < end; addr = next) {
 		pud_t *pud = pud_page + pud_index(addr);
 		pmd_t *pmd;
+		bool use_gbpage;
 
 		next = (addr & PUD_MASK) + PUD_SIZE;
 		if (next > end)
 			next = end;
 
-		if (info->direct_gbpages) {
+		/* if this is already a gbpage, this portion is already mapped */
+		if (pud_large(*pud))
+			continue;
+
+		/* Is using a gbpage allowed? */
+		use_gbpage = info->direct_gbpages;
+
+		/* Don't use gbpage if it maps more than the requested region. */
+		/* at the begining: */
+		use_gbpage &= ((addr & ~PUD_MASK) == 0);
+		/* ... or at the end: */
+		use_gbpage &= ((next & ~PUD_MASK) == 0);
+
+		/* Never overwrite existing mappings */
+		use_gbpage &= !pud_present(*pud);
+
+		if (use_gbpage) {
 			pud_t pudval;
 
-			if (pud_present(*pud))
-				continue;
-
-			addr &= PUD_MASK;
 			pudval = __pud((addr - info->offset) | info->page_flag);
 			set_pud(pud, pudval);
 			continue;

diff --git a/block/bio.c b/block/bio.c
index b13c7a3..19a1622 100644
--- a/block/bio.c
+++ b/block/bio.c

@@ -1729,7 +1729,7 @@ void bio_set_pages_dirty(struct bio *bio)
 	bio_for_each_segment_all(bvec, bio, i) {
 		struct page *page = bvec->bv_page;
 
-		if (page && !PageCompound(page))
+		if (page)
 			set_page_dirty_lock(page);
 	}
 }
@@ -1796,7 +1796,7 @@ void bio_check_pages_dirty(struct bio *bio)
 	bio_for_each_segment_all(bvec, bio, i) {
 		struct page *page = bvec->bv_page;
 
-		if (PageDirty(page) || PageCompound(page)) {
+		if (PageDirty(page)) {
 			put_page(page);
 			bvec->bv_page = NULL;
 		} else {

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index da000a2..24de37a 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c

@@ -1060,9 +1060,13 @@ EXPORT_SYMBOL_GPL(af_alg_sendpage);
 void af_alg_free_resources(struct af_alg_async_req *areq)
 {
 	struct sock *sk = areq->sk;
+	struct af_alg_ctx *ctx;
 
 	af_alg_free_areq_sgls(areq);
 	sock_kfree_s(sk, areq, areq->areqlen);
+
+	ctx = alg_sk(sk)->private;
+	ctx->inflight = false;
 }
 EXPORT_SYMBOL_GPL(af_alg_free_resources);
 
@@ -1126,11 +1130,19 @@ EXPORT_SYMBOL_GPL(af_alg_poll);
 struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk,
 					   unsigned int areqlen)
 {
-	struct af_alg_async_req *areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
+	struct af_alg_ctx *ctx = alg_sk(sk)->private;
+	struct af_alg_async_req *areq;
 
+	/* Only one AIO request can be in flight. */
+	if (ctx->inflight)
+		return ERR_PTR(-EBUSY);
+
+	areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
 	if (unlikely(!areq))
 		return ERR_PTR(-ENOMEM);
 
+	ctx->inflight = true;
+
 	areq->areqlen = areqlen;
 	areq->sk = sk;
 	areq->last_rsgl = NULL;

diff --git a/crypto/algapi.c b/crypto/algapi.c
index 603d2d6..8557aff 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c

@@ -222,6 +222,7 @@ static struct crypto_larval *__crypto_register_alg(struct crypto_alg *alg)
 		}
 
 		if (!strcmp(q->cra_driver_name, alg->cra_name) ||
+		    !strcmp(q->cra_driver_name, alg->cra_driver_name) ||
 		    !strcmp(q->cra_name, alg->cra_driver_name))
 			goto err;
 	}

diff --git a/crypto/scompress.c b/crypto/scompress.c
index 2075e2c..9baaf49 100644
--- a/crypto/scompress.c
+++ b/crypto/scompress.c

@@ -29,9 +29,17 @@
 #include <crypto/internal/scompress.h>
 #include "internal.h"
 
+struct scomp_scratch {
+	spinlock_t	lock;
+	void		*src;
+	void		*dst;
+};
+
+static DEFINE_PER_CPU(struct scomp_scratch, scomp_scratch) = {
+	.lock = __SPIN_LOCK_UNLOCKED(scomp_scratch.lock),
+};
+
 static const struct crypto_type crypto_scomp_type;
-static void * __percpu *scomp_src_scratches;
-static void * __percpu *scomp_dst_scratches;
 static int scomp_scratch_users;
 static DEFINE_MUTEX(scomp_lock);
 
@@ -65,76 +73,53 @@ static void crypto_scomp_show(struct seq_file *m, struct crypto_alg *alg)
 	seq_puts(m, "type         : scomp\n");
 }
 
-static void crypto_scomp_free_scratches(void * __percpu *scratches)
+static void crypto_scomp_free_scratches(void)
 {
+	struct scomp_scratch *scratch;
 	int i;
 
-	if (!scratches)
-		return;
-
-	for_each_possible_cpu(i)
-		vfree(*per_cpu_ptr(scratches, i));
-
-	free_percpu(scratches);
-}
-
-static void * __percpu *crypto_scomp_alloc_scratches(void)
-{
-	void * __percpu *scratches;
-	int i;
-
-	scratches = alloc_percpu(void *);
-	if (!scratches)
-		return NULL;
-
 	for_each_possible_cpu(i) {
-		void *scratch;
+		scratch = per_cpu_ptr(&scomp_scratch, i);
 
-		scratch = vmalloc_node(SCOMP_SCRATCH_SIZE, cpu_to_node(i));
-		if (!scratch)
+		vfree(scratch->src);
+		vfree(scratch->dst);
+		scratch->src = NULL;
+		scratch->dst = NULL;
+	}
+}
+
+static int crypto_scomp_alloc_scratches(void)
+{
+	struct scomp_scratch *scratch;
+	int i;
+
+	for_each_possible_cpu(i) {
+		void *mem;
+
+		scratch = per_cpu_ptr(&scomp_scratch, i);
+
+		mem = vmalloc_node(SCOMP_SCRATCH_SIZE, cpu_to_node(i));
+		if (!mem)
 			goto error;
-		*per_cpu_ptr(scratches, i) = scratch;
-	}
-
-	return scratches;
-
-error:
-	crypto_scomp_free_scratches(scratches);
-	return NULL;
-}
-
-static void crypto_scomp_free_all_scratches(void)
-{
-	if (!--scomp_scratch_users) {
-		crypto_scomp_free_scratches(scomp_src_scratches);
-		crypto_scomp_free_scratches(scomp_dst_scratches);
-		scomp_src_scratches = NULL;
-		scomp_dst_scratches = NULL;
-	}
-}
-
-static int crypto_scomp_alloc_all_scratches(void)
-{
-	if (!scomp_scratch_users++) {
-		scomp_src_scratches = crypto_scomp_alloc_scratches();
-		if (!scomp_src_scratches)
-			return -ENOMEM;
-		scomp_dst_scratches = crypto_scomp_alloc_scratches();
-		if (!scomp_dst_scratches) {
-			crypto_scomp_free_scratches(scomp_src_scratches);
-			scomp_src_scratches = NULL;
-			return -ENOMEM;
-		}
+		scratch->src = mem;
+		mem = vmalloc_node(SCOMP_SCRATCH_SIZE, cpu_to_node(i));
+		if (!mem)
+			goto error;
+		scratch->dst = mem;
 	}
 	return 0;
+error:
+	crypto_scomp_free_scratches();
+	return -ENOMEM;
 }
 
 static int crypto_scomp_init_tfm(struct crypto_tfm *tfm)
 {
-	int ret;
+	int ret = 0;
 
 	mutex_lock(&scomp_lock);
-	ret = crypto_scomp_alloc_all_scratches();
+	if (!scomp_scratch_users++)
+		ret = crypto_scomp_alloc_scratches();
 	mutex_unlock(&scomp_lock);
 
 	return ret;
@@ -193,42 +178,47 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
 	void **tfm_ctx = acomp_tfm_ctx(tfm);
 	struct crypto_scomp *scomp = *tfm_ctx;
 	void **ctx = acomp_request_ctx(req);
-	const int cpu = get_cpu();
-	u8 *scratch_src = *per_cpu_ptr(scomp_src_scratches, cpu);
-	u8 *scratch_dst = *per_cpu_ptr(scomp_dst_scratches, cpu);
+	struct scomp_scratch *scratch;
+	unsigned int dlen;
 	int ret;
 
-	if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) {
-		ret = -EINVAL;
-		goto out;
-	}
+	if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE)
+		return -EINVAL;
 
-	if (req->dst && !req->dlen) {
-		ret = -EINVAL;
-		goto out;
-	}
+	if (req->dst && !req->dlen)
+		return -EINVAL;
 
 	if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE)
 		req->dlen = SCOMP_SCRATCH_SIZE;
 
-	scatterwalk_map_and_copy(scratch_src, req->src, 0, req->slen, 0);
+	dlen = req->dlen;
+
+	scratch = raw_cpu_ptr(&scomp_scratch);
+	spin_lock(&scratch->lock);
+
+	scatterwalk_map_and_copy(scratch->src, req->src, 0, req->slen, 0);
 	if (dir)
-		ret = crypto_scomp_compress(scomp, scratch_src, req->slen,
-					    scratch_dst, &req->dlen, *ctx);
+		ret = crypto_scomp_compress(scomp, scratch->src, req->slen,
+					    scratch->dst, &req->dlen, *ctx);
 	else
-		ret = crypto_scomp_decompress(scomp, scratch_src, req->slen,
-					      scratch_dst, &req->dlen, *ctx);
+		ret = crypto_scomp_decompress(scomp, scratch->src, req->slen,
+					      scratch->dst, &req->dlen, *ctx);
 	if (!ret) {
 		if (!req->dst) {
 			req->dst = crypto_scomp_sg_alloc(req->dlen, GFP_ATOMIC);
-			if (!req->dst)
+			if (!req->dst) {
+				ret = -ENOMEM;
 				goto out;
+			}
+		} else if (req->dlen > dlen) {
+			ret = -ENOSPC;
+			goto out;
 		}
-		scatterwalk_map_and_copy(scratch_dst, req->dst, 0, req->dlen,
+		scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen,
 					 1);
 	}
 out:
-	put_cpu();
+	spin_unlock(&scratch->lock);
 	return ret;
 }
 
@@ -249,7 +239,8 @@ static void crypto_exit_scomp_ops_async(struct crypto_tfm *tfm)
 	crypto_free_scomp(*ctx);
 
 	mutex_lock(&scomp_lock);
-	crypto_scomp_free_all_scratches();
+	if (!--scomp_scratch_users)
+		crypto_scomp_free_scratches();
 	mutex_unlock(&scomp_lock);
 }
 

diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
index e05309b..e148b0a 100644
--- a/drivers/acpi/acpi_extlog.c
+++ b/drivers/acpi/acpi_extlog.c

@@ -317,9 +317,10 @@ static void __exit extlog_exit(void)
 {
 	edac_set_report_status(old_edac_report_status);
 	mce_unregister_decode_chain(&extlog_mce_dec);
-	((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN;
-	if (extlog_l1_addr)
+	if (extlog_l1_addr) {
+		((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN;
 		acpi_os_unmap_iomem(extlog_l1_addr, l1_size);
+	}
 	if (elog_addr)
 		acpi_os_unmap_iomem(elog_addr, elog_size);
 	release_mem_region(elog_base, elog_size);

diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index cc228e5..d426ece 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c

@@ -581,6 +581,15 @@ static const struct dmi_system_id video_dmi_table[] = {
 		DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3350"),
 		},
 	},
+	{
+	 .callback = video_set_report_key_events,
+	 .driver_data = (void *)((uintptr_t)REPORT_BRIGHTNESS_KEY_EVENTS),
+	 .ident = "COLORFUL X15 AT 23",
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "COLORFUL"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "X15 AT 23"),
+		},
+	},
 	/*
 	 * Some machines change the brightness themselves when a brightness
 	 * hotkey gets pressed, despite us telling them not to. In this case
@@ -1796,12 +1805,12 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device)
 		return;
 	count++;
 
-	acpi_get_parent(device->dev->handle, &acpi_parent);
-
-	pdev = acpi_get_pci_dev(acpi_parent);
-	if (pdev) {
-		parent = &pdev->dev;
-		pci_dev_put(pdev);
+	if (ACPI_SUCCESS(acpi_get_parent(device->dev->handle, &acpi_parent))) {
+		pdev = acpi_get_pci_dev(acpi_parent);
+		if (pdev) {
+			parent = &pdev->dev;
+			pci_dev_put(pdev);
+		}
 	}
 
 	memset(&props, 0, sizeof(struct backlight_properties));

diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 457500d..c123082 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c

@@ -280,7 +280,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
 	}
 	if (mm) {
 		up_read(&mm->mmap_sem);
-		mmput(mm);
+		mmput_async(mm);
 	}
 	return 0;
 
@@ -313,7 +313,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
 err_no_vma:
 	if (mm) {
 		up_read(&mm->mmap_sem);
-		mmput(mm);
+		mmput_async(mm);
 	}
 	return vma ? -ENOMEM : -ESRCH;
 }
@@ -429,17 +429,17 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
 				alloc->pid, extra_buffers_size);
 		return ERR_PTR(-EINVAL);
 	}
-	if (is_async &&
-	    alloc->free_async_space < size + sizeof(struct binder_buffer)) {
+
+	/* Pad 0-size buffers so they get assigned unique addresses */
+	size = max(size, sizeof(void *));
+
+	if (is_async && alloc->free_async_space < size) {
 		binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
 			     "%d: binder_alloc_buf size %zd failed, no async space left\n",
 			      alloc->pid, size);
 		return ERR_PTR(-ENOSPC);
 	}
 
-	/* Pad 0-size buffers so they get assigned unique addresses */
-	size = max(size, sizeof(void *));
-
 	while (n) {
 		buffer = rb_entry(n, struct binder_buffer, rb_node);
 		BUG_ON(!buffer->free);
@@ -541,7 +541,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
 	buffer->pid = pid;
 	buffer->oneway_spam_suspect = false;
 	if (is_async) {
-		alloc->free_async_space -= size + sizeof(struct binder_buffer);
+		alloc->free_async_space -= size;
 		binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
 			     "%d: binder_alloc_buf size %zd async free %zd\n",
 			      alloc->pid, size, alloc->free_async_space);
@@ -579,7 +579,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
  * is the sum of the three given sizes (each rounded up to
  * pointer-sized boundary)
  *
- * Return:	The allocated buffer or %NULL if error
+ * Return:	The allocated buffer or %ERR_PTR(-errno) if error
  */
 struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
 					   size_t data_size,
@@ -678,8 +678,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
 	BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size);
 
 	if (buffer->async_transaction) {
-		alloc->free_async_space += buffer_size + sizeof(struct binder_buffer);
-
+		alloc->free_async_space += buffer_size;
 		binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
 			     "%d: binder_free_buf size %zd async free %zd\n",
 			      alloc->pid, size, alloc->free_async_space);

diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index e7a6b49..c777973 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c

@@ -2933,6 +2933,8 @@ open_card_ubr0(struct idt77252_dev *card)
 	vc->scq = alloc_scq(card, vc->class);
 	if (!vc->scq) {
 		printk("%s: can't get SCQ.\n", card->name);
+		kfree(card->vcs[0]);
+		card->vcs[0] = NULL;
 		return -ENOMEM;
 	}
 

diff --git a/drivers/base/core.c b/drivers/base/core.c
index e834087..4f1ac62 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c

@@ -3075,6 +3075,50 @@ define_dev_printk_level(_dev_info, KERN_INFO);
 
 #endif
 
+/**
+ * dev_err_probe - probe error check and log helper
+ * @dev: the pointer to the struct device
+ * @err: error value to test
+ * @fmt: printf-style format string
+ * @...: arguments as specified in the format string
+ *
+ * This helper implements common pattern present in probe functions for error
+ * checking: print debug or error message depending if the error value is
+ * -EPROBE_DEFER and propagate error upwards.
+ * It replaces code sequence::
+ * 	if (err != -EPROBE_DEFER)
+ * 		dev_err(dev, ...);
+ * 	else
+ * 		dev_dbg(dev, ...);
+ * 	return err;
+ *
+ * with::
+ *
+ * 	return dev_err_probe(dev, err, ...);
+ *
+ * Returns @err.
+ *
+ */
+int dev_err_probe(const struct device *dev, int err, const char *fmt, ...)
+{
+	struct va_format vaf;
+	va_list args;
+
+	va_start(args, fmt);
+	vaf.fmt = fmt;
+	vaf.va = &args;
+
+	if (err != -EPROBE_DEFER)
+		dev_err(dev, "error %pe: %pV", ERR_PTR(err), &vaf);
+	else
+		dev_dbg(dev, "error %pe: %pV", ERR_PTR(err), &vaf);
+
+	va_end(args);
+
+	return err;
+}
+EXPORT_SYMBOL_GPL(dev_err_probe);
+
 static inline bool fwnode_is_primary(struct fwnode_handle *fwnode)
 {
 	return fwnode && !IS_ERR(fwnode->secondary);

diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 0f38df5..a469fb4 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c

@@ -749,7 +749,7 @@ static int __init genpd_power_off_unused(void)
 
 	return 0;
 }
-late_initcall(genpd_power_off_unused);
+late_initcall_sync(genpd_power_off_unused);
 
 #if defined(CONFIG_PM_SLEEP) || defined(CONFIG_PM_GENERIC_DOMAINS_OF)
 

diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 303fd55..a12561f 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c

@@ -24,10 +24,13 @@
 #include <linux/random.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
+#include <linux/string.h>
 #include <linux/uaccess.h>
 
 #define RNG_MODULE_NAME		"hw_random"
 
+#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES)
+
 static struct hwrng *current_rng;
 /* the current rng has been explicitly chosen by user via sysfs */
 static int cur_rng_set_by_user;
@@ -59,7 +62,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
 
 static size_t rng_buffer_size(void)
 {
-	return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
+	return RNG_BUFFER_SIZE;
 }
 
 static void add_early_randomness(struct hwrng *rng)
@@ -202,6 +205,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
 static ssize_t rng_dev_read(struct file *filp, char __user *buf,
 			    size_t size, loff_t *offp)
 {
+	u8 buffer[RNG_BUFFER_SIZE];
 	ssize_t ret = 0;
 	int err = 0;
 	int bytes_read, len;
@@ -229,34 +233,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
 			if (bytes_read < 0) {
 				err = bytes_read;
 				goto out_unlock_reading;
-			}
-			data_avail = bytes_read;
-		}
-
-		if (!data_avail) {
-			if (filp->f_flags & O_NONBLOCK) {
+			} else if (bytes_read == 0 &&
+				   (filp->f_flags & O_NONBLOCK)) {
 				err = -EAGAIN;
 				goto out_unlock_reading;
 			}
-		} else {
-			len = data_avail;
+
+			data_avail = bytes_read;
+		}
+
+		len = data_avail;
+		if (len) {
 			if (len > size)
 				len = size;
 
 			data_avail -= len;
 
-			if (copy_to_user(buf + ret, rng_buffer + data_avail,
-								len)) {
+			memcpy(buffer, rng_buffer + data_avail, len);
+		}
+		mutex_unlock(&reading_mutex);
+		put_rng(rng);
+
+		if (len) {
+			if (copy_to_user(buf + ret, buffer, len)) {
 				err = -EFAULT;
-				goto out_unlock_reading;
+				goto out;
 			}
 
 			size -= len;
 			ret += len;
 		}
 
-		mutex_unlock(&reading_mutex);
-		put_rng(rng);
 
 		if (need_resched())
 			schedule_timeout_interruptible(1);
@@ -267,6 +274,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
 		}
 	}
 out:
+	memzero_explicit(buffer, sizeof(buffer));
 	return ret ? : err;
 
 out_unlock_reading:

diff --git a/drivers/clk/hisilicon/clk-hi3620.c b/drivers/clk/hisilicon/clk-hi3620.c
index fa0fba6..7f49c70 100644
--- a/drivers/clk/hisilicon/clk-hi3620.c
+++ b/drivers/clk/hisilicon/clk-hi3620.c

@@ -481,8 +481,10 @@ static void __init hi3620_mmc_clk_init(struct device_node *node)
 		return;
 
 	clk_data->clks = kcalloc(num, sizeof(*clk_data->clks), GFP_KERNEL);
-	if (!clk_data->clks)
+	if (!clk_data->clks) {
+		kfree(clk_data);
 		return;
+	}
 
 	for (i = 0; i < num; i++) {
 		struct hisi_mmc_clock *mmc_clk = &hi3620_mmc_clks[i];

diff --git a/drivers/clk/mmp/clk-of-pxa168.c b/drivers/clk/mmp/clk-of-pxa168.c
index f110c02..9674c6c 100644
--- a/drivers/clk/mmp/clk-of-pxa168.c
+++ b/drivers/clk/mmp/clk-of-pxa168.c

@@ -258,18 +258,21 @@ static void __init pxa168_clk_init(struct device_node *np)
 	pxa_unit->mpmu_base = of_iomap(np, 0);
 	if (!pxa_unit->mpmu_base) {
 		pr_err("failed to map mpmu registers\n");
+		kfree(pxa_unit);
 		return;
 	}
 
 	pxa_unit->apmu_base = of_iomap(np, 1);
 	if (!pxa_unit->apmu_base) {
 		pr_err("failed to map apmu registers\n");
+		kfree(pxa_unit);
 		return;
 	}
 
 	pxa_unit->apbc_base = of_iomap(np, 2);
 	if (!pxa_unit->apbc_base) {
 		pr_err("failed to map apbc registers\n");
+		kfree(pxa_unit);
 		return;
 	}
 

diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c
index 5970a50..83c7eb1 100644
--- a/drivers/clk/rockchip/clk-rk3128.c
+++ b/drivers/clk/rockchip/clk-rk3128.c

@@ -497,7 +497,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
 	GATE(HCLK_I2S_2CH, "hclk_i2s_2ch", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 2, GFLAGS),
 	GATE(0, "hclk_usb_peri", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 13, GFLAGS),
 	GATE(HCLK_HOST2, "hclk_host2", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 3, GFLAGS),
-	GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(3), 13, GFLAGS),
+	GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 13, GFLAGS),
 	GATE(0, "hclk_peri_ahb", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 14, GFLAGS),
 	GATE(HCLK_SPDIF, "hclk_spdif", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 9, GFLAGS),
 	GATE(HCLK_TSP, "hclk_tsp", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 12, GFLAGS),

diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index 453d27d..56c5713 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c

@@ -183,8 +183,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa,
 
 		wa->dma.address = dma_map_single(wa->dev, wa->address, len,
 						 dir);
-		if (dma_mapping_error(wa->dev, wa->dma.address))
+		if (dma_mapping_error(wa->dev, wa->dma.address)) {
+			kfree(wa->address);
+			wa->address = NULL;
 			return -ENOMEM;
+		}
 
 		wa->dma.length = len;
 	}

diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index 085c229..fdc9db6 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c

@@ -46,7 +46,6 @@
 #define FLAGS_MODE_MASK		0x000f
 #define FLAGS_ENCRYPT		BIT(0)
 #define FLAGS_CBC		BIT(1)
-#define FLAGS_NEW_KEY		BIT(3)
 
 #define SAHARA_HDR_BASE			0x00800000
 #define SAHARA_HDR_SKHA_ALG_AES	0
@@ -144,8 +143,6 @@ struct sahara_hw_link {
 };
 
 struct sahara_ctx {
-	unsigned long flags;
-
 	/* AES-specific context */
 	int keylen;
 	u8 key[AES_KEYSIZE_128];
@@ -448,27 +445,24 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
 	int ret;
 	int i, j;
 	int idx = 0;
+	u32 len;
 
-	/* Copy new key if necessary */
-	if (ctx->flags & FLAGS_NEW_KEY) {
-		memcpy(dev->key_base, ctx->key, ctx->keylen);
-		ctx->flags &= ~FLAGS_NEW_KEY;
+	memcpy(dev->key_base, ctx->key, ctx->keylen);
 
-		if (dev->flags & FLAGS_CBC) {
-			dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE;
-			dev->hw_desc[idx]->p1 = dev->iv_phys_base;
-		} else {
-			dev->hw_desc[idx]->len1 = 0;
-			dev->hw_desc[idx]->p1 = 0;
-		}
-		dev->hw_desc[idx]->len2 = ctx->keylen;
-		dev->hw_desc[idx]->p2 = dev->key_phys_base;
-		dev->hw_desc[idx]->next = dev->hw_phys_desc[1];
-
-		dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev);
-
-		idx++;
+	if (dev->flags & FLAGS_CBC) {
+		dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE;
+		dev->hw_desc[idx]->p1 = dev->iv_phys_base;
+	} else {
+		dev->hw_desc[idx]->len1 = 0;
+		dev->hw_desc[idx]->p1 = 0;
 	}
+	dev->hw_desc[idx]->len2 = ctx->keylen;
+	dev->hw_desc[idx]->p2 = dev->key_phys_base;
+	dev->hw_desc[idx]->next = dev->hw_phys_desc[1];
+	dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev);
+
+	idx++;
+
 
 	dev->nb_in_sg = sg_nents_for_len(dev->in_sg, dev->total);
 	if (dev->nb_in_sg < 0) {
@@ -490,24 +484,27 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
 			 DMA_TO_DEVICE);
 	if (ret != dev->nb_in_sg) {
 		dev_err(dev->device, "couldn't map in sg\n");
-		goto unmap_in;
+		return -EINVAL;
 	}
+
 	ret = dma_map_sg(dev->device, dev->out_sg, dev->nb_out_sg,
 			 DMA_FROM_DEVICE);
 	if (ret != dev->nb_out_sg) {
 		dev_err(dev->device, "couldn't map out sg\n");
-		goto unmap_out;
+		goto unmap_in;
 	}
 
 	/* Create input links */
 	dev->hw_desc[idx]->p1 = dev->hw_phys_link[0];
 	sg = dev->in_sg;
+	len = dev->total;
 	for (i = 0; i < dev->nb_in_sg; i++) {
-		dev->hw_link[i]->len = sg->length;
+		dev->hw_link[i]->len = min(len, sg->length);
 		dev->hw_link[i]->p = sg->dma_address;
 		if (i == (dev->nb_in_sg - 1)) {
 			dev->hw_link[i]->next = 0;
 		} else {
+			len -= min(len, sg->length);
 			dev->hw_link[i]->next = dev->hw_phys_link[i + 1];
 			sg = sg_next(sg);
 		}
@@ -516,12 +513,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
 	/* Create output links */
 	dev->hw_desc[idx]->p2 = dev->hw_phys_link[i];
 	sg = dev->out_sg;
+	len = dev->total;
 	for (j = i; j < dev->nb_out_sg + i; j++) {
-		dev->hw_link[j]->len = sg->length;
+		dev->hw_link[j]->len = min(len, sg->length);
 		dev->hw_link[j]->p = sg->dma_address;
 		if (j == (dev->nb_out_sg + i - 1)) {
 			dev->hw_link[j]->next = 0;
 		} else {
+			len -= min(len, sg->length);
 			dev->hw_link[j]->next = dev->hw_phys_link[j + 1];
 			sg = sg_next(sg);
 		}
@@ -540,9 +539,6 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
 
 	return 0;
 
-unmap_out:
-	dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg,
-		DMA_FROM_DEVICE);
 unmap_in:
 	dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
 		DMA_TO_DEVICE);
@@ -587,16 +583,17 @@ static int sahara_aes_process(struct ablkcipher_request *req)
 
 	timeout = wait_for_completion_timeout(&dev->dma_completion,
 				msecs_to_jiffies(SAHARA_TIMEOUT_MS));
-	if (!timeout) {
-		dev_err(dev->device, "AES timeout\n");
-		return -ETIMEDOUT;
-	}
 
 	dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg,
 		DMA_FROM_DEVICE);
 	dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
 		DMA_TO_DEVICE);
 
+	if (!timeout) {
+		dev_err(dev->device, "AES timeout\n");
+		return -ETIMEDOUT;
+	}
+
 	return 0;
 }
 
@@ -611,7 +608,6 @@ static int sahara_aes_setkey(struct crypto_ablkcipher *tfm, const u8 *key,
 	/* SAHARA only supports 128bit keys */
 	if (keylen == AES_KEYSIZE_128) {
 		memcpy(ctx->key, key, keylen);
-		ctx->flags |= FLAGS_NEW_KEY;
 		return 0;
 	}
 
@@ -800,6 +796,7 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,
 				       int start)
 {
 	struct scatterlist *sg;
+	unsigned int len;
 	unsigned int i;
 	int ret;
 
@@ -821,12 +818,14 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,
 	if (!ret)
 		return -EFAULT;
 
+	len = rctx->total;
 	for (i = start; i < dev->nb_in_sg + start; i++) {
-		dev->hw_link[i]->len = sg->length;
+		dev->hw_link[i]->len = min(len, sg->length);
 		dev->hw_link[i]->p = sg->dma_address;
 		if (i == (dev->nb_in_sg + start - 1)) {
 			dev->hw_link[i]->next = 0;
 		} else {
+			len -= min(len, sg->length);
 			dev->hw_link[i]->next = dev->hw_phys_link[i + 1];
 			sg = sg_next(sg);
 		}
@@ -907,24 +906,6 @@ static int sahara_sha_hw_context_descriptor_create(struct sahara_dev *dev,
 	return 0;
 }
 
-static int sahara_walk_and_recalc(struct scatterlist *sg, unsigned int nbytes)
-{
-	if (!sg || !sg->length)
-		return nbytes;
-
-	while (nbytes && sg) {
-		if (nbytes <= sg->length) {
-			sg->length = nbytes;
-			sg_mark_end(sg);
-			break;
-		}
-		nbytes -= sg->length;
-		sg = sg_next(sg);
-	}
-
-	return nbytes;
-}
-
 static int sahara_sha_prepare_request(struct ahash_request *req)
 {
 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
@@ -961,36 +942,20 @@ static int sahara_sha_prepare_request(struct ahash_request *req)
 					hash_later, 0);
 	}
 
-	/* nbytes should now be multiple of blocksize */
-	req->nbytes = req->nbytes - hash_later;
-
-	sahara_walk_and_recalc(req->src, req->nbytes);
-
+	rctx->total = len - hash_later;
 	/* have data from previous operation and current */
 	if (rctx->buf_cnt && req->nbytes) {
 		sg_init_table(rctx->in_sg_chain, 2);
 		sg_set_buf(rctx->in_sg_chain, rctx->rembuf, rctx->buf_cnt);
-
 		sg_chain(rctx->in_sg_chain, 2, req->src);
-
-		rctx->total = req->nbytes + rctx->buf_cnt;
 		rctx->in_sg = rctx->in_sg_chain;
-
-		req->src = rctx->in_sg_chain;
 	/* only data from previous operation */
 	} else if (rctx->buf_cnt) {
-		if (req->src)
-			rctx->in_sg = req->src;
-		else
-			rctx->in_sg = rctx->in_sg_chain;
-		/* buf was copied into rembuf above */
+		rctx->in_sg = rctx->in_sg_chain;
 		sg_init_one(rctx->in_sg, rctx->rembuf, rctx->buf_cnt);
-		rctx->total = rctx->buf_cnt;
 	/* no data from previous operation */
 	} else {
 		rctx->in_sg = req->src;
-		rctx->total = req->nbytes;
-		req->src = rctx->in_sg;
 	}
 
 	/* on next call, we only have the remaining data in the buffer */
@@ -1011,7 +976,10 @@ static int sahara_sha_process(struct ahash_request *req)
 		return ret;
 
 	if (rctx->first) {
-		sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0);
+		ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0);
+		if (ret)
+			return ret;
+
 		dev->hw_desc[0]->next = 0;
 		rctx->first = 0;
 	} else {
@@ -1019,7 +987,10 @@ static int sahara_sha_process(struct ahash_request *req)
 
 		sahara_sha_hw_context_descriptor_create(dev, rctx, req, 0);
 		dev->hw_desc[0]->next = dev->hw_phys_desc[1];
-		sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1);
+		ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1);
+		if (ret)
+			return ret;
+
 		dev->hw_desc[1]->next = 0;
 	}
 
@@ -1032,18 +1003,19 @@ static int sahara_sha_process(struct ahash_request *req)
 
 	timeout = wait_for_completion_timeout(&dev->dma_completion,
 				msecs_to_jiffies(SAHARA_TIMEOUT_MS));
-	if (!timeout) {
-		dev_err(dev->device, "SHA timeout\n");
-		return -ETIMEDOUT;
-	}
 
 	if (rctx->sg_in_idx)
 		dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
 			     DMA_TO_DEVICE);
 
+	if (!timeout) {
+		dev_err(dev->device, "SHA timeout\n");
+		return -ETIMEDOUT;
+	}
+
 	memcpy(rctx->context, dev->context_base, rctx->context_size);
 
-	if (req->result)
+	if (req->result && rctx->last)
 		memcpy(req->result, rctx->context, rctx->digest_size);
 
 	return 0;
@@ -1187,8 +1159,7 @@ static int sahara_sha_import(struct ahash_request *req, const void *in)
 static int sahara_sha_cra_init(struct crypto_tfm *tfm)
 {
 	crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm),
-				 sizeof(struct sahara_sha_reqctx) +
-				 SHA_BUFFER_LEN + SHA256_BLOCK_SIZE);
+				 sizeof(struct sahara_sha_reqctx));
 
 	return 0;
 }

diff --git a/drivers/crypto/virtio/virtio_crypto_common.h b/drivers/crypto/virtio/virtio_crypto_common.h
index e976539..d8be210 100644
--- a/drivers/crypto/virtio/virtio_crypto_common.h
+++ b/drivers/crypto/virtio/virtio_crypto_common.h

@@ -22,6 +22,7 @@
 #include <linux/virtio.h>
 #include <linux/crypto.h>
 #include <linux/spinlock.h>
+#include <linux/interrupt.h>
 #include <crypto/aead.h>
 #include <crypto/aes.h>
 #include <crypto/authenc.h>
@@ -40,6 +41,7 @@ struct data_queue {
 	char name[32];
 
 	struct crypto_engine *engine;
+	struct tasklet_struct done_task;
 };
 
 struct virtio_crypto {

diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c
index ff1410a..e21dd21 100644
--- a/drivers/crypto/virtio/virtio_crypto_core.c
+++ b/drivers/crypto/virtio/virtio_crypto_core.c

@@ -34,27 +34,28 @@ virtcrypto_clear_request(struct virtio_crypto_request *vc_req)
 	}
 }
 
-static void virtcrypto_dataq_callback(struct virtqueue *vq)
+static void virtcrypto_done_task(unsigned long data)
 {
-	struct virtio_crypto *vcrypto = vq->vdev->priv;
+	struct data_queue *data_vq = (struct data_queue *)data;
+	struct virtqueue *vq = data_vq->vq;
 	struct virtio_crypto_request *vc_req;
-	unsigned long flags;
 	unsigned int len;
-	unsigned int qid = vq->index;
 
-	spin_lock_irqsave(&vcrypto->data_vq[qid].lock, flags);
 	do {
 		virtqueue_disable_cb(vq);
 		while ((vc_req = virtqueue_get_buf(vq, &len)) != NULL) {
-			spin_unlock_irqrestore(
-				&vcrypto->data_vq[qid].lock, flags);
 			if (vc_req->alg_cb)
 				vc_req->alg_cb(vc_req, len);
-			spin_lock_irqsave(
-				&vcrypto->data_vq[qid].lock, flags);
 		}
 	} while (!virtqueue_enable_cb(vq));
-	spin_unlock_irqrestore(&vcrypto->data_vq[qid].lock, flags);
+}
+
+static void virtcrypto_dataq_callback(struct virtqueue *vq)
+{
+	struct virtio_crypto *vcrypto = vq->vdev->priv;
+	struct data_queue *dq = &vcrypto->data_vq[vq->index];
+
+	tasklet_schedule(&dq->done_task);
 }
 
 static int virtcrypto_find_vqs(struct virtio_crypto *vi)
@@ -114,6 +115,8 @@ static int virtcrypto_find_vqs(struct virtio_crypto *vi)
 
 		vi->data_vq[i].engine->cipher_one_request =
 			virtio_crypto_ablkcipher_crypt_req;
+		tasklet_init(&vi->data_vq[i].done_task, virtcrypto_done_task,
+				(unsigned long)&vi->data_vq[i]);
 	}
 
 	kfree(names);
@@ -417,11 +420,14 @@ static void virtcrypto_free_unused_reqs(struct virtio_crypto *vcrypto)
 static void virtcrypto_remove(struct virtio_device *vdev)
 {
 	struct virtio_crypto *vcrypto = vdev->priv;
+	int i;
 
 	dev_info(&vdev->dev, "Start virtcrypto_remove.\n");
 
 	if (virtcrypto_dev_started(vcrypto))
 		virtcrypto_dev_stop(vcrypto);
+	for (i = 0; i < vcrypto->max_data_queues; i++)
+		tasklet_kill(&vcrypto->data_vq[i].done_task);
 	vdev->config->reset(vdev);
 	virtcrypto_free_unused_reqs(vcrypto);
 	virtcrypto_clear_crypto_engines(vcrypto);

diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c
index dfefa39..bc9ecc6 100644
--- a/drivers/edac/thunderx_edac.c
+++ b/drivers/edac/thunderx_edac.c

@@ -1154,7 +1154,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
 		decode_register(other, OCX_OTHER_SIZE,
 				ocx_com_errors, ctx->reg_com_int);
 
-		strncat(msg, other, OCX_MESSAGE_SIZE);
+		strlcat(msg, other, OCX_MESSAGE_SIZE);
 
 		for (lane = 0; lane < OCX_RX_LANES; lane++)
 			if (ctx->reg_com_int & BIT(lane)) {
@@ -1163,12 +1163,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
 					 lane, ctx->reg_lane_int[lane],
 					 lane, ctx->reg_lane_stat11[lane]);
 
-				strncat(msg, other, OCX_MESSAGE_SIZE);
+				strlcat(msg, other, OCX_MESSAGE_SIZE);
 
 				decode_register(other, OCX_OTHER_SIZE,
 						ocx_lane_errors,
 						ctx->reg_lane_int[lane]);
-				strncat(msg, other, OCX_MESSAGE_SIZE);
+				strlcat(msg, other, OCX_MESSAGE_SIZE);
 			}
 
 		if (ctx->reg_com_int & OCX_COM_INT_CE)
@@ -1238,7 +1238,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id)
 		decode_register(other, OCX_OTHER_SIZE,
 				ocx_com_link_errors, ctx->reg_com_link_int);
 
-		strncat(msg, other, OCX_MESSAGE_SIZE);
+		strlcat(msg, other, OCX_MESSAGE_SIZE);
 
 		if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE)
 			edac_device_handle_ue(ocx->edac_dev, 0, 0, msg);
@@ -1917,7 +1917,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)
 
 		decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int);
 
-		strncat(msg, other, L2C_MESSAGE_SIZE);
+		strlcat(msg, other, L2C_MESSAGE_SIZE);
 
 		if (ctx->reg_int & mask_ue)
 			edac_device_handle_ue(l2c->edac_dev, 0, 0, msg);

diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index a293b39f..25c5de0 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c

@@ -113,10 +113,9 @@ static int textual_leaf_to_string(const u32 *block, char *buf, size_t size)
  * @buf:	where to put the string
  * @size:	size of @buf, in bytes
  *
- * The string is taken from a minimal ASCII text descriptor leaf after
- * the immediate entry with @key.  The string is zero-terminated.
- * An overlong string is silently truncated such that it and the
- * zero byte fit into @size.
+ * The string is taken from a minimal ASCII text descriptor leaf just after the entry with the
+ * @key. The string is zero-terminated. An overlong string is silently truncated such that it
+ * and the zero byte fit into @size.
  *
  * Returns strlen(buf) or a negative error code.
  */

diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
index dd677fc..7ac5a8b 100644
--- a/drivers/firmware/ti_sci.c
+++ b/drivers/firmware/ti_sci.c

@@ -184,7 +184,7 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
 {
 	struct device *dev = &pdev->dev;
 	struct resource *res;
-	char debug_name[50] = "ti_sci_debug@";
+	char debug_name[50];
 
 	/* Debug region is optional */
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -201,10 +201,10 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
 	/* Setup NULL termination */
 	info->debug_buffer[info->debug_region_size] = 0;
 
-	info->d = debugfs_create_file(strncat(debug_name, dev_name(dev),
-					      sizeof(debug_name) -
-					      sizeof("ti_sci_debug@")),
-				      0444, NULL, info, &ti_sci_debug_fops);
+	snprintf(debug_name, sizeof(debug_name), "ti_sci_debug@%s",
+		 dev_name(dev));
+	info->d = debugfs_create_file(debug_name, 0444, NULL, info,
+				      &ti_sci_debug_fops);
 	if (IS_ERR(info->d))
 		return PTR_ERR(info->d);
 

diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 713dc43..a2d00b1f 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c

@@ -1476,6 +1476,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = {
 			.ignore_wake = "INT33FF:01@0",
 		},
 	},
+	{
+		/*
+		 * Spurious wakeups from TP_ATTN# pin
+		 * Found in BIOS 0.35
+		 * https://gitlab.freedesktop.org/drm/amd/-/issues/3073
+		 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "GPD"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "G1619-04"),
+		},
+		.driver_data = &(struct acpi_gpiolib_dmi_quirk) {
+			.ignore_wake = "PNP0C50:00@8",
+		},
+	},
 	{} /* Terminating entry */
 };
 

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 076b22c..d7192b2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c

@@ -701,6 +701,7 @@ static bool amdgpu_vpost_needed(struct amdgpu_device *adev)
 				return true;
 
 			fw_ver = *((uint32_t *)adev->pm.fw->data + 69);
+			release_firmware(adev->pm.fw);
 			if (fw_ver < 0x00160e00)
 				return true;
 		}

diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index d99fb88..a4c9a32 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c

@@ -2718,10 +2718,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev)
 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
 		ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL);
-		if (ps == NULL) {
-			kfree(adev->pm.dpm.ps);
+		if (ps == NULL)
 			return -ENOMEM;
-		}
 		adev->pm.dpm.ps[i].ps_priv = ps;
 		k = 0;
 		idx = (u8 *)&power_state->v2.clockInfoIndex[0];

diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index 288ac69..5f80f44 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c

@@ -7336,10 +7336,9 @@ static int si_dpm_init(struct amdgpu_device *adev)
 
 	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries =
 		kzalloc(4 * sizeof(struct amdgpu_clock_voltage_dependency_entry), GFP_KERNEL);
-	if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
-		amdgpu_free_extended_power_table(adev);
+	if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries)
 		return -ENOMEM;
-	}
+
 	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4;
 	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0;
 	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0;

diff --git a/drivers/gpu/drm/bridge/nxp-ptn3460.c b/drivers/gpu/drm/bridge/nxp-ptn3460.c
index d64a328..4ea8098 100644
--- a/drivers/gpu/drm/bridge/nxp-ptn3460.c
+++ b/drivers/gpu/drm/bridge/nxp-ptn3460.c

@@ -64,13 +64,13 @@ static int ptn3460_read_bytes(struct ptn3460_bridge *ptn_bridge, char addr,
 	int ret;
 
 	ret = i2c_master_send(ptn_bridge->client, &addr, 1);
-	if (ret <= 0) {
+	if (ret < 0) {
 		DRM_ERROR("Failed to send i2c command, ret=%d\n", ret);
 		return ret;
 	}
 
 	ret = i2c_master_recv(ptn_bridge->client, buf, len);
-	if (ret <= 0) {
+	if (ret < 0) {
 		DRM_ERROR("Failed to recv i2c data, ret=%d\n", ret);
 		return ret;
 	}
@@ -88,7 +88,7 @@ static int ptn3460_write_byte(struct ptn3460_bridge *ptn_bridge, char addr,
 	buf[1] = val;
 
 	ret = i2c_master_send(ptn_bridge->client, buf, ARRAY_SIZE(buf));
-	if (ret <= 0) {
+	if (ret < 0) {
 		DRM_ERROR("Failed to send i2c command, ret=%d\n", ret);
 		return ret;
 	}

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 5af25ce..7e37b43 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c

@@ -556,8 +556,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
 	struct drm_mode_set set;
 	uint32_t __user *set_connectors_ptr;
 	struct drm_modeset_acquire_ctx ctx;
-	int ret;
-	int i;
+	int ret, i, num_connectors = 0;
 
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
@@ -692,6 +691,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
 					connector->name);
 
 			connector_set[i] = connector;
+			num_connectors++;
 		}
 	}
 
@@ -700,7 +700,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
 	set.y = crtc_req->y;
 	set.mode = mode;
 	set.connectors = connector_set;
-	set.num_connectors = crtc_req->count_connectors;
+	set.num_connectors = num_connectors;
 	set.fb = fb;
 	ret = __drm_mode_set_config_internal(&set, &ctx);
 
@@ -709,7 +709,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
 		drm_framebuffer_put(fb);
 
 	if (connector_set) {
-		for (i = 0; i < crtc_req->count_connectors; i++) {
+		for (i = 0; i < num_connectors; i++) {
 			if (connector_set[i])
 				drm_connector_put(connector_set[i]);
 		}

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 340440f..384a060a 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c

@@ -812,8 +812,11 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
 			goto err_minors;
 	}
 
-	if (drm_core_check_feature(dev, DRIVER_MODESET))
-		drm_modeset_register_all(dev);
+	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+		ret = drm_modeset_register_all(dev);
+		if (ret)
+			goto err_unload;
+	}
 
 	ret = 0;
 
@@ -825,6 +828,9 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
 
 	goto out_unlock;
 
+err_unload:
+	if (dev->driver->unload)
+		dev->driver->unload(dev);
 err_minors:
 	remove_compat_control_link(dev);
 	drm_minor_unregister(dev, DRM_MINOR_PRIMARY);

diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index 3cf07f5..8705060 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c

@@ -138,7 +138,7 @@ int drm_open(struct inode *inode, struct file *filp)
 {
 	struct drm_device *dev;
 	struct drm_minor *minor;
-	int retcode;
+	int retcode = 0;
 	int need_setup = 0;
 
 	minor = drm_minor_acquire(iminor(inode));

diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index af40189..d647622 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c

@@ -521,7 +521,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
 	struct drm_framebuffer *fb;
 	unsigned flags;
 	int num_clips;
-	int ret;
+	int ret = 0;
 
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;

diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
index 6995bee..488e8e3 100644
--- a/drivers/gpu/drm/drm_mipi_dsi.c
+++ b/drivers/gpu/drm/drm_mipi_dsi.c

@@ -305,7 +305,8 @@ static int mipi_dsi_remove_device_fn(struct device *dev, void *priv)
 {
 	struct mipi_dsi_device *dsi = to_mipi_dsi_device(dev);
 
-	mipi_dsi_detach(dsi);
+	if (dsi->attached)
+		mipi_dsi_detach(dsi);
 	mipi_dsi_device_unregister(dsi);
 
 	return 0;
@@ -328,11 +329,18 @@ EXPORT_SYMBOL(mipi_dsi_host_unregister);
 int mipi_dsi_attach(struct mipi_dsi_device *dsi)
 {
 	const struct mipi_dsi_host_ops *ops = dsi->host->ops;
+	int ret;
 
 	if (!ops || !ops->attach)
 		return -ENOSYS;
 
-	return ops->attach(dsi->host, dsi);
+	ret = ops->attach(dsi->host, dsi);
+	if (ret)
+		return ret;
+
+	dsi->attached = true;
+
+	return 0;
 }
 EXPORT_SYMBOL(mipi_dsi_attach);
 
@@ -344,9 +352,14 @@ int mipi_dsi_detach(struct mipi_dsi_device *dsi)
 {
 	const struct mipi_dsi_host_ops *ops = dsi->host->ops;
 
+	if (WARN_ON(!dsi->attached))
+		return -EINVAL;
+
 	if (!ops || !ops->detach)
 		return -ENOSYS;
 
+	dsi->attached = false;
+
 	return ops->detach(dsi->host, dsi);
 }
 EXPORT_SYMBOL(mipi_dsi_detach);

diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index 71186bf..5354deda 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c

@@ -1072,6 +1072,7 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
 out:
 	if (fb)
 		drm_framebuffer_put(fb);
+	fb = NULL;
 	if (crtc->primary->old_fb)
 		drm_framebuffer_put(crtc->primary->old_fb);
 	crtc->primary->old_fb = NULL;

diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 82b7242..707b4fd 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c

@@ -407,6 +407,7 @@ static int exynos_drm_bind(struct device *dev)
 	drm_release_iommu_mapping(drm);
 err_free_private:
 	kfree(private);
+	dev_set_drvdata(dev, NULL);
 err_free_drm:
 	drm_dev_unref(drm);
 
@@ -423,6 +424,7 @@ static void exynos_drm_unbind(struct device *dev)
 
 	exynos_drm_fbdev_fini(drm);
 	drm_kms_helper_poll_fini(drm);
+	drm_atomic_helper_shutdown(drm);
 
 	component_unbind_all(drm->dev, drm);
 	drm_mode_config_cleanup(drm);
@@ -460,9 +462,18 @@ static int exynos_drm_platform_remove(struct platform_device *pdev)
 	return 0;
 }
 
+static void exynos_drm_platform_shutdown(struct platform_device *pdev)
+{
+	struct drm_device *drm = platform_get_drvdata(pdev);
+
+	if (drm)
+		drm_atomic_helper_shutdown(drm);
+}
+
 static struct platform_driver exynos_drm_platform_driver = {
 	.probe	= exynos_drm_platform_probe,
 	.remove	= exynos_drm_platform_remove,
+	.shutdown = exynos_drm_platform_shutdown,
 	.driver	= {
 		.name	= "exynos-drm",
 		.pm	= &exynos_drm_pm_ops,

diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 0109ff4..3d79a7a 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c

@@ -1722,6 +1722,8 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
 		return ret;
 
 	crtc = exynos_drm_crtc_get_by_type(drm_dev, EXYNOS_DISPLAY_TYPE_HDMI);
+	if (IS_ERR(crtc))
+		return PTR_ERR(crtc);
 	crtc->pipe_clk = &hdata->phy_clk;
 
 	ret = hdmi_create_connector(encoder);

diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
index 47fa2ab..de0dac7 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c

@@ -284,6 +284,7 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
 {
 	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
 	struct mdp4_kms *mdp4_kms = get_kms(crtc);
+	unsigned long flags;
 
 	DBG("%s", mdp4_crtc->name);
 
@@ -293,6 +294,14 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
 	mdp_irq_unregister(&mdp4_kms->base, &mdp4_crtc->err);
 	mdp4_disable(mdp4_kms);
 
+	if (crtc->state->event && !crtc->state->active) {
+		WARN_ON(mdp4_crtc->event);
+		spin_lock_irqsave(&mdp4_kms->dev->event_lock, flags);
+		drm_crtc_send_vblank_event(crtc, crtc->state->event);
+		crtc->state->event = NULL;
+		spin_unlock_irqrestore(&mdp4_kms->dev->event_lock, flags);
+	}
+
 	mdp4_crtc->enabled = false;
 }
 

diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index a492937..56e13bd 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c

@@ -2307,7 +2307,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
 	switch (prim_walk) {
 	case 1:
 		for (i = 0; i < track->num_arrays; i++) {
-			size = track->arrays[i].esize * track->max_indx * 4;
+			size = track->arrays[i].esize * track->max_indx * 4UL;
 			if (track->arrays[i].robj == NULL) {
 				DRM_ERROR("(PW %u) Vertex array %u no buffer "
 					  "bound\n", prim_walk, i);
@@ -2326,7 +2326,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
 		break;
 	case 2:
 		for (i = 0; i < track->num_arrays; i++) {
-			size = track->arrays[i].esize * (nverts - 1) * 4;
+			size = track->arrays[i].esize * (nverts - 1) * 4UL;
 			if (track->arrays[i].robj == NULL) {
 				DRM_ERROR("(PW %u) Vertex array %u no buffer "
 					  "bound\n", prim_walk, i);

diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 97fd58e..f478d88 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c

@@ -1278,7 +1278,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
 			return -EINVAL;
 		}
 		tmp = (reg - CB_COLOR0_BASE) / 4;
-		track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8;
+		track->cb_color_bo_offset[tmp] = (u64)radeon_get_ib_value(p, idx) << 8;
 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
 		track->cb_color_base_last[tmp] = ib[idx];
 		track->cb_color_bo[tmp] = reloc->robj;
@@ -1305,7 +1305,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
 					"0x%04X\n", reg);
 			return -EINVAL;
 		}
-		track->htile_offset = radeon_get_ib_value(p, idx) << 8;
+		track->htile_offset = (u64)radeon_get_ib_value(p, idx) << 8;
 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
 		track->htile_bo = reloc->robj;
 		track->db_dirty = true;

diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 173439a..620f301 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c

@@ -678,11 +678,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
 	if (radeon_crtc == NULL)
 		return;
 
+	radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
+	if (!radeon_crtc->flip_queue) {
+		kfree(radeon_crtc);
+		return;
+	}
+
 	drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs);
 
 	drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256);
 	radeon_crtc->crtc_id = index;
-	radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
 	rdev->mode_info.crtcs[index] = radeon_crtc;
 
 	if (rdev->family >= CHIP_BONAIRE) {

diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index e5c0e63..6f2133f 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c

@@ -1205,13 +1205,17 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
 	r = radeon_bo_create(rdev, pd_size, align, true,
 			     RADEON_GEM_DOMAIN_VRAM, 0, NULL,
 			     NULL, &vm->page_directory);
-	if (r)
+	if (r) {
+		kfree(vm->page_tables);
+		vm->page_tables = NULL;
 		return r;
-
+	}
 	r = radeon_vm_clear_bo(rdev, vm->page_directory);
 	if (r) {
 		radeon_bo_unref(&vm->page_directory);
 		vm->page_directory = NULL;
+		kfree(vm->page_tables);
+		vm->page_tables = NULL;
 		return r;
 	}
 

diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 1144caf..6dc20e7 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c

@@ -3612,6 +3612,10 @@ static int si_cp_start(struct radeon_device *rdev)
 	for (i = RADEON_RING_TYPE_GFX_INDEX; i <= CAYMAN_RING_TYPE_CP2_INDEX; ++i) {
 		ring = &rdev->ring[i];
 		r = radeon_ring_lock(rdev, ring, 2);
+		if (r) {
+			DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r);
+			return r;
+		}
 
 		/* clear the compute context state */
 		radeon_ring_write(ring, PACKET3_COMPUTE(PACKET3_CLEAR_STATE, 0));

diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
index fd48048..258cca4 100644
--- a/drivers/gpu/drm/radeon/sumo_dpm.c
+++ b/drivers/gpu/drm/radeon/sumo_dpm.c

@@ -1493,8 +1493,10 @@ static int sumo_parse_power_table(struct radeon_device *rdev)
 		non_clock_array_index = power_state->v2.nonClockInfoIndex;
 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
-		if (!rdev->pm.power_state[i].clock_info)
+		if (!rdev->pm.power_state[i].clock_info) {
+			kfree(rdev->pm.dpm.ps);
 			return -EINVAL;
+		}
 		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
 		if (ps == NULL) {
 			kfree(rdev->pm.dpm.ps);

diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 2ef7c4e..8fcb746 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c

@@ -1768,8 +1768,10 @@ static int trinity_parse_power_table(struct radeon_device *rdev)
 		non_clock_array_index = power_state->v2.nonClockInfoIndex;
 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
-		if (!rdev->pm.power_state[i].clock_info)
+		if (!rdev->pm.power_state[i].clock_info) {
+			kfree(rdev->pm.dpm.ps);
 			return -EINVAL;
+		}
 		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
 		if (ps == NULL) {
 			kfree(rdev->pm.dpm.ps);

diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 80ecbf1..8ba8f76 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c

@@ -54,6 +54,12 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")
 		"(For people who want to keep Windows PC keyboard muscle memory. "
 		"[0] = as-is, Mac layout. 1 = swapped, Windows layout.)");
 
+static unsigned int swap_fn_leftctrl;
+module_param(swap_fn_leftctrl, uint, 0644);
+MODULE_PARM_DESC(swap_fn_leftctrl, "Swap the Fn and left Control keys. "
+		"(For people who want to keep PC keyboard muscle memory. "
+		"[0] = as-is, Mac layout, 1 = swapped, PC layout)");
+
 struct apple_sc {
 	unsigned long quirks;
 	unsigned int fn_on;
@@ -67,6 +73,28 @@ struct apple_key_translation {
 	u8 flags;
 };
 
+static const struct apple_key_translation apple2021_fn_keys[] = {
+	{ KEY_BACKSPACE, KEY_DELETE },
+	{ KEY_ENTER,	KEY_INSERT },
+	{ KEY_F1,	KEY_BRIGHTNESSDOWN, APPLE_FLAG_FKEY },
+	{ KEY_F2,	KEY_BRIGHTNESSUP,   APPLE_FLAG_FKEY },
+	{ KEY_F3,	KEY_SCALE,          APPLE_FLAG_FKEY },
+	{ KEY_F4,	KEY_SEARCH,         APPLE_FLAG_FKEY },
+	{ KEY_F5,	KEY_MICMUTE,        APPLE_FLAG_FKEY },
+	{ KEY_F6,	KEY_SLEEP,          APPLE_FLAG_FKEY },
+	{ KEY_F7,	KEY_PREVIOUSSONG,   APPLE_FLAG_FKEY },
+	{ KEY_F8,	KEY_PLAYPAUSE,      APPLE_FLAG_FKEY },
+	{ KEY_F9,	KEY_NEXTSONG,       APPLE_FLAG_FKEY },
+	{ KEY_F10,	KEY_MUTE,           APPLE_FLAG_FKEY },
+	{ KEY_F11,	KEY_VOLUMEDOWN,     APPLE_FLAG_FKEY },
+	{ KEY_F12,	KEY_VOLUMEUP,       APPLE_FLAG_FKEY },
+	{ KEY_UP,	KEY_PAGEUP },
+	{ KEY_DOWN,	KEY_PAGEDOWN },
+	{ KEY_LEFT,	KEY_HOME },
+	{ KEY_RIGHT,	KEY_END },
+	{ }
+};
+
 static const struct apple_key_translation macbookair_fn_keys[] = {
 	{ KEY_BACKSPACE, KEY_DELETE },
 	{ KEY_ENTER,	KEY_INSERT },
@@ -166,6 +194,11 @@ static const struct apple_key_translation swapped_option_cmd_keys[] = {
 	{ }
 };
 
+static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
+	{ KEY_FN, KEY_LEFTCTRL },
+	{ }
+};
+
 static const struct apple_key_translation *apple_find_translation(
 		const struct apple_key_translation *table, u16 from)
 {
@@ -187,14 +220,18 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
 	bool do_translate;
 	u16 code = 0;
 
-	if (usage->code == KEY_FN) {
+	u16 fn_keycode = (swap_fn_leftctrl) ? (KEY_LEFTCTRL) : (KEY_FN);
+
+	if (usage->code == fn_keycode) {
 		asc->fn_on = !!value;
-		input_event(input, usage->type, usage->code, value);
+		input_event(input, usage->type, KEY_FN, value);
 		return 1;
 	}
 
 	if (fnmode) {
-		if (hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
+		if (hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021)
+			table = apple2021_fn_keys;
+		else if (hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
 				hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS)
 			table = macbookair_fn_keys;
 		else if (hid->product < 0x21d || hid->product >= 0x300)
@@ -274,6 +311,14 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
 		}
 	}
 
+	if (swap_fn_leftctrl) {
+		trans = apple_find_translation(swapped_fn_leftctrl_keys, usage->code);
+		if (trans) {
+			input_event(input, usage->type, trans->to, value);
+			return 1;
+		}
+	}
+
 	return 0;
 }
 
@@ -344,6 +389,14 @@ static void apple_setup_input(struct input_dev *input)
 
 	for (trans = apple_iso_keyboard; trans->from; trans++)
 		set_bit(trans->to, input->keybit);
+
+	for (trans = apple2021_fn_keys; trans->from; trans++)
+		set_bit(trans->to, input->keybit);
+
+	if (swap_fn_leftctrl) {
+		for (trans = swapped_fn_leftctrl_keys; trans->from; trans++)
+			set_bit(trans->to, input->keybit);
+	}
 }
 
 static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
@@ -599,6 +652,10 @@ static const struct hid_device_id apple_devices[] = {
 		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY),
 		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021),
+		.driver_data = APPLE_HAS_FN },
+	{ HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021),
+		.driver_data = APPLE_HAS_FN },
 
 	{ }
 };

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index e9c0653..f89d16d 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c

@@ -2063,6 +2063,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
 	{ HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021) },
 #endif
 #if IS_ENABLED(CONFIG_HID_APPLEIR)
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 85e6a48..f76167b 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h

@@ -172,6 +172,7 @@
 #define USB_DEVICE_ID_APPLE_IRCONTROL3	0x8241
 #define USB_DEVICE_ID_APPLE_IRCONTROL4	0x8242
 #define USB_DEVICE_ID_APPLE_IRCONTROL5	0x8243
+#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021   0x029c
 
 #define USB_VENDOR_ID_ASUS		0x0486
 #define USB_DEVICE_ID_ASUS_T91MT	0x0185

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 3ca5050..b4c25af 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c

@@ -1920,7 +1920,7 @@ static int wacom_allocate_inputs(struct wacom *wacom)
 	return 0;
 }
 
-static int wacom_register_inputs(struct wacom *wacom)
+static int wacom_setup_inputs(struct wacom *wacom)
 {
 	struct input_dev *pen_input_dev, *touch_input_dev, *pad_input_dev;
 	struct wacom_wac *wacom_wac = &(wacom->wacom_wac);
@@ -1939,10 +1939,6 @@ static int wacom_register_inputs(struct wacom *wacom)
 		input_free_device(pen_input_dev);
 		wacom_wac->pen_input = NULL;
 		pen_input_dev = NULL;
-	} else {
-		error = input_register_device(pen_input_dev);
-		if (error)
-			goto fail;
 	}
 
 	error = wacom_setup_touch_input_capabilities(touch_input_dev, wacom_wac);
@@ -1951,10 +1947,6 @@ static int wacom_register_inputs(struct wacom *wacom)
 		input_free_device(touch_input_dev);
 		wacom_wac->touch_input = NULL;
 		touch_input_dev = NULL;
-	} else {
-		error = input_register_device(touch_input_dev);
-		if (error)
-			goto fail;
 	}
 
 	error = wacom_setup_pad_input_capabilities(pad_input_dev, wacom_wac);
@@ -1963,7 +1955,34 @@ static int wacom_register_inputs(struct wacom *wacom)
 		input_free_device(pad_input_dev);
 		wacom_wac->pad_input = NULL;
 		pad_input_dev = NULL;
-	} else {
+	}
+
+	return 0;
+}
+
+static int wacom_register_inputs(struct wacom *wacom)
+{
+	struct input_dev *pen_input_dev, *touch_input_dev, *pad_input_dev;
+	struct wacom_wac *wacom_wac = &(wacom->wacom_wac);
+	int error = 0;
+
+	pen_input_dev = wacom_wac->pen_input;
+	touch_input_dev = wacom_wac->touch_input;
+	pad_input_dev = wacom_wac->pad_input;
+
+	if (pen_input_dev) {
+		error = input_register_device(pen_input_dev);
+		if (error)
+			goto fail;
+	}
+
+	if (touch_input_dev) {
+		error = input_register_device(touch_input_dev);
+		if (error)
+			goto fail;
+	}
+
+	if (pad_input_dev) {
 		error = input_register_device(pad_input_dev);
 		if (error)
 			goto fail;
@@ -2213,6 +2232,20 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
 			goto fail;
 	}
 
+	error = wacom_setup_inputs(wacom);
+	if (error)
+		goto fail;
+
+	if (features->type == HID_GENERIC)
+		connect_mask |= HID_CONNECT_DRIVER;
+
+	/* Regular HID work starts now */
+	error = hid_hw_start(hdev, connect_mask);
+	if (error) {
+		hid_err(hdev, "hw start failed\n");
+		goto fail;
+	}
+
 	error = wacom_register_inputs(wacom);
 	if (error)
 		goto fail;
@@ -2227,16 +2260,6 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
 			goto fail;
 	}
 
-	if (features->type == HID_GENERIC)
-		connect_mask |= HID_CONNECT_DRIVER;
-
-	/* Regular HID work starts now */
-	error = hid_hw_start(hdev, connect_mask);
-	if (error) {
-		hid_err(hdev, "hw start failed\n");
-		goto fail;
-	}
-
 	if (!wireless) {
 		/* Note that if query fails it is not a hard failure */
 		wacom_query_tablet_data(wacom);

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 19a798e..eb39c88b 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c

@@ -2317,7 +2317,14 @@ static void wacom_wac_pen_report(struct hid_device *hdev,
 				wacom_wac->hid_data.tipswitch);
 		input_report_key(input, wacom_wac->tool[0], prox);
 		if (wacom_wac->serial[0]) {
-			input_event(input, EV_MSC, MSC_SERIAL, wacom_wac->serial[0]);
+			/*
+			 * xf86-input-wacom does not accept a serial number
+			 * of '0'. Report the low 32 bits if possible, but
+			 * if they are zero, report the upper ones instead.
+			 */
+			__u32 serial_lo = wacom_wac->serial[0] & 0xFFFFFFFFu;
+			__u32 serial_hi = wacom_wac->serial[0] >> 32;
+			input_event(input, EV_MSC, MSC_SERIAL, (int)(serial_lo ? serial_lo : serial_hi));
 			input_report_abs(input, ABS_MISC, prox ? id : 0);
 		}
 
@@ -2389,8 +2396,8 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac,
 {
 	struct hid_data *hid_data = &wacom_wac->hid_data;
 	bool mt = wacom_wac->features.touch_max > 1;
-	bool prox = hid_data->tipswitch &&
-		    report_touch_events(wacom_wac);
+	bool touch_down = hid_data->tipswitch && hid_data->confidence;
+	bool prox = touch_down && report_touch_events(wacom_wac);
 
 	if (wacom_wac->shared->has_mute_touch_switch &&
 	    !wacom_wac->shared->is_touch_on) {
@@ -2429,24 +2436,6 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac,
 	}
 }
 
-static bool wacom_wac_slot_is_active(struct input_dev *dev, int key)
-{
-	struct input_mt *mt = dev->mt;
-	struct input_mt_slot *s;
-
-	if (!mt)
-		return false;
-
-	for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
-		if (s->key == key &&
-			input_mt_get_value(s, ABS_MT_TRACKING_ID) >= 0) {
-			return true;
-		}
-	}
-
-	return false;
-}
-
 static void wacom_wac_finger_event(struct hid_device *hdev,
 		struct hid_field *field, struct hid_usage *usage, __s32 value)
 {
@@ -2489,14 +2478,8 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
 
 
 	if (usage->usage_index + 1 == field->report_count) {
-		if (equivalent_usage == wacom_wac->hid_data.last_slot_field) {
-			bool touch_removed = wacom_wac_slot_is_active(wacom_wac->touch_input,
-				wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch;
-
-			if (wacom_wac->hid_data.confidence || touch_removed) {
-				wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
-			}
-		}
+		if (equivalent_usage == wacom_wac->hid_data.last_slot_field)
+			wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
 	}
 }
 

diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c
index e4337e9..922c593 100644
--- a/drivers/hwmon/aspeed-pwm-tacho.c
+++ b/drivers/hwmon/aspeed-pwm-tacho.c

@@ -195,6 +195,8 @@ struct aspeed_pwm_tacho_data {
 	u8 fan_tach_ch_source[16];
 	struct aspeed_cooling_device *cdev[8];
 	const struct attribute_group *groups[3];
+	/* protects access to shared ASPEED_PTCR_RESULT */
+	struct mutex tach_lock;
 };
 
 enum type { TYPEM, TYPEN, TYPEO };
@@ -529,6 +531,8 @@ static int aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
 	u8 fan_tach_ch_source, type, mode, both;
 	int ret;
 
+	mutex_lock(&priv->tach_lock);
+
 	regmap_write(priv->regmap, ASPEED_PTCR_TRIGGER, 0);
 	regmap_write(priv->regmap, ASPEED_PTCR_TRIGGER, 0x1 << fan_tach_ch);
 
@@ -546,6 +550,8 @@ static int aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
 		ASPEED_RPM_STATUS_SLEEP_USEC,
 		usec);
 
+	mutex_unlock(&priv->tach_lock);
+
 	/* return -ETIMEDOUT if we didn't get an answer. */
 	if (ret)
 		return ret;
@@ -929,6 +935,7 @@ static int aspeed_pwm_tacho_probe(struct platform_device *pdev)
 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
 		return -ENOMEM;
+	mutex_init(&priv->tach_lock);
 	priv->regmap = devm_regmap_init(dev, NULL, (__force void *)regs,
 			&aspeed_pwm_tacho_regmap_config);
 	if (IS_ERR(priv->regmap))

diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index 397fd40..c6888bc 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h

@@ -435,7 +435,7 @@ struct etmv4_drvdata {
 	u8				ctxid_size;
 	u8				vmid_size;
 	u8				ccsize;
-	u8				ccitmin;
+	u16				ccitmin;
 	u8				s_ex_level;
 	u8				ns_ex_level;
 	u8				q_support;

diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 911f862..299d8f3 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c

@@ -235,8 +235,17 @@ static bool is_ack(struct s3c24xx_i2c *i2c)
 	int tries;
 
 	for (tries = 50; tries; --tries) {
-		if (readl(i2c->regs + S3C2410_IICCON)
-			& S3C2410_IICCON_IRQPEND) {
+		unsigned long tmp = readl(i2c->regs + S3C2410_IICCON);
+
+		if (!(tmp & S3C2410_IICCON_ACKEN)) {
+			/*
+			 * Wait a bit for the bus to stabilize,
+			 * delay estimated experimentally.
+			 */
+			usleep_range(100, 200);
+			return true;
+		}
+		if (tmp & S3C2410_IICCON_IRQPEND) {
 			if (!(readl(i2c->regs + S3C2410_IICSTAT)
 				& S3C2410_IICSTAT_LASTBIT))
 				return true;
@@ -289,16 +298,6 @@ static void s3c24xx_i2c_message_start(struct s3c24xx_i2c *i2c,
 
 	stat |= S3C2410_IICSTAT_START;
 	writel(stat, i2c->regs + S3C2410_IICSTAT);
-
-	if (i2c->quirks & QUIRK_POLL) {
-		while ((i2c->msg_num != 0) && is_ack(i2c)) {
-			i2c_s3c_irq_nextbyte(i2c, stat);
-			stat = readl(i2c->regs + S3C2410_IICSTAT);
-
-			if (stat & S3C2410_IICSTAT_ARBITR)
-				dev_err(i2c->dev, "deal with arbitration loss\n");
-		}
-	}
 }
 
 static inline void s3c24xx_i2c_stop(struct s3c24xx_i2c *i2c, int ret)
@@ -705,7 +704,7 @@ static void s3c24xx_i2c_wait_idle(struct s3c24xx_i2c *i2c)
 static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c,
 			      struct i2c_msg *msgs, int num)
 {
-	unsigned long timeout;
+	unsigned long timeout = 0;
 	int ret;
 
 	if (i2c->suspended)
@@ -728,16 +727,19 @@ static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c,
 	s3c24xx_i2c_message_start(i2c, msgs);
 
 	if (i2c->quirks & QUIRK_POLL) {
-		ret = i2c->msg_idx;
+		while ((i2c->msg_num != 0) && is_ack(i2c)) {
+			unsigned long stat = readl(i2c->regs + S3C2410_IICSTAT);
 
-		if (ret != num)
-			dev_dbg(i2c->dev, "incomplete xfer (%d)\n", ret);
+			i2c_s3c_irq_nextbyte(i2c, stat);
 
-		goto out;
+			stat = readl(i2c->regs + S3C2410_IICSTAT);
+			if (stat & S3C2410_IICSTAT_ARBITR)
+				dev_err(i2c->dev, "deal with arbitration loss\n");
+		}
+	} else {
+		timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5);
 	}
 
-	timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5);
-
 	ret = i2c->msg_idx;
 
 	/*

diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 419a2a2..7df5155 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c

@@ -641,7 +641,7 @@ void mthca_free_mailbox(struct mthca_dev *dev, struct mthca_mailbox *mailbox)
 
 int mthca_SYS_EN(struct mthca_dev *dev)
 {
-	u64 out;
+	u64 out = 0;
 	int ret;
 
 	ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D);
@@ -1961,7 +1961,7 @@ int mthca_WRITE_MGM(struct mthca_dev *dev, int index,
 int mthca_MGID_HASH(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
 		    u16 *hash)
 {
-	u64 imm;
+	u64 imm = 0;
 	int err;
 
 	err = mthca_cmd_imm(dev, mailbox->dma, &imm, 0, 0, CMD_MGID_HASH,

diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index ccf50da..66a85f7 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c

@@ -382,7 +382,7 @@ static int mthca_init_icm(struct mthca_dev *mdev,
 			  struct mthca_init_hca_param *init_hca,
 			  u64 icm_size)
 {
-	u64 aux_pages;
+	u64 aux_pages = 0;
 	int err;
 
 	err = mthca_SET_ICM_SIZE(mdev, icm_size, &aux_pages);

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 9b3f47a..25d7d92 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c

@@ -543,21 +543,18 @@ static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
 			/* SM supports sendonly-fullmember, otherwise fallback to full-member */
 			rec.join_state = SENDONLY_FULLMEMBER_JOIN;
 	}
-	spin_unlock_irq(&priv->lock);
 
 	multicast = ib_sa_join_multicast(&ipoib_sa_client, priv->ca, priv->port,
-					 &rec, comp_mask, GFP_KERNEL,
+					 &rec, comp_mask, GFP_ATOMIC,
 					 ipoib_mcast_join_complete, mcast);
-	spin_lock_irq(&priv->lock);
 	if (IS_ERR(multicast)) {
 		ret = PTR_ERR(multicast);
 		ipoib_warn(priv, "ib_sa_join_multicast failed, status %d\n", ret);
 		/* Requeue this join task with a backoff delay */
 		__ipoib_mcast_schedule_join_thread(priv, mcast, 1);
 		clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
-		spin_unlock_irq(&priv->lock);
 		complete(&mcast->done);
-		spin_lock_irq(&priv->lock);
+		return ret;
 	}
 	return 0;
 }

diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 1dbe303..3fedc36 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c

@@ -282,6 +282,7 @@ static const struct xpad_device {
 	{ 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
 	{ 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
 	{ 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
+	{ 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE },
 	{ 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
 	{ 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
 	{ 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },

diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 7e75835..585bf73 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c

@@ -717,6 +717,44 @@ static void atkbd_deactivate(struct atkbd *atkbd)
 			ps2dev->serio->phys);
 }
 
+#ifdef CONFIG_X86
+static bool atkbd_is_portable_device(void)
+{
+	static const char * const chassis_types[] = {
+		"8",	/* Portable */
+		"9",	/* Laptop */
+		"10",	/* Notebook */
+		"14",	/* Sub-Notebook */
+		"31",	/* Convertible */
+		"32",	/* Detachable */
+	};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(chassis_types); i++)
+		if (dmi_match(DMI_CHASSIS_TYPE, chassis_types[i]))
+			return true;
+
+	return false;
+}
+
+/*
+ * On many modern laptops ATKBD_CMD_GETID may cause problems, on these laptops
+ * the controller is always in translated mode. In this mode mice/touchpads will
+ * not work. So in this case simply assume a keyboard is connected to avoid
+ * confusing some laptop keyboards.
+ *
+ * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using the standard
+ * 0xab83 id is ok in translated mode, only atkbd_select_set() checks atkbd->id
+ * and in translated mode that is a no-op.
+ */
+static bool atkbd_skip_getid(struct atkbd *atkbd)
+{
+	return atkbd->translated && atkbd_is_portable_device();
+}
+#else
+static inline bool atkbd_skip_getid(struct atkbd *atkbd) { return false; }
+#endif
+
 /*
  * atkbd_probe() probes for an AT keyboard on a serio port.
  */
@@ -738,6 +776,11 @@ static int atkbd_probe(struct atkbd *atkbd)
 				 "keyboard reset failed on %s\n",
 				 ps2dev->serio->phys);
 
+	if (atkbd_skip_getid(atkbd)) {
+		atkbd->id = 0xab83;
+		return 0;
+	}
+
 /*
  * Then we check the keyboard ID. We should get 0xab83 under normal conditions.
  * Some keyboards report different values, but the first byte is always 0xab or
@@ -749,9 +792,9 @@ static int atkbd_probe(struct atkbd *atkbd)
 	if (ps2_command(ps2dev, param, ATKBD_CMD_GETID)) {
 
 /*
- * If the get ID command failed, we check if we can at least set the LEDs on
- * the keyboard. This should work on every keyboard out there. It also turns
- * the LEDs off, which we want anyway.
+ * If the get ID command failed, we check if we can at least set
+ * the LEDs on the keyboard. This should work on every keyboard out there.
+ * It also turns the LEDs off, which we want anyway.
  */
 		param[0] = 0;
 		if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS))

diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index b009b91..da8a426 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c

@@ -76,6 +76,9 @@ static void brcmstb_l2_intc_irq_handle(struct irq_desc *desc)
 		generic_handle_irq(irq_find_mapping(b->domain, irq));
 	} while (status);
 out:
+	/* Don't ack parent before all device writes are done */
+	wmb();
+
 	chained_irq_exit(chip, desc);
 }
 

diff --git a/drivers/leds/trigger/ledtrig-panic.c b/drivers/leds/trigger/ledtrig-panic.c
index d735526..2fc0441 100644
--- a/drivers/leds/trigger/ledtrig-panic.c
+++ b/drivers/leds/trigger/ledtrig-panic.c

@@ -67,10 +67,13 @@ static long led_panic_blink(int state)
 
 static int __init ledtrig_panic_init(void)
 {
+	led_trigger_register_simple("panic", &trigger);
+	if (!trigger)
+		return -ENOMEM;
+
 	atomic_notifier_chain_register(&panic_notifier_list,
 				       &led_trigger_panic_nb);
 
-	led_trigger_register_simple("panic", &trigger);
 	panic_blink = led_panic_blink;
 	return 0;
 }

diff --git a/drivers/md/md.c b/drivers/md/md.c
index c9c0032..cca784a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c

@@ -1018,6 +1018,7 @@ struct super_type  {
 					  struct md_rdev *refdev,
 					  int minor_version);
 	int		    (*validate_super)(struct mddev *mddev,
+					      struct md_rdev *freshest,
 					      struct md_rdev *rdev);
 	void		    (*sync_super)(struct mddev *mddev,
 					  struct md_rdev *rdev);
@@ -1144,8 +1145,9 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
 
 /*
  * validate_super for 0.90.0
+ * note: we are not using "freshest" for 0.9 superblock
  */
-static int super_90_validate(struct mddev *mddev, struct md_rdev *rdev)
+static int super_90_validate(struct mddev *mddev, struct md_rdev *freshest, struct md_rdev *rdev)
 {
 	mdp_disk_t *desc;
 	mdp_super_t *sb = page_address(rdev->sb_page);
@@ -1649,7 +1651,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
 	return ret;
 }
 
-static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
+static int super_1_validate(struct mddev *mddev, struct md_rdev *freshest, struct md_rdev *rdev)
 {
 	struct mdp_superblock_1 *sb = page_address(rdev->sb_page);
 	__u64 ev1 = le64_to_cpu(sb->events);
@@ -1745,13 +1747,15 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
 		}
 	} else if (mddev->pers == NULL) {
 		/* Insist of good event counter while assembling, except for
-		 * spares (which don't need an event count) */
-		++ev1;
+		 * spares (which don't need an event count).
+		 * Similar to mdadm, we allow event counter difference of 1
+		 * from the freshest device.
+		 */
 		if (rdev->desc_nr >= 0 &&
 		    rdev->desc_nr < le32_to_cpu(sb->max_dev) &&
 		    (le16_to_cpu(sb->dev_roles[rdev->desc_nr]) < MD_DISK_ROLE_MAX ||
 		     le16_to_cpu(sb->dev_roles[rdev->desc_nr]) == MD_DISK_ROLE_JOURNAL))
-			if (ev1 < mddev->events)
+			if (ev1 + 1 < mddev->events)
 				return -EINVAL;
 	} else if (mddev->bitmap) {
 		/* If adding to array with a bitmap, then we can accept an
@@ -1772,8 +1776,38 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
 		    rdev->desc_nr >= le32_to_cpu(sb->max_dev)) {
 			role = MD_DISK_ROLE_SPARE;
 			rdev->desc_nr = -1;
-		} else
+		} else if (mddev->pers == NULL && freshest && ev1 < mddev->events) {
+			/*
+			 * If we are assembling, and our event counter is smaller than the
+			 * highest event counter, we cannot trust our superblock about the role.
+			 * It could happen that our rdev was marked as Faulty, and all other
+			 * superblocks were updated with +1 event counter.
+			 * Then, before the next superblock update, which typically happens when
+			 * remove_and_add_spares() removes the device from the array, there was
+			 * a crash or reboot.
+			 * If we allow current rdev without consulting the freshest superblock,
+			 * we could cause data corruption.
+			 * Note that in this case our event counter is smaller by 1 than the
+			 * highest, otherwise, this rdev would not be allowed into array;
+			 * both kernel and mdadm allow event counter difference of 1.
+			 */
+			struct mdp_superblock_1 *freshest_sb = page_address(freshest->sb_page);
+			u32 freshest_max_dev = le32_to_cpu(freshest_sb->max_dev);
+
+			if (rdev->desc_nr >= freshest_max_dev) {
+				/* this is unexpected, better not proceed */
+				pr_warn("md: %s: rdev[%pg]: desc_nr(%d) >= freshest(%pg)->sb->max_dev(%u)\n",
+						mdname(mddev), rdev->bdev, rdev->desc_nr,
+						freshest->bdev, freshest_max_dev);
+				return -EUCLEAN;
+			}
+
+			role = le16_to_cpu(freshest_sb->dev_roles[rdev->desc_nr]);
+			pr_debug("md: %s: rdev[%pg]: role=%d(0x%x) according to freshest %pg\n",
+				     mdname(mddev), rdev->bdev, role, role, freshest->bdev);
+		} else {
 			role = le16_to_cpu(sb->dev_roles[rdev->desc_nr]);
+		}
 		switch(role) {
 		case MD_DISK_ROLE_SPARE: /* spare */
 			break;
@@ -2667,7 +2701,7 @@ static int add_bound_rdev(struct md_rdev *rdev)
 		 * and should be added immediately.
 		 */
 		super_types[mddev->major_version].
-			validate_super(mddev, rdev);
+			validate_super(mddev, NULL/*freshest*/, rdev);
 		if (add_journal)
 			mddev_suspend(mddev);
 		err = mddev->pers->hot_add_disk(mddev, rdev);
@@ -3569,7 +3603,7 @@ static void analyze_sbs(struct mddev *mddev)
 		}
 
 	super_types[mddev->major_version].
-		validate_super(mddev, freshest);
+		validate_super(mddev, NULL/*freshest*/, freshest);
 
 	i = 0;
 	rdev_for_each_safe(rdev, tmp, mddev) {
@@ -3584,7 +3618,7 @@ static void analyze_sbs(struct mddev *mddev)
 		}
 		if (rdev != freshest) {
 			if (super_types[mddev->major_version].
-			    validate_super(mddev, rdev)) {
+			    validate_super(mddev, freshest, rdev)) {
 				pr_warn("md: kicking non-fresh %s from array!\n",
 					bdevname(rdev->bdev,b));
 				md_kick_rdev_from_array(rdev);
@@ -6424,7 +6458,7 @@ static int add_new_disk(struct mddev *mddev, mdu_disk_info_t *info)
 			rdev->saved_raid_disk = rdev->raid_disk;
 		} else
 			super_types[mddev->major_version].
-				validate_super(mddev, rdev);
+				validate_super(mddev, NULL/*freshest*/, rdev);
 		if ((info->state & (1<<MD_DISK_SYNC)) &&
 		     rdev->raid_disk != info->raid_disk) {
 			/* This was a hot-add request, but events doesn't

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index d2ac3d1..6fca2df 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c

@@ -44,7 +44,6 @@
  */
 
 #include <linux/blkdev.h>
-#include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/raid/pq.h>
 #include <linux/async_tx.h>
@@ -6309,18 +6308,7 @@ static void raid5d(struct md_thread *thread)
 			spin_unlock_irq(&conf->device_lock);
 			md_check_recovery(mddev);
 			spin_lock_irq(&conf->device_lock);
-
-			/*
-			 * Waiting on MD_SB_CHANGE_PENDING below may deadlock
-			 * seeing md_check_recovery() is needed to clear
-			 * the flag when using mdmon.
-			 */
-			continue;
 		}
-
-		wait_event_lock_irq(mddev->sb_wait,
-			!test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags),
-			conf->device_lock);
 	}
 	pr_debug("%d stripes handled\n", handled);
 

diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
index 1b3a545..0506179 100644
--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c

@@ -90,6 +90,8 @@ static int dvb_device_open(struct inode *inode, struct file *file)
 			err = file->f_op->open(inode, file);
 		up_read(&minor_rwsem);
 		mutex_unlock(&dvbdev_mutex);
+		if (err)
+			dvb_device_put(dvbdev);
 		return err;
 	}
 fail:

diff --git a/drivers/media/pci/ddbridge/ddbridge-main.c b/drivers/media/pci/ddbridge/ddbridge-main.c
index ccac7fe..13aab32 100644
--- a/drivers/media/pci/ddbridge/ddbridge-main.c
+++ b/drivers/media/pci/ddbridge/ddbridge-main.c

@@ -265,7 +265,7 @@ static int ddb_probe(struct pci_dev *pdev,
 	ddb_unmap(dev);
 	pci_set_drvdata(pdev, NULL);
 	pci_disable_device(pdev);
-	return -1;
+	return stat;
 }
 
 /****************************************************************************/

diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c
index f372ad3..61fd934 100644
--- a/drivers/media/usb/cx231xx/cx231xx-core.c
+++ b/drivers/media/usb/cx231xx/cx231xx-core.c

@@ -1038,6 +1038,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
 	if (!dev->video_mode.isoc_ctl.urb) {
 		dev_err(dev->dev,
 			"cannot alloc memory for usb buffers\n");
+		kfree(dma_q->p_left_data);
 		return -ENOMEM;
 	}
 
@@ -1047,6 +1048,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
 		dev_err(dev->dev,
 			"cannot allocate memory for usbtransfer\n");
 		kfree(dev->video_mode.isoc_ctl.urb);
+		kfree(dma_q->p_left_data);
 		return -ENOMEM;
 	}
 

diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c
index d9e8481..9236463 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-context.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c

@@ -277,7 +277,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp)
 {
 	pvr2_hdw_disconnect(mp->hdw);
 	mp->disconnect_flag = !0;
-	pvr2_context_notify(mp);
+	if (!pvr2_context_shutok())
+		pvr2_context_notify(mp);
 }
 
 

diff --git a/drivers/media/usb/stk1160/stk1160-video.c b/drivers/media/usb/stk1160/stk1160-video.c
index ce8ebbe..8a6cdbc 100644
--- a/drivers/media/usb/stk1160/stk1160-video.c
+++ b/drivers/media/usb/stk1160/stk1160-video.c

@@ -117,8 +117,7 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
 
 	/*
 	 * TODO: These stk1160_dbg are very spammy!
-	 * We should 1) check why we are getting them
-	 * and 2) add ratelimit.
+	 * We should check why we are getting them.
 	 *
 	 * UPDATE: One of the reasons (the only one?) for getting these
 	 * is incorrect standard (mismatch between expected and configured).
@@ -161,7 +160,7 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
 
 	/* Let the bug hunt begin! sanity checks! */
 	if (lencopy < 0) {
-		stk1160_dbg("copy skipped: negative lencopy\n");
+		printk_ratelimited(KERN_DEBUG "copy skipped: negative lencopy\n");
 		return;
 	}
 

diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index fc5e4fe..7e90ed8 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig

@@ -1199,6 +1199,7 @@
 
 config MFD_TI_AM335X_TSCADC
 	tristate "TI ADC / Touch Screen chip support"
+	depends on ARCH_OMAP2PLUS || ARCH_K3 || COMPILE_TEST
 	select MFD_CORE
 	select REGMAP
 	select REGMAP_MMIO

diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 9ec8f03..5a76e7c 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c

@@ -513,7 +513,7 @@ static void blktrans_notify_add(struct mtd_info *mtd)
 {
 	struct mtd_blktrans_ops *tr;
 
-	if (mtd->type == MTD_ABSENT)
+	if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME)
 		return;
 
 	list_for_each_entry(tr, &blktrans_majors, list)
@@ -556,7 +556,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
 	list_add(&tr->list, &blktrans_majors);
 
 	mtd_for_each_device(mtd)
-		if (mtd->type != MTD_ABSENT)
+		if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME)
 			tr->add_mtd(tr, mtd);
 
 	mutex_unlock(&mtd_table_mutex);

diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c
index 0d49281..be7d9eb 100644
--- a/drivers/mtd/nand/fsl_ifc_nand.c
+++ b/drivers/mtd/nand/fsl_ifc_nand.c

@@ -33,7 +33,7 @@
 
 #define ERR_BYTE		0xFF /* Value returned for read
 					bytes when read failed	*/
-#define IFC_TIMEOUT_MSECS	500  /* Maximum number of mSecs to wait
+#define IFC_TIMEOUT_MSECS	1000 /* Maximum timeout to wait
 					for IFC NAND Machine	*/
 
 struct fsl_ifc_ctrl;

diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 4926c3e..6cd4e02 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c

@@ -988,7 +988,8 @@ static int alb_upper_dev_walk(struct net_device *upper, void *_data)
 	if (netif_is_macvlan(upper) && !strict_match) {
 		tags = bond_verify_device_path(bond->dev, upper, 0);
 		if (IS_ERR_OR_NULL(tags))
-			BUG();
+			return -ENOMEM;
+
 		alb_send_lp_vid(slave, upper->dev_addr,
 				tags[0].vlan_proto, tags[0].vlan_id);
 		kfree(tags);

diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 7a900f7..396c335 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c

@@ -884,7 +884,6 @@ int aq_nic_set_link_ksettings(struct aq_nic_s *self,
 		default:
 			err = -1;
 			goto err_exit;
-		break;
 		}
 		if (!(self->aq_hw_caps.link_speed_msk & rate)) {
 			err = -1;

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index ff0b13b..df6e76e 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c

@@ -7092,6 +7092,8 @@ static void bnxt_sp_task(struct work_struct *work)
 		bnxt_cfg_ntp_filters(bp);
 	if (test_and_clear_bit(BNXT_HWRM_EXEC_FWD_REQ_SP_EVENT, &bp->sp_event))
 		bnxt_hwrm_exec_fwd_req(bp);
+	if (test_and_clear_bit(BNXT_HWRM_PF_UNLOAD_SP_EVENT, &bp->sp_event))
+		netdev_info(bp->dev, "Receive PF driver unload event!\n");
 	if (test_and_clear_bit(BNXT_VXLAN_ADD_PORT_SP_EVENT, &bp->sp_event)) {
 		bnxt_hwrm_tunnel_dst_port_alloc(
 			bp, bp->vxlan_port,
@@ -7583,8 +7585,6 @@ static void bnxt_cfg_ntp_filters(struct bnxt *bp)
 			}
 		}
 	}
-	if (test_and_clear_bit(BNXT_HWRM_PF_UNLOAD_SP_EVENT, &bp->sp_event))
-		netdev_info(bp->dev, "Receive PF driver unload event!");
 }
 
 #else

diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index dc27c81a..44556ee 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c

@@ -6434,6 +6434,14 @@ static void tg3_dump_state(struct tg3 *tp)
 	int i;
 	u32 *regs;
 
+	/* If it is a PCI error, all registers will be 0xffff,
+	 * we don't dump them out, just report the error and return
+	 */
+	if (tp->pdev->error_state != pci_channel_io_normal) {
+		netdev_err(tp->dev, "PCI channel ERROR!\n");
+		return;
+	}
+
 	regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC);
 	if (!regs)
 		return;
@@ -11168,7 +11176,8 @@ static void tg3_reset_task(struct work_struct *work)
 	rtnl_lock();
 	tg3_full_lock(tp, 0);
 
-	if (tp->pcierr_recovery || !netif_running(tp->dev)) {
+	if (tp->pcierr_recovery || !netif_running(tp->dev) ||
+	    tp->pdev->error_state != pci_channel_io_normal) {
 		tg3_flag_clear(tp, RESET_TASK_PENDING);
 		tg3_full_unlock(tp);
 		rtnl_unlock();

diff --git a/drivers/net/ethernet/cisco/enic/enic_ethtool.c b/drivers/net/ethernet/cisco/enic/enic_ethtool.c
index fd3980c..3280fba 100644
--- a/drivers/net/ethernet/cisco/enic/enic_ethtool.c
+++ b/drivers/net/ethernet/cisco/enic/enic_ethtool.c

@@ -378,7 +378,6 @@ static int enic_grxclsrule(struct enic *enic, struct ethtool_rxnfc *cmd)
 		break;
 	default:
 		return -EINVAL;
-		break;
 	}
 
 	fsp->h_u.tcp_ip4_spec.ip4src = flow_get_u32_src(&n->keys);

diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 1085f1d..4b16989 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c

@@ -1746,6 +1746,7 @@ static void fec_enet_adjust_link(struct net_device *ndev)
 
 		/* if any of the above changed restart the FEC */
 		if (status_change) {
+			netif_stop_queue(ndev);
 			napi_disable(&fep->napi);
 			netif_tx_lock_bh(ndev);
 			fec_restart(ndev);
@@ -1755,6 +1756,7 @@ static void fec_enet_adjust_link(struct net_device *ndev)
 		}
 	} else {
 		if (fep->link) {
+			netif_stop_queue(ndev);
 			napi_disable(&fep->napi);
 			netif_tx_lock_bh(ndev);
 			fec_stop(ndev);

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index e4dbbca..8a397449 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c

@@ -4708,7 +4708,7 @@ static int i40e_pf_wait_queues_disabled(struct i40e_pf *pf)
 {
 	int v, ret = 0;
 
-	for (v = 0; v < pf->hw.func_caps.num_vsis; v++) {
+	for (v = 0; v < pf->num_alloc_vsi; v++) {
 		if (pf->vsi[v]) {
 			ret = i40e_vsi_wait_queues_disabled(pf->vsi[v]);
 			if (ret)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index 6b56626..71583f8 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c

@@ -55,7 +55,7 @@ static s32 ixgbe_write_eeprom_buffer_bit_bang(struct ixgbe_hw *hw, u16 offset,
 					     u16 words, u16 *data);
 static s32 ixgbe_detect_eeprom_page_size_generic(struct ixgbe_hw *hw,
 						 u16 offset);
-static s32 ixgbe_disable_pcie_master(struct ixgbe_hw *hw);
+static s32 ixgbe_disable_pcie_primary(struct ixgbe_hw *hw);
 
 /* Base table for registers values that change by MAC */
 const u32 ixgbe_mvals_8259X[IXGBE_MVALS_IDX_LIMIT] = {
@@ -771,10 +771,10 @@ s32 ixgbe_stop_adapter_generic(struct ixgbe_hw *hw)
 	usleep_range(1000, 2000);
 
 	/*
-	 * Prevent the PCI-E bus from from hanging by disabling PCI-E master
+	 * Prevent the PCI-E bus from hanging by disabling PCI-E primary
 	 * access and verify no pending requests
 	 */
-	return ixgbe_disable_pcie_master(hw);
+	return ixgbe_disable_pcie_primary(hw);
 }
 
 /**
@@ -2530,15 +2530,15 @@ static u32 ixgbe_pcie_timeout_poll(struct ixgbe_hw *hw)
 }
 
 /**
- *  ixgbe_disable_pcie_master - Disable PCI-express master access
+ *  ixgbe_disable_pcie_primary - Disable PCI-express primary access
  *  @hw: pointer to hardware structure
  *
- *  Disables PCI-Express master access and verifies there are no pending
- *  requests. IXGBE_ERR_MASTER_REQUESTS_PENDING is returned if master disable
- *  bit hasn't caused the master requests to be disabled, else 0
- *  is returned signifying master requests disabled.
+ *  Disables PCI-Express primary access and verifies there are no pending
+ *  requests. IXGBE_ERR_PRIMARY_REQUESTS_PENDING is returned if primary disable
+ *  bit hasn't caused the primary requests to be disabled, else 0
+ *  is returned signifying primary requests disabled.
  **/
-static s32 ixgbe_disable_pcie_master(struct ixgbe_hw *hw)
+static s32 ixgbe_disable_pcie_primary(struct ixgbe_hw *hw)
 {
 	u32 i, poll;
 	u16 value;
@@ -2547,23 +2547,23 @@ static s32 ixgbe_disable_pcie_master(struct ixgbe_hw *hw)
 	IXGBE_WRITE_REG(hw, IXGBE_CTRL, IXGBE_CTRL_GIO_DIS);
 
 	/* Poll for bit to read as set */
-	for (i = 0; i < IXGBE_PCI_MASTER_DISABLE_TIMEOUT; i++) {
+	for (i = 0; i < IXGBE_PCI_PRIMARY_DISABLE_TIMEOUT; i++) {
 		if (IXGBE_READ_REG(hw, IXGBE_CTRL) & IXGBE_CTRL_GIO_DIS)
 			break;
 		usleep_range(100, 120);
 	}
-	if (i >= IXGBE_PCI_MASTER_DISABLE_TIMEOUT) {
+	if (i >= IXGBE_PCI_PRIMARY_DISABLE_TIMEOUT) {
 		hw_dbg(hw, "GIO disable did not set - requesting resets\n");
 		goto gio_disable_fail;
 	}
 
-	/* Exit if master requests are blocked */
+	/* Exit if primary requests are blocked */
 	if (!(IXGBE_READ_REG(hw, IXGBE_STATUS) & IXGBE_STATUS_GIO) ||
 	    ixgbe_removed(hw->hw_addr))
 		return 0;
 
-	/* Poll for master request bit to clear */
-	for (i = 0; i < IXGBE_PCI_MASTER_DISABLE_TIMEOUT; i++) {
+	/* Poll for primary request bit to clear */
+	for (i = 0; i < IXGBE_PCI_PRIMARY_DISABLE_TIMEOUT; i++) {
 		udelay(100);
 		if (!(IXGBE_READ_REG(hw, IXGBE_STATUS) & IXGBE_STATUS_GIO))
 			return 0;
@@ -2571,13 +2571,13 @@ static s32 ixgbe_disable_pcie_master(struct ixgbe_hw *hw)
 
 	/*
 	 * Two consecutive resets are required via CTRL.RST per datasheet
-	 * 5.2.5.3.2 Master Disable.  We set a flag to inform the reset routine
-	 * of this need.  The first reset prevents new master requests from
+	 * 5.2.5.3.2 Primary Disable.  We set a flag to inform the reset routine
+	 * of this need.  The first reset prevents new primary requests from
 	 * being issued by our device.  We then must wait 1usec or more for any
 	 * remaining completions from the PCIe bus to trickle in, and then reset
 	 * again to clear out any effects they may have had on our device.
 	 */
-	hw_dbg(hw, "GIO Master Disable bit didn't clear - requesting resets\n");
+	hw_dbg(hw, "GIO Primary Disable bit didn't clear - requesting resets\n");
 gio_disable_fail:
 	hw->mac.flags |= IXGBE_FLAGS_DOUBLE_RESET_REQUIRED;
 
@@ -2599,7 +2599,7 @@ static s32 ixgbe_disable_pcie_master(struct ixgbe_hw *hw)
 	}
 
 	hw_dbg(hw, "PCIe transaction pending bit also did not clear.\n");
-	return IXGBE_ERR_MASTER_REQUESTS_PENDING;
+	return IXGBE_ERR_PRIMARY_REQUESTS_PENDING;
 }
 
 /**

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index c8f2759..64b8cc5 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c

@@ -2660,7 +2660,6 @@ static void ixgbe_check_overtemp_subtask(struct ixgbe_adapter *adapter)
 {
 	struct ixgbe_hw *hw = &adapter->hw;
 	u32 eicr = adapter->interrupt_event;
-	s32 rc;
 
 	if (test_bit(__IXGBE_DOWN, &adapter->state))
 		return;
@@ -2694,14 +2693,13 @@ static void ixgbe_check_overtemp_subtask(struct ixgbe_adapter *adapter)
 		}
 
 		/* Check if this is not due to overtemp */
-		if (hw->phy.ops.check_overtemp(hw) != IXGBE_ERR_OVERTEMP)
+		if (!hw->phy.ops.check_overtemp(hw))
 			return;
 
 		break;
 	case IXGBE_DEV_ID_X550EM_A_1G_T:
 	case IXGBE_DEV_ID_X550EM_A_1G_T_L:
-		rc = hw->phy.ops.check_overtemp(hw);
-		if (rc != IXGBE_ERR_OVERTEMP)
+		if (!hw->phy.ops.check_overtemp(hw))
 			return;
 		break;
 	default:
@@ -5690,8 +5688,8 @@ void ixgbe_reset(struct ixgbe_adapter *adapter)
 	case IXGBE_ERR_SFP_NOT_PRESENT:
 	case IXGBE_ERR_SFP_NOT_SUPPORTED:
 		break;
-	case IXGBE_ERR_MASTER_REQUESTS_PENDING:
-		e_dev_err("master disable timed out\n");
+	case IXGBE_ERR_PRIMARY_REQUESTS_PENDING:
+		e_dev_err("primary disable timed out\n");
 		break;
 	case IXGBE_ERR_EEPROM_VERSION:
 		/* We are running on a pre-production device, log a warning */
@@ -7636,7 +7634,7 @@ static void ixgbe_service_timer(unsigned long data)
 static void ixgbe_phy_interrupt_subtask(struct ixgbe_adapter *adapter)
 {
 	struct ixgbe_hw *hw = &adapter->hw;
-	u32 status;
+	bool overtemp;
 
 	if (!(adapter->flags2 & IXGBE_FLAG2_PHY_INTERRUPT))
 		return;
@@ -7646,11 +7644,9 @@ static void ixgbe_phy_interrupt_subtask(struct ixgbe_adapter *adapter)
 	if (!hw->phy.ops.handle_lasi)
 		return;
 
-	status = hw->phy.ops.handle_lasi(&adapter->hw);
-	if (status != IXGBE_ERR_OVERTEMP)
-		return;
-
-	e_crit(drv, "%s\n", ixgbe_overheat_msg);
+	hw->phy.ops.handle_lasi(&adapter->hw, &overtemp);
+	if (overtemp)
+		e_crit(drv, "%s\n", ixgbe_overheat_msg);
 }
 
 static void ixgbe_reset_subtask(struct ixgbe_adapter *adapter)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index 654a402..09a7c0f 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c

@@ -429,8 +429,7 @@ s32 ixgbe_reset_phy_generic(struct ixgbe_hw *hw)
 		return status;
 
 	/* Don't reset PHY if it's shut down due to overtemp. */
-	if (!hw->phy.reset_if_overtemp &&
-	    (IXGBE_ERR_OVERTEMP == hw->phy.ops.check_overtemp(hw)))
+	if (!hw->phy.reset_if_overtemp && hw->phy.ops.check_overtemp(hw))
 		return 0;
 
 	/* Blocked by MNG FW so bail */
@@ -2329,22 +2328,24 @@ static void ixgbe_i2c_bus_clear(struct ixgbe_hw *hw)
  *  @hw: pointer to hardware structure
  *
  *  Checks if the LASI temp alarm status was triggered due to overtemp
+ *
+ *  Return true when an overtemp event detected, otherwise false.
  **/
-s32 ixgbe_tn_check_overtemp(struct ixgbe_hw *hw)
+bool ixgbe_tn_check_overtemp(struct ixgbe_hw *hw)
 {
 	u16 phy_data = 0;
+	u32 status;
 
 	if (hw->device_id != IXGBE_DEV_ID_82599_T3_LOM)
-		return 0;
+		return false;
 
 	/* Check that the LASI temp alarm status was triggered */
-	hw->phy.ops.read_reg(hw, IXGBE_TN_LASI_STATUS_REG,
-			     MDIO_MMD_PMAPMD, &phy_data);
+	status = hw->phy.ops.read_reg(hw, IXGBE_TN_LASI_STATUS_REG,
+				      MDIO_MMD_PMAPMD, &phy_data);
+	if (status)
+		return false;
 
-	if (!(phy_data & IXGBE_TN_LASI_STATUS_TEMP_ALARM))
-		return 0;
-
-	return IXGBE_ERR_OVERTEMP;
+	return !!(phy_data & IXGBE_TN_LASI_STATUS_TEMP_ALARM);
 }
 
 /** ixgbe_set_copper_phy_power - Control power for copper phy

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
index 94df1d9..7002f0a 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h

@@ -178,7 +178,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw);
 s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw,
 					u16 *list_offset,
 					u16 *data_offset);
-s32 ixgbe_tn_check_overtemp(struct ixgbe_hw *hw);
+bool ixgbe_tn_check_overtemp(struct ixgbe_hw *hw);
 s32 ixgbe_read_i2c_byte_generic(struct ixgbe_hw *hw, u8 byte_offset,
 				u8 dev_addr, u8 *data);
 s32 ixgbe_read_i2c_byte_generic_unlocked(struct ixgbe_hw *hw, u8 byte_offset,

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
index ffa0ee5..93d1805 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h

@@ -1227,7 +1227,7 @@ struct ixgbe_thermal_sensor_data {
 #define IXGBE_PSRTYPE_RQPL_SHIFT    29
 
 /* CTRL Bit Masks */
-#define IXGBE_CTRL_GIO_DIS      0x00000004 /* Global IO Master Disable bit */
+#define IXGBE_CTRL_GIO_DIS      0x00000004 /* Global IO Primary Disable bit */
 #define IXGBE_CTRL_LNK_RST      0x00000008 /* Link Reset. Resets everything. */
 #define IXGBE_CTRL_RST          0x04000000 /* Reset (SW) */
 #define IXGBE_CTRL_RST_MASK     (IXGBE_CTRL_LNK_RST | IXGBE_CTRL_RST)
@@ -1790,7 +1790,7 @@ enum {
 /* STATUS Bit Masks */
 #define IXGBE_STATUS_LAN_ID         0x0000000C /* LAN ID */
 #define IXGBE_STATUS_LAN_ID_SHIFT   2          /* LAN ID Shift*/
-#define IXGBE_STATUS_GIO            0x00080000 /* GIO Master Enable Status */
+#define IXGBE_STATUS_GIO            0x00080000 /* GIO Primary Enable Status */
 
 #define IXGBE_STATUS_LAN_ID_0   0x00000000 /* LAN ID 0 */
 #define IXGBE_STATUS_LAN_ID_1   0x00000004 /* LAN ID 1 */
@@ -2172,8 +2172,8 @@ enum {
 #define IXGBE_PCIDEVCTRL2_4_8s		0xd
 #define IXGBE_PCIDEVCTRL2_17_34s	0xe
 
-/* Number of 100 microseconds we wait for PCI Express master disable */
-#define IXGBE_PCI_MASTER_DISABLE_TIMEOUT	800
+/* Number of 100 microseconds we wait for PCI Express primary disable */
+#define IXGBE_PCI_PRIMARY_DISABLE_TIMEOUT	800
 
 /* RAH */
 #define IXGBE_RAH_VIND_MASK     0x003C0000
@@ -3482,10 +3482,10 @@ struct ixgbe_phy_operations {
 	s32 (*read_i2c_sff8472)(struct ixgbe_hw *, u8 , u8 *);
 	s32 (*read_i2c_eeprom)(struct ixgbe_hw *, u8 , u8 *);
 	s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
-	s32 (*check_overtemp)(struct ixgbe_hw *);
+	bool (*check_overtemp)(struct ixgbe_hw *);
 	s32 (*set_phy_power)(struct ixgbe_hw *, bool on);
 	s32 (*enter_lplu)(struct ixgbe_hw *);
-	s32 (*handle_lasi)(struct ixgbe_hw *hw);
+	s32 (*handle_lasi)(struct ixgbe_hw *hw, bool *);
 	s32 (*read_i2c_byte_unlocked)(struct ixgbe_hw *, u8 offset, u8 addr,
 				      u8 *value);
 	s32 (*write_i2c_byte_unlocked)(struct ixgbe_hw *, u8 offset, u8 addr,
@@ -3651,7 +3651,7 @@ struct ixgbe_info {
 #define IXGBE_ERR_ADAPTER_STOPPED               -9
 #define IXGBE_ERR_INVALID_MAC_ADDR              -10
 #define IXGBE_ERR_DEVICE_NOT_SUPPORTED          -11
-#define IXGBE_ERR_MASTER_REQUESTS_PENDING       -12
+#define IXGBE_ERR_PRIMARY_REQUESTS_PENDING      -12
 #define IXGBE_ERR_INVALID_LINK_SETTINGS         -13
 #define IXGBE_ERR_AUTONEG_NOT_COMPLETE          -14
 #define IXGBE_ERR_RESET_FAILED                  -15

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
index 6ea0d6a..b5e4e78 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c

@@ -375,7 +375,6 @@ static s32 ixgbe_calc_eeprom_checksum_X540(struct ixgbe_hw *hw)
 		if (ixgbe_read_eerd_generic(hw, pointer, &length)) {
 			hw_dbg(hw, "EEPROM read failed\n");
 			return IXGBE_ERR_EEPROM;
-			break;
 		}
 
 		/* Skip pointer section if length is invalid. */

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
index 10fa0e0..f99596c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c

@@ -620,8 +620,10 @@ static s32 ixgbe_setup_fw_link(struct ixgbe_hw *hw)
 	rc = ixgbe_fw_phy_activity(hw, FW_PHY_ACT_SETUP_LINK, &setup);
 	if (rc)
 		return rc;
+
 	if (setup[0] == FW_PHY_ACT_SETUP_LINK_RSP_DOWN)
-		return IXGBE_ERR_OVERTEMP;
+		return -EIO;
+
 	return 0;
 }
 
@@ -735,7 +737,8 @@ static s32 ixgbe_read_iosf_sb_reg_x550(struct ixgbe_hw *hw, u32 reg_addr,
 		error = (command & IXGBE_SB_IOSF_CTRL_CMPL_ERR_MASK) >>
 			 IXGBE_SB_IOSF_CTRL_CMPL_ERR_SHIFT;
 		hw_dbg(hw, "Failed to read, error %x\n", error);
-		return IXGBE_ERR_PHY;
+		ret = IXGBE_ERR_PHY;
+		goto out;
 	}
 
 	if (!ret)
@@ -2314,18 +2317,18 @@ static s32 ixgbe_get_link_capabilities_X550em(struct ixgbe_hw *hw,
  * @hw: pointer to hardware structure
  * @lsc: pointer to boolean flag which indicates whether external Base T
  *	 PHY interrupt is lsc
+ * @is_overtemp: indicate whether an overtemp event encountered
  *
  * Determime if external Base T PHY interrupt cause is high temperature
  * failure alarm or link status change.
- *
- * Return IXGBE_ERR_OVERTEMP if interrupt is high temperature
- * failure alarm, else return PHY access status.
  **/
-static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc)
+static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc,
+				       bool *is_overtemp)
 {
 	u32 status;
 	u16 reg;
 
+	*is_overtemp = false;
 	*lsc = false;
 
 	/* Vendor alarm triggered */
@@ -2357,7 +2360,8 @@ static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc)
 	if (reg & IXGBE_MDIO_GLOBAL_ALM_1_HI_TMP_FAIL) {
 		/* power down the PHY in case the PHY FW didn't already */
 		ixgbe_set_copper_phy_power(hw, false);
-		return IXGBE_ERR_OVERTEMP;
+		*is_overtemp = true;
+		return -EIO;
 	}
 	if (reg & IXGBE_MDIO_GLOBAL_ALM_1_DEV_FAULT) {
 		/*  device fault alarm triggered */
@@ -2371,7 +2375,8 @@ static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc)
 		if (reg == IXGBE_MDIO_GLOBAL_FAULT_MSG_HI_TMP) {
 			/* power down the PHY in case the PHY FW didn't */
 			ixgbe_set_copper_phy_power(hw, false);
-			return IXGBE_ERR_OVERTEMP;
+			*is_overtemp = true;
+			return -EIO;
 		}
 	}
 
@@ -2407,12 +2412,12 @@ static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc)
  **/
 static s32 ixgbe_enable_lasi_ext_t_x550em(struct ixgbe_hw *hw)
 {
+	bool lsc, overtemp;
 	u32 status;
 	u16 reg;
-	bool lsc;
 
 	/* Clear interrupt flags */
-	status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc);
+	status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc, &overtemp);
 
 	/* Enable link status change alarm */
 
@@ -2491,21 +2496,20 @@ static s32 ixgbe_enable_lasi_ext_t_x550em(struct ixgbe_hw *hw)
 /**
  * ixgbe_handle_lasi_ext_t_x550em - Handle external Base T PHY interrupt
  * @hw: pointer to hardware structure
+ * @is_overtemp: indicate whether an overtemp event encountered
  *
  * Handle external Base T PHY interrupt. If high temperature
  * failure alarm then return error, else if link status change
  * then setup internal/external PHY link
- *
- * Return IXGBE_ERR_OVERTEMP if interrupt is high temperature
- * failure alarm, else return PHY access status.
  **/
-static s32 ixgbe_handle_lasi_ext_t_x550em(struct ixgbe_hw *hw)
+static s32 ixgbe_handle_lasi_ext_t_x550em(struct ixgbe_hw *hw,
+					  bool *is_overtemp)
 {
 	struct ixgbe_phy_info *phy = &hw->phy;
 	bool lsc;
 	u32 status;
 
-	status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc);
+	status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc, is_overtemp);
 	if (status)
 		return status;
 
@@ -3132,21 +3136,23 @@ static s32 ixgbe_reset_phy_fw(struct ixgbe_hw *hw)
 /**
  * ixgbe_check_overtemp_fw - Check firmware-controlled PHYs for overtemp
  * @hw: pointer to hardware structure
+ *
+ * Return true when an overtemp event detected, otherwise false.
  */
-static s32 ixgbe_check_overtemp_fw(struct ixgbe_hw *hw)
+static bool ixgbe_check_overtemp_fw(struct ixgbe_hw *hw)
 {
 	u32 store[FW_PHY_ACT_DATA_COUNT] = { 0 };
 	s32 rc;
 
 	rc = ixgbe_fw_phy_activity(hw, FW_PHY_ACT_GET_LINK_INFO, &store);
 	if (rc)
-		return rc;
+		return false;
 
 	if (store[0] & FW_PHY_ACT_GET_LINK_INFO_TEMP) {
 		ixgbe_shutdown_fw_phy(hw);
-		return IXGBE_ERR_OVERTEMP;
+		return true;
 	}
-	return 0;
+	return false;
 }
 
 /**

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
index c567cff..b8c7997 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c

@@ -229,11 +229,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
 
 	ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS,
 			sizeof(*ft->g), GFP_KERNEL);
-	in = kvzalloc(inlen, GFP_KERNEL);
-	if  (!in || !ft->g) {
-		kvfree(ft->g);
-		kvfree(in);
+	if (!ft->g)
 		return -ENOMEM;
+
+	in = kvzalloc(inlen, GFP_KERNEL);
+	if (!in) {
+		err = -ENOMEM;
+		goto err_free_g;
 	}
 
 	mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);
@@ -253,7 +255,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
 		break;
 	default:
 		err = -EINVAL;
-		goto out;
+		goto err_free_in;
 	}
 
 	switch (type) {
@@ -275,7 +277,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
 		break;
 	default:
 		err = -EINVAL;
-		goto out;
+		goto err_free_in;
 	}
 
 	MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
@@ -284,7 +286,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
 	MLX5_SET_CFG(in, end_flow_index, ix - 1);
 	ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in);
 	if (IS_ERR(ft->g[ft->num_groups]))
-		goto err;
+		goto err_clean_group;
 	ft->num_groups++;
 
 	memset(in, 0, inlen);
@@ -293,18 +295,20 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
 	MLX5_SET_CFG(in, end_flow_index, ix - 1);
 	ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in);
 	if (IS_ERR(ft->g[ft->num_groups]))
-		goto err;
+		goto err_clean_group;
 	ft->num_groups++;
 
 	kvfree(in);
 	return 0;
 
-err:
+err_clean_group:
 	err = PTR_ERR(ft->g[ft->num_groups]);
 	ft->g[ft->num_groups] = NULL;
-out:
+err_free_in:
 	kvfree(in);
-
+err_free_g:
+	kfree(ft->g);
+	ft->g = NULL;
 	return err;
 }
 

diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
index cd67832..375c1c4 100644
--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
+++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c

@@ -571,11 +571,13 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
 	const u32 barcfg_msix_general =
 		NFP_PCIE_BAR_PCIE2CPP_MapType(
 			NFP_PCIE_BAR_PCIE2CPP_MapType_GENERAL) |
-		NFP_PCIE_BAR_PCIE2CPP_LengthSelect_32BIT;
+		NFP_PCIE_BAR_PCIE2CPP_LengthSelect(
+			NFP_PCIE_BAR_PCIE2CPP_LengthSelect_32BIT);
 	const u32 barcfg_msix_xpb =
 		NFP_PCIE_BAR_PCIE2CPP_MapType(
 			NFP_PCIE_BAR_PCIE2CPP_MapType_BULK) |
-		NFP_PCIE_BAR_PCIE2CPP_LengthSelect_32BIT |
+		NFP_PCIE_BAR_PCIE2CPP_LengthSelect(
+			NFP_PCIE_BAR_PCIE2CPP_LengthSelect_32BIT) |
 		NFP_PCIE_BAR_PCIE2CPP_Target_BaseAddress(
 			NFP_CPP_TARGET_ISLAND_XPB);
 	const u32 barcfg_explicit[4] = {

diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index 6c8a591..bc3d268 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c

@@ -316,12 +316,11 @@ static void ql_release_to_lrg_buf_free_list(struct ql3_adapter *qdev,
 			 * buffer
 			 */
 			skb_reserve(lrg_buf_cb->skb, QL_HEADER_SPACE);
-			map = pci_map_single(qdev->pdev,
+			map = dma_map_single(&qdev->pdev->dev,
 					     lrg_buf_cb->skb->data,
-					     qdev->lrg_buffer_len -
-					     QL_HEADER_SPACE,
-					     PCI_DMA_FROMDEVICE);
-			err = pci_dma_mapping_error(qdev->pdev, map);
+					     qdev->lrg_buffer_len - QL_HEADER_SPACE,
+					     DMA_FROM_DEVICE);
+			err = dma_mapping_error(&qdev->pdev->dev, map);
 			if (err) {
 				netdev_err(qdev->ndev,
 					   "PCI mapping failed with error: %d\n",
@@ -1803,13 +1802,12 @@ static int ql_populate_free_queue(struct ql3_adapter *qdev)
 				 * first buffer
 				 */
 				skb_reserve(lrg_buf_cb->skb, QL_HEADER_SPACE);
-				map = pci_map_single(qdev->pdev,
+				map = dma_map_single(&qdev->pdev->dev,
 						     lrg_buf_cb->skb->data,
-						     qdev->lrg_buffer_len -
-						     QL_HEADER_SPACE,
-						     PCI_DMA_FROMDEVICE);
+						     qdev->lrg_buffer_len - QL_HEADER_SPACE,
+						     DMA_FROM_DEVICE);
 
-				err = pci_dma_mapping_error(qdev->pdev, map);
+				err = dma_mapping_error(&qdev->pdev->dev, map);
 				if (err) {
 					netdev_err(qdev->ndev,
 						   "PCI mapping failed with error: %d\n",
@@ -1944,18 +1942,16 @@ static void ql_process_mac_tx_intr(struct ql3_adapter *qdev,
 		goto invalid_seg_count;
 	}
 
-	pci_unmap_single(qdev->pdev,
+	dma_unmap_single(&qdev->pdev->dev,
 			 dma_unmap_addr(&tx_cb->map[0], mapaddr),
-			 dma_unmap_len(&tx_cb->map[0], maplen),
-			 PCI_DMA_TODEVICE);
+			 dma_unmap_len(&tx_cb->map[0], maplen), DMA_TO_DEVICE);
 	tx_cb->seg_count--;
 	if (tx_cb->seg_count) {
 		for (i = 1; i < tx_cb->seg_count; i++) {
-			pci_unmap_page(qdev->pdev,
-				       dma_unmap_addr(&tx_cb->map[i],
-						      mapaddr),
+			dma_unmap_page(&qdev->pdev->dev,
+				       dma_unmap_addr(&tx_cb->map[i], mapaddr),
 				       dma_unmap_len(&tx_cb->map[i], maplen),
-				       PCI_DMA_TODEVICE);
+				       DMA_TO_DEVICE);
 		}
 	}
 	qdev->ndev->stats.tx_packets++;
@@ -2022,10 +2018,9 @@ static void ql_process_mac_rx_intr(struct ql3_adapter *qdev,
 	qdev->ndev->stats.rx_bytes += length;
 
 	skb_put(skb, length);
-	pci_unmap_single(qdev->pdev,
+	dma_unmap_single(&qdev->pdev->dev,
 			 dma_unmap_addr(lrg_buf_cb2, mapaddr),
-			 dma_unmap_len(lrg_buf_cb2, maplen),
-			 PCI_DMA_FROMDEVICE);
+			 dma_unmap_len(lrg_buf_cb2, maplen), DMA_FROM_DEVICE);
 	prefetch(skb->data);
 	skb_checksum_none_assert(skb);
 	skb->protocol = eth_type_trans(skb, qdev->ndev);
@@ -2068,10 +2063,9 @@ static void ql_process_macip_rx_intr(struct ql3_adapter *qdev,
 	skb2 = lrg_buf_cb2->skb;
 
 	skb_put(skb2, length);	/* Just the second buffer length here. */
-	pci_unmap_single(qdev->pdev,
+	dma_unmap_single(&qdev->pdev->dev,
 			 dma_unmap_addr(lrg_buf_cb2, mapaddr),
-			 dma_unmap_len(lrg_buf_cb2, maplen),
-			 PCI_DMA_FROMDEVICE);
+			 dma_unmap_len(lrg_buf_cb2, maplen), DMA_FROM_DEVICE);
 	prefetch(skb2->data);
 
 	skb_checksum_none_assert(skb2);
@@ -2320,9 +2314,9 @@ static int ql_send_map(struct ql3_adapter *qdev,
 	/*
 	 * Map the skb buffer first.
 	 */
-	map = pci_map_single(qdev->pdev, skb->data, len, PCI_DMA_TODEVICE);
+	map = dma_map_single(&qdev->pdev->dev, skb->data, len, DMA_TO_DEVICE);
 
-	err = pci_dma_mapping_error(qdev->pdev, map);
+	err = dma_mapping_error(&qdev->pdev->dev, map);
 	if (err) {
 		netdev_err(qdev->ndev, "PCI mapping failed with error: %d\n",
 			   err);
@@ -2358,11 +2352,11 @@ static int ql_send_map(struct ql3_adapter *qdev,
 		    (seg == 7 && seg_cnt > 8) ||
 		    (seg == 12 && seg_cnt > 13) ||
 		    (seg == 17 && seg_cnt > 18)) {
-			map = pci_map_single(qdev->pdev, oal,
+			map = dma_map_single(&qdev->pdev->dev, oal,
 					     sizeof(struct oal),
-					     PCI_DMA_TODEVICE);
+					     DMA_TO_DEVICE);
 
-			err = pci_dma_mapping_error(qdev->pdev, map);
+			err = dma_mapping_error(&qdev->pdev->dev, map);
 			if (err) {
 				netdev_err(qdev->ndev,
 					   "PCI mapping outbound address list with error: %d\n",
@@ -2424,24 +2418,24 @@ static int ql_send_map(struct ql3_adapter *qdev,
 		    (seg == 7 && seg_cnt > 8) ||
 		    (seg == 12 && seg_cnt > 13) ||
 		    (seg == 17 && seg_cnt > 18)) {
-			pci_unmap_single(qdev->pdev,
-				dma_unmap_addr(&tx_cb->map[seg], mapaddr),
-				dma_unmap_len(&tx_cb->map[seg], maplen),
-				 PCI_DMA_TODEVICE);
+			dma_unmap_single(&qdev->pdev->dev,
+					 dma_unmap_addr(&tx_cb->map[seg], mapaddr),
+					 dma_unmap_len(&tx_cb->map[seg], maplen),
+					 DMA_TO_DEVICE);
 			oal++;
 			seg++;
 		}
 
-		pci_unmap_page(qdev->pdev,
+		dma_unmap_page(&qdev->pdev->dev,
 			       dma_unmap_addr(&tx_cb->map[seg], mapaddr),
 			       dma_unmap_len(&tx_cb->map[seg], maplen),
-			       PCI_DMA_TODEVICE);
+			       DMA_TO_DEVICE);
 	}
 
-	pci_unmap_single(qdev->pdev,
+	dma_unmap_single(&qdev->pdev->dev,
 			 dma_unmap_addr(&tx_cb->map[0], mapaddr),
 			 dma_unmap_addr(&tx_cb->map[0], maplen),
-			 PCI_DMA_TODEVICE);
+			 DMA_TO_DEVICE);
 
 	return NETDEV_TX_BUSY;
 
@@ -2527,9 +2521,8 @@ static int ql_alloc_net_req_rsp_queues(struct ql3_adapter *qdev)
 	wmb();
 
 	qdev->req_q_virt_addr =
-	    pci_alloc_consistent(qdev->pdev,
-				 (size_t) qdev->req_q_size,
-				 &qdev->req_q_phy_addr);
+	    dma_alloc_coherent(&qdev->pdev->dev, (size_t)qdev->req_q_size,
+			       &qdev->req_q_phy_addr, GFP_KERNEL);
 
 	if ((qdev->req_q_virt_addr == NULL) ||
 	    LS_64BITS(qdev->req_q_phy_addr) & (qdev->req_q_size - 1)) {
@@ -2538,16 +2531,14 @@ static int ql_alloc_net_req_rsp_queues(struct ql3_adapter *qdev)
 	}
 
 	qdev->rsp_q_virt_addr =
-	    pci_alloc_consistent(qdev->pdev,
-				 (size_t) qdev->rsp_q_size,
-				 &qdev->rsp_q_phy_addr);
+	    dma_alloc_coherent(&qdev->pdev->dev, (size_t)qdev->rsp_q_size,
+			       &qdev->rsp_q_phy_addr, GFP_KERNEL);
 
 	if ((qdev->rsp_q_virt_addr == NULL) ||
 	    LS_64BITS(qdev->rsp_q_phy_addr) & (qdev->rsp_q_size - 1)) {
 		netdev_err(qdev->ndev, "rspQ allocation failed\n");
-		pci_free_consistent(qdev->pdev, (size_t) qdev->req_q_size,
-				    qdev->req_q_virt_addr,
-				    qdev->req_q_phy_addr);
+		dma_free_coherent(&qdev->pdev->dev, (size_t)qdev->req_q_size,
+				  qdev->req_q_virt_addr, qdev->req_q_phy_addr);
 		return -ENOMEM;
 	}
 
@@ -2563,15 +2554,13 @@ static void ql_free_net_req_rsp_queues(struct ql3_adapter *qdev)
 		return;
 	}
 
-	pci_free_consistent(qdev->pdev,
-			    qdev->req_q_size,
-			    qdev->req_q_virt_addr, qdev->req_q_phy_addr);
+	dma_free_coherent(&qdev->pdev->dev, qdev->req_q_size,
+			  qdev->req_q_virt_addr, qdev->req_q_phy_addr);
 
 	qdev->req_q_virt_addr = NULL;
 
-	pci_free_consistent(qdev->pdev,
-			    qdev->rsp_q_size,
-			    qdev->rsp_q_virt_addr, qdev->rsp_q_phy_addr);
+	dma_free_coherent(&qdev->pdev->dev, qdev->rsp_q_size,
+			  qdev->rsp_q_virt_addr, qdev->rsp_q_phy_addr);
 
 	qdev->rsp_q_virt_addr = NULL;
 
@@ -2595,12 +2584,13 @@ static int ql_alloc_buffer_queues(struct ql3_adapter *qdev)
 		return -ENOMEM;
 
 	qdev->lrg_buf_q_alloc_virt_addr =
-		pci_alloc_consistent(qdev->pdev,
-				     qdev->lrg_buf_q_alloc_size,
-				     &qdev->lrg_buf_q_alloc_phy_addr);
+		dma_alloc_coherent(&qdev->pdev->dev,
+				   qdev->lrg_buf_q_alloc_size,
+				   &qdev->lrg_buf_q_alloc_phy_addr, GFP_KERNEL);
 
 	if (qdev->lrg_buf_q_alloc_virt_addr == NULL) {
 		netdev_err(qdev->ndev, "lBufQ failed\n");
+		kfree(qdev->lrg_buf);
 		return -ENOMEM;
 	}
 	qdev->lrg_buf_q_virt_addr = qdev->lrg_buf_q_alloc_virt_addr;
@@ -2615,15 +2605,17 @@ static int ql_alloc_buffer_queues(struct ql3_adapter *qdev)
 		qdev->small_buf_q_alloc_size = qdev->small_buf_q_size * 2;
 
 	qdev->small_buf_q_alloc_virt_addr =
-		pci_alloc_consistent(qdev->pdev,
-				     qdev->small_buf_q_alloc_size,
-				     &qdev->small_buf_q_alloc_phy_addr);
+		dma_alloc_coherent(&qdev->pdev->dev,
+				   qdev->small_buf_q_alloc_size,
+				   &qdev->small_buf_q_alloc_phy_addr, GFP_KERNEL);
 
 	if (qdev->small_buf_q_alloc_virt_addr == NULL) {
 		netdev_err(qdev->ndev, "Small Buffer Queue allocation failed\n");
-		pci_free_consistent(qdev->pdev, qdev->lrg_buf_q_alloc_size,
-				    qdev->lrg_buf_q_alloc_virt_addr,
-				    qdev->lrg_buf_q_alloc_phy_addr);
+		dma_free_coherent(&qdev->pdev->dev,
+				  qdev->lrg_buf_q_alloc_size,
+				  qdev->lrg_buf_q_alloc_virt_addr,
+				  qdev->lrg_buf_q_alloc_phy_addr);
+		kfree(qdev->lrg_buf);
 		return -ENOMEM;
 	}
 
@@ -2640,17 +2632,15 @@ static void ql_free_buffer_queues(struct ql3_adapter *qdev)
 		return;
 	}
 	kfree(qdev->lrg_buf);
-	pci_free_consistent(qdev->pdev,
-			    qdev->lrg_buf_q_alloc_size,
-			    qdev->lrg_buf_q_alloc_virt_addr,
-			    qdev->lrg_buf_q_alloc_phy_addr);
+	dma_free_coherent(&qdev->pdev->dev, qdev->lrg_buf_q_alloc_size,
+			  qdev->lrg_buf_q_alloc_virt_addr,
+			  qdev->lrg_buf_q_alloc_phy_addr);
 
 	qdev->lrg_buf_q_virt_addr = NULL;
 
-	pci_free_consistent(qdev->pdev,
-			    qdev->small_buf_q_alloc_size,
-			    qdev->small_buf_q_alloc_virt_addr,
-			    qdev->small_buf_q_alloc_phy_addr);
+	dma_free_coherent(&qdev->pdev->dev, qdev->small_buf_q_alloc_size,
+			  qdev->small_buf_q_alloc_virt_addr,
+			  qdev->small_buf_q_alloc_phy_addr);
 
 	qdev->small_buf_q_virt_addr = NULL;
 
@@ -2668,9 +2658,9 @@ static int ql_alloc_small_buffers(struct ql3_adapter *qdev)
 		 QL_SMALL_BUFFER_SIZE);
 
 	qdev->small_buf_virt_addr =
-		pci_alloc_consistent(qdev->pdev,
-				     qdev->small_buf_total_size,
-				     &qdev->small_buf_phy_addr);
+		dma_alloc_coherent(&qdev->pdev->dev,
+				   qdev->small_buf_total_size,
+				   &qdev->small_buf_phy_addr, GFP_KERNEL);
 
 	if (qdev->small_buf_virt_addr == NULL) {
 		netdev_err(qdev->ndev, "Failed to get small buffer memory\n");
@@ -2703,10 +2693,10 @@ static void ql_free_small_buffers(struct ql3_adapter *qdev)
 		return;
 	}
 	if (qdev->small_buf_virt_addr != NULL) {
-		pci_free_consistent(qdev->pdev,
-				    qdev->small_buf_total_size,
-				    qdev->small_buf_virt_addr,
-				    qdev->small_buf_phy_addr);
+		dma_free_coherent(&qdev->pdev->dev,
+				  qdev->small_buf_total_size,
+				  qdev->small_buf_virt_addr,
+				  qdev->small_buf_phy_addr);
 
 		qdev->small_buf_virt_addr = NULL;
 	}
@@ -2721,10 +2711,10 @@ static void ql_free_large_buffers(struct ql3_adapter *qdev)
 		lrg_buf_cb = &qdev->lrg_buf[i];
 		if (lrg_buf_cb->skb) {
 			dev_kfree_skb(lrg_buf_cb->skb);
-			pci_unmap_single(qdev->pdev,
+			dma_unmap_single(&qdev->pdev->dev,
 					 dma_unmap_addr(lrg_buf_cb, mapaddr),
 					 dma_unmap_len(lrg_buf_cb, maplen),
-					 PCI_DMA_FROMDEVICE);
+					 DMA_FROM_DEVICE);
 			memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb));
 		} else {
 			break;
@@ -2776,13 +2766,11 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev)
 			 * buffer
 			 */
 			skb_reserve(skb, QL_HEADER_SPACE);
-			map = pci_map_single(qdev->pdev,
-					     skb->data,
-					     qdev->lrg_buffer_len -
-					     QL_HEADER_SPACE,
-					     PCI_DMA_FROMDEVICE);
+			map = dma_map_single(&qdev->pdev->dev, skb->data,
+					     qdev->lrg_buffer_len - QL_HEADER_SPACE,
+					     DMA_FROM_DEVICE);
 
-			err = pci_dma_mapping_error(qdev->pdev, map);
+			err = dma_mapping_error(&qdev->pdev->dev, map);
 			if (err) {
 				netdev_err(qdev->ndev,
 					   "PCI mapping failed with error: %d\n",
@@ -2867,8 +2855,8 @@ static int ql_alloc_mem_resources(struct ql3_adapter *qdev)
 	 * Network Completion Queue Producer Index Register
 	 */
 	qdev->shadow_reg_virt_addr =
-		pci_alloc_consistent(qdev->pdev,
-				     PAGE_SIZE, &qdev->shadow_reg_phy_addr);
+		dma_alloc_coherent(&qdev->pdev->dev, PAGE_SIZE,
+				   &qdev->shadow_reg_phy_addr, GFP_KERNEL);
 
 	if (qdev->shadow_reg_virt_addr != NULL) {
 		qdev->preq_consumer_index = qdev->shadow_reg_virt_addr;
@@ -2923,10 +2911,9 @@ static int ql_alloc_mem_resources(struct ql3_adapter *qdev)
 err_buffer_queues:
 	ql_free_net_req_rsp_queues(qdev);
 err_req_rsp:
-	pci_free_consistent(qdev->pdev,
-			    PAGE_SIZE,
-			    qdev->shadow_reg_virt_addr,
-			    qdev->shadow_reg_phy_addr);
+	dma_free_coherent(&qdev->pdev->dev, PAGE_SIZE,
+			  qdev->shadow_reg_virt_addr,
+			  qdev->shadow_reg_phy_addr);
 
 	return -ENOMEM;
 }
@@ -2939,10 +2926,9 @@ static void ql_free_mem_resources(struct ql3_adapter *qdev)
 	ql_free_buffer_queues(qdev);
 	ql_free_net_req_rsp_queues(qdev);
 	if (qdev->shadow_reg_virt_addr != NULL) {
-		pci_free_consistent(qdev->pdev,
-				    PAGE_SIZE,
-				    qdev->shadow_reg_virt_addr,
-				    qdev->shadow_reg_phy_addr);
+		dma_free_coherent(&qdev->pdev->dev, PAGE_SIZE,
+				  qdev->shadow_reg_virt_addr,
+				  qdev->shadow_reg_phy_addr);
 		qdev->shadow_reg_virt_addr = NULL;
 	}
 }
@@ -3643,18 +3629,15 @@ static void ql_reset_work(struct work_struct *work)
 			if (tx_cb->skb) {
 				netdev_printk(KERN_DEBUG, ndev,
 					      "Freeing lost SKB\n");
-				pci_unmap_single(qdev->pdev,
-					 dma_unmap_addr(&tx_cb->map[0],
-							mapaddr),
-					 dma_unmap_len(&tx_cb->map[0], maplen),
-					 PCI_DMA_TODEVICE);
+				dma_unmap_single(&qdev->pdev->dev,
+						 dma_unmap_addr(&tx_cb->map[0], mapaddr),
+						 dma_unmap_len(&tx_cb->map[0], maplen),
+						 DMA_TO_DEVICE);
 				for (j = 1; j < tx_cb->seg_count; j++) {
-					pci_unmap_page(qdev->pdev,
-					       dma_unmap_addr(&tx_cb->map[j],
-							      mapaddr),
-					       dma_unmap_len(&tx_cb->map[j],
-							     maplen),
-					       PCI_DMA_TODEVICE);
+					dma_unmap_page(&qdev->pdev->dev,
+						       dma_unmap_addr(&tx_cb->map[j], mapaddr),
+						       dma_unmap_len(&tx_cb->map[j], maplen),
+						       DMA_TO_DEVICE);
 				}
 				dev_kfree_skb(tx_cb->skb);
 				tx_cb->skb = NULL;
@@ -3786,13 +3769,10 @@ static int ql3xxx_probe(struct pci_dev *pdev,
 
 	pci_set_master(pdev);
 
-	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+	if (!dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)))
 		pci_using_dac = 1;
-		err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
-	} else if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) {
+	else if (!(err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32))))
 		pci_using_dac = 0;
-		err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
-	}
 
 	if (err) {
 		pr_err("%s no usable DMA configuration\n", pci_name(pdev));

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index b97d450..2190ed6 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c

@@ -1545,7 +1545,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 	struct ravb_tstamp_skb *ts_skb;
 	struct ravb_tx_desc *desc;
 	unsigned long flags;
-	u32 dma_addr;
+	dma_addr_t dma_addr;
 	void *buffer;
 	u32 entry;
 	u32 len;

diff --git a/drivers/net/fjes/fjes_hw.c b/drivers/net/fjes/fjes_hw.c
index 9c652c0..c3fa8db 100644
--- a/drivers/net/fjes/fjes_hw.c
+++ b/drivers/net/fjes/fjes_hw.c

@@ -235,21 +235,25 @@ static int fjes_hw_setup(struct fjes_hw *hw)
 
 	mem_size = FJES_DEV_REQ_BUF_SIZE(hw->max_epid);
 	hw->hw_info.req_buf = kzalloc(mem_size, GFP_KERNEL);
-	if (!(hw->hw_info.req_buf))
-		return -ENOMEM;
+	if (!(hw->hw_info.req_buf)) {
+		result = -ENOMEM;
+		goto free_ep_info;
+	}
 
 	hw->hw_info.req_buf_size = mem_size;
 
 	mem_size = FJES_DEV_RES_BUF_SIZE(hw->max_epid);
 	hw->hw_info.res_buf = kzalloc(mem_size, GFP_KERNEL);
-	if (!(hw->hw_info.res_buf))
-		return -ENOMEM;
+	if (!(hw->hw_info.res_buf)) {
+		result = -ENOMEM;
+		goto free_req_buf;
+	}
 
 	hw->hw_info.res_buf_size = mem_size;
 
 	result = fjes_hw_alloc_shared_status_region(hw);
 	if (result)
-		return result;
+		goto free_res_buf;
 
 	hw->hw_info.buffer_share_bit = 0;
 	hw->hw_info.buffer_unshare_reserve_bit = 0;
@@ -260,11 +264,11 @@ static int fjes_hw_setup(struct fjes_hw *hw)
 
 			result = fjes_hw_alloc_epbuf(&buf_pair->tx);
 			if (result)
-				return result;
+				goto free_epbuf;
 
 			result = fjes_hw_alloc_epbuf(&buf_pair->rx);
 			if (result)
-				return result;
+				goto free_epbuf;
 
 			spin_lock_irqsave(&hw->rx_status_lock, flags);
 			fjes_hw_setup_epbuf(&buf_pair->tx, mac,
@@ -287,6 +291,25 @@ static int fjes_hw_setup(struct fjes_hw *hw)
 	fjes_hw_init_command_registers(hw, &param);
 
 	return 0;
+
+free_epbuf:
+	for (epidx = 0; epidx < hw->max_epid ; epidx++) {
+		if (epidx == hw->my_epid)
+			continue;
+		fjes_hw_free_epbuf(&hw->ep_shm_info[epidx].tx);
+		fjes_hw_free_epbuf(&hw->ep_shm_info[epidx].rx);
+	}
+	fjes_hw_free_shared_status_region(hw);
+free_res_buf:
+	kfree(hw->hw_info.res_buf);
+	hw->hw_info.res_buf = NULL;
+free_req_buf:
+	kfree(hw->hw_info.req_buf);
+	hw->hw_info.req_buf = NULL;
+free_ep_info:
+	kfree(hw->ep_shm_info);
+	hw->ep_shm_info = NULL;
+	return result;
 }
 
 static void fjes_hw_cleanup(struct fjes_hw *hw)

diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c
index f347e5a..7172dd3 100644
--- a/drivers/net/ppp/ppp_async.c
+++ b/drivers/net/ppp/ppp_async.c

@@ -474,6 +474,10 @@ ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
 	case PPPIOCSMRU:
 		if (get_user(val, p))
 			break;
+		if (val > U16_MAX) {
+			err = -EINVAL;
+			break;
+		}
 		if (val < PPP_MRU)
 			val = PPP_MRU;
 		ap->mru = val;

diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
index 909755e..5881620 100644
--- a/drivers/net/usb/ax88172a.c
+++ b/drivers/net/usb/ax88172a.c

@@ -198,7 +198,9 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
 	u8 buf[ETH_ALEN];
 	struct ax88172a_private *priv;
 
-	usbnet_get_endpoints(dev, intf);
+	ret = usbnet_get_endpoints(dev, intf);
+	if (ret)
+		return ret;
 
 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
 	if (!priv)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f391b43..4bccf2b 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c

@@ -2277,10 +2277,11 @@ static int virtnet_find_vqs(struct virtnet_info *vi)
 {
 	vq_callback_t **callbacks;
 	struct virtqueue **vqs;
-	int ret = -ENOMEM;
-	int i, total_vqs;
 	const char **names;
+	int ret = -ENOMEM;
+	int total_vqs;
 	bool *ctx;
+	u16 i;
 
 	/* We expect 1 RX virtqueue followed by 1 TX virtqueue, followed by
 	 * possible N-1 RX/TX queue pairs used in multiqueue mode, followed by
@@ -2317,8 +2318,8 @@ static int virtnet_find_vqs(struct virtnet_info *vi)
 	for (i = 0; i < vi->max_queue_pairs; i++) {
 		callbacks[rxq2vq(i)] = skb_recv_done;
 		callbacks[txq2vq(i)] = skb_xmit_done;
-		sprintf(vi->rq[i].name, "input.%d", i);
-		sprintf(vi->sq[i].name, "output.%d", i);
+		sprintf(vi->rq[i].name, "input.%u", i);
+		sprintf(vi->sq[i].name, "output.%u", i);
 		names[rxq2vq(i)] = vi->rq[i].name;
 		names[txq2vq(i)] = vi->sq[i].name;
 		if (ctx)

diff --git a/drivers/net/wan/lmc/lmc_proto.c b/drivers/net/wan/lmc/lmc_proto.c
index f600075..7ae39a2 100644
--- a/drivers/net/wan/lmc/lmc_proto.c
+++ b/drivers/net/wan/lmc/lmc_proto.c

@@ -103,17 +103,13 @@ __be16 lmc_proto_type(lmc_softc_t *sc, struct sk_buff *skb) /*FOLD00*/
     switch(sc->if_type){
     case LMC_PPP:
 	    return hdlc_type_trans(skb, sc->lmc_device);
-	    break;
     case LMC_NET:
         return htons(ETH_P_802_2);
-        break;
     case LMC_RAW: /* Packet type for skbuff kind of useless */
         return htons(ETH_P_802_2);
-        break;
     default:
         printk(KERN_WARNING "%s: No protocol set for this interface, assuming 802.2 (which is wrong!!)\n", sc->name);
         return htons(ETH_P_802_2);
-        break;
     }
     lmc_trace(sc->lmc_device, "lmc_proto_tye out");
 

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index e62ed7f..763521f 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c

@@ -647,9 +647,10 @@ void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event)
 	struct ath9k_htc_tx_event *tx_pend;
 	int i;
 
-	for (i = 0; i < txs->cnt; i++) {
-		WARN_ON(txs->cnt > HTC_MAX_TX_STATUS);
+	if (WARN_ON_ONCE(txs->cnt > HTC_MAX_TX_STATUS))
+		return;
 
+	for (i = 0; i < txs->cnt; i++) {
 		__txs = &txs->txstatus[i];
 
 		skb = ath9k_htc_tx_get_packet(priv, __txs);

diff --git a/drivers/net/wireless/marvell/libertas/Kconfig b/drivers/net/wireless/marvell/libertas/Kconfig
index e6268ce..28985cd 100644
--- a/drivers/net/wireless/marvell/libertas/Kconfig
+++ b/drivers/net/wireless/marvell/libertas/Kconfig

@@ -1,8 +1,6 @@
 config LIBERTAS
 	tristate "Marvell 8xxx Libertas WLAN driver support"
 	depends on CFG80211
-	select WIRELESS_EXT
-	select WEXT_SPY
 	select LIB80211
 	select FW_LOADER
 	---help---

diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index a88bddc..76205d6 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c

@@ -1940,6 +1940,8 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
 
 	mwifiex_set_sys_config_invalid_data(bss_cfg);
 
+	memcpy(bss_cfg->mac_addr, priv->curr_addr, ETH_ALEN);
+
 	if (params->beacon_interval)
 		bss_cfg->beacon_period = params->beacon_interval;
 	if (params->dtim_period)

diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
index c802b73..99b40bc 100644
--- a/drivers/net/wireless/marvell/mwifiex/fw.h
+++ b/drivers/net/wireless/marvell/mwifiex/fw.h

@@ -168,6 +168,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_STA_MAC_ADDR       (PROPRIETARY_TLV_BASE_ID + 32)
 #define TLV_TYPE_BSSID              (PROPRIETARY_TLV_BASE_ID + 35)
 #define TLV_TYPE_CHANNELBANDLIST    (PROPRIETARY_TLV_BASE_ID + 42)
+#define TLV_TYPE_UAP_MAC_ADDRESS    (PROPRIETARY_TLV_BASE_ID + 43)
 #define TLV_TYPE_UAP_BEACON_PERIOD  (PROPRIETARY_TLV_BASE_ID + 44)
 #define TLV_TYPE_UAP_DTIM_PERIOD    (PROPRIETARY_TLV_BASE_ID + 45)
 #define TLV_TYPE_UAP_BCAST_SSID     (PROPRIETARY_TLV_BASE_ID + 48)

diff --git a/drivers/net/wireless/marvell/mwifiex/ioctl.h b/drivers/net/wireless/marvell/mwifiex/ioctl.h
index 0dd592e..96ff916 100644
--- a/drivers/net/wireless/marvell/mwifiex/ioctl.h
+++ b/drivers/net/wireless/marvell/mwifiex/ioctl.h

@@ -119,6 +119,7 @@ struct mwifiex_uap_bss_param {
 	u8 qos_info;
 	u8 power_constraint;
 	struct mwifiex_types_wmm_info wmm_info;
+	u8 mac_addr[ETH_ALEN];
 };
 
 enum {

diff --git a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
index 0939a8c..1ab253c 100644
--- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c

@@ -479,6 +479,7 @@ void mwifiex_config_uap_11d(struct mwifiex_private *priv,
 static int
 mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
 {
+	struct host_cmd_tlv_mac_addr *mac_tlv;
 	struct host_cmd_tlv_dtim_period *dtim_period;
 	struct host_cmd_tlv_beacon_period *beacon_period;
 	struct host_cmd_tlv_ssid *ssid;
@@ -498,6 +499,13 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
 	int i;
 	u16 cmd_size = *param_size;
 
+	mac_tlv = (struct host_cmd_tlv_mac_addr *)tlv;
+	mac_tlv->header.type = cpu_to_le16(TLV_TYPE_UAP_MAC_ADDRESS);
+	mac_tlv->header.len = cpu_to_le16(ETH_ALEN);
+	memcpy(mac_tlv->mac_addr, bss_cfg->mac_addr, ETH_ALEN);
+	cmd_size += sizeof(struct host_cmd_tlv_mac_addr);
+	tlv += sizeof(struct host_cmd_tlv_mac_addr);
+
 	if (bss_cfg->ssid.ssid_len) {
 		ssid = (struct host_cmd_tlv_ssid *)tlv;
 		ssid->header.type = cpu_to_le16(TLV_TYPE_UAP_SSID);

diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
index bfd704b..9263a6a 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c

@@ -6366,6 +6366,18 @@ static const struct usb_device_id dev_table[] = {
 	.driver_info = (unsigned long)&rtl8192eu_fops},
 {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x818c, 0xff, 0xff, 0xff),
 	.driver_info = (unsigned long)&rtl8192eu_fops},
+/* D-Link DWA-131 rev C1 */
+{USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3312, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192eu_fops},
+/* TP-Link TL-WN8200ND V2 */
+{USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0126, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192eu_fops},
+/* Mercusys MW300UM */
+{USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0100, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192eu_fops},
+/* Mercusys MW300UH */
+{USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0104, 0xff, 0xff, 0xff),
+	.driver_info = (unsigned long)&rtl8192eu_fops},
 #endif
 { }
 };

diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index ab74f31..b6c3a6d 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c

@@ -194,21 +194,29 @@ static bool _rtl_pci_platform_switch_device_pci_aspm(
 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
 	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 
-	if (rtlhal->hw_type != HARDWARE_TYPE_RTL8192SE)
-		value |= 0x40;
+	value &= PCI_EXP_LNKCTL_ASPMC;
 
-	pci_write_config_byte(rtlpci->pdev, 0x80, value);
+	if (rtlhal->hw_type != HARDWARE_TYPE_RTL8192SE)
+		value |= PCI_EXP_LNKCTL_CCC;
+
+	pcie_capability_clear_and_set_word(rtlpci->pdev, PCI_EXP_LNKCTL,
+					   PCI_EXP_LNKCTL_ASPMC | value,
+					   value);
 
 	return false;
 }
 
-/*When we set 0x01 to enable clk request. Set 0x0 to disable clk req.*/
-static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u8 value)
+/* @value is PCI_EXP_LNKCTL_CLKREQ_EN or 0 to enable/disable clk request. */
+static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u16 value)
 {
 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
 	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 
-	pci_write_config_byte(rtlpci->pdev, 0x81, value);
+	value &= PCI_EXP_LNKCTL_CLKREQ_EN;
+
+	pcie_capability_clear_and_set_word(rtlpci->pdev, PCI_EXP_LNKCTL,
+					   PCI_EXP_LNKCTL_CLKREQ_EN,
+					   value);
 
 	if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192SE)
 		udelay(100);
@@ -222,11 +230,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
 	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
 	u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor;
-	u8 num4bytes = pcipriv->ndis_adapter.num4bytes;
 	/*Retrieve original configuration settings. */
 	u8 linkctrl_reg = pcipriv->ndis_adapter.linkctrl_reg;
-	u16 pcibridge_linkctrlreg = pcipriv->ndis_adapter.
-				pcibridge_linkctrlreg;
 	u16 aspmlevel = 0;
 	u8 tmp_u1b = 0;
 
@@ -251,16 +256,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
 	/*Set corresponding value. */
 	aspmlevel |= BIT(0) | BIT(1);
 	linkctrl_reg &= ~aspmlevel;
-	pcibridge_linkctrlreg &= ~(BIT(0) | BIT(1));
 
 	_rtl_pci_platform_switch_device_pci_aspm(hw, linkctrl_reg);
-	udelay(50);
-
-	/*4 Disable Pci Bridge ASPM */
-	pci_write_config_byte(rtlpci->pdev, (num4bytes << 2),
-			      pcibridge_linkctrlreg);
-
-	udelay(50);
 }
 
 /*
@@ -276,9 +273,7 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
 	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
 	u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor;
-	u8 num4bytes = pcipriv->ndis_adapter.num4bytes;
 	u16 aspmlevel;
-	u8 u_pcibridge_aspmsetting;
 	u8 u_device_aspmsetting;
 
 	if (!ppsc->support_aspm)
@@ -290,25 +285,6 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
 		return;
 	}
 
-	/*4 Enable Pci Bridge ASPM */
-
-	u_pcibridge_aspmsetting =
-	    pcipriv->ndis_adapter.pcibridge_linkctrlreg |
-	    rtlpci->const_hostpci_aspm_setting;
-
-	if (pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL)
-		u_pcibridge_aspmsetting &= ~BIT(0);
-
-	pci_write_config_byte(rtlpci->pdev, (num4bytes << 2),
-			      u_pcibridge_aspmsetting);
-
-	RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
-		 "PlatformEnableASPM(): Write reg[%x] = %x\n",
-		 (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10),
-		 u_pcibridge_aspmsetting);
-
-	udelay(50);
-
 	/*Get ASPM level (with/without Clock Req) */
 	aspmlevel = rtlpci->const_devicepci_aspm_setting;
 	u_device_aspmsetting = pcipriv->ndis_adapter.linkctrl_reg;
@@ -322,7 +298,8 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
 
 	if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
 		_rtl_pci_switch_clk_req(hw, (ppsc->reg_rfps_level &
-					     RT_RF_OFF_LEVL_CLK_REQ) ? 1 : 0);
+					     RT_RF_OFF_LEVL_CLK_REQ) ?
+					     PCI_EXP_LNKCTL_CLKREQ_EN : 0);
 		RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_CLK_REQ);
 	}
 	udelay(100);
@@ -390,22 +367,6 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
 	return find_buddy_priv;
 }
 
-static void rtl_pci_get_linkcontrol_field(struct ieee80211_hw *hw)
-{
-	struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
-	struct rtl_pci *rtlpci = rtl_pcidev(pcipriv);
-	u8 capabilityoffset = pcipriv->ndis_adapter.pcibridge_pciehdr_offset;
-	u8 linkctrl_reg;
-	u8 num4bbytes;
-
-	num4bbytes = (capabilityoffset + 0x10) / 4;
-
-	/*Read  Link Control Register */
-	pci_read_config_byte(rtlpci->pdev, (num4bbytes << 2), &linkctrl_reg);
-
-	pcipriv->ndis_adapter.pcibridge_linkctrlreg = linkctrl_reg;
-}
-
 static void rtl_pci_parse_configuration(struct pci_dev *pdev,
 		struct ieee80211_hw *hw)
 {
@@ -2076,12 +2037,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
 		    PCI_SLOT(bridge_pdev->devfn);
 		pcipriv->ndis_adapter.pcibridge_funcnum =
 		    PCI_FUNC(bridge_pdev->devfn);
-		pcipriv->ndis_adapter.pcibridge_pciehdr_offset =
-		    pci_pcie_cap(bridge_pdev);
-		pcipriv->ndis_adapter.num4bytes =
-		    (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10) / 4;
-
-		rtl_pci_get_linkcontrol_field(hw);
 
 		if (pcipriv->ndis_adapter.pcibridge_vendor ==
 		    PCI_BRIDGE_VENDOR_AMD) {
@@ -2098,13 +2053,11 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
 		 pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg);
 
 	RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
-		 "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n",
+		 "pci_bridge busnumber:devnumber:funcnumber:vendor:amd %d:%d:%d:%x:%x\n",
 		 pcipriv->ndis_adapter.pcibridge_busnum,
 		 pcipriv->ndis_adapter.pcibridge_devnum,
 		 pcipriv->ndis_adapter.pcibridge_funcnum,
 		 pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor],
-		 pcipriv->ndis_adapter.pcibridge_pciehdr_offset,
-		 pcipriv->ndis_adapter.pcibridge_linkctrlreg,
 		 pcipriv->ndis_adapter.amd_l1_patch);
 
 	rtl_pci_parse_configuration(pdev, hw);

diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.h b/drivers/net/wireless/realtek/rtlwifi/pci.h
index d9039ea..19b7a57 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.h
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.h

@@ -262,11 +262,6 @@ struct mp_adapter {
 	u16 pcibridge_vendorid;
 	u16 pcibridge_deviceid;
 
-	u8 num4bytes;
-
-	u8 pcibridge_pciehdr_offset;
-	u8 pcibridge_linkctrlreg;
-
 	bool amd_l1_patch;
 };
 

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
index 14a2560..44cabfa 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c

@@ -38,7 +38,6 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw,
 static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw,
 					enum radio_path rfpath, u32 offset,
 					u32 data);
-static u32 _rtl88e_phy_calculate_bit_shift(u32 bitmask);
 static bool _rtl88e_phy_bb8188e_config_parafile(struct ieee80211_hw *hw);
 static bool _rtl88e_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
 static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw,
@@ -68,7 +67,7 @@ u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
 	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
 		 "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
-	bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	returnvalue = (originalvalue & bitmask) >> bitshift;
 
 	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
@@ -91,7 +90,7 @@ void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,
 
 	if (bitmask != MASKDWORD) {
 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
-		bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
+		bitshift = calculate_bit_shift(bitmask);
 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
 	}
 
@@ -117,7 +116,7 @@ u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw,
 
 
 	original_value = _rtl88e_phy_rf_serial_read(hw, rfpath, regaddr);
-	bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	readback_value = (original_value & bitmask) >> bitshift;
 
 	spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
@@ -146,7 +145,7 @@ void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw,
 			original_value = _rtl88e_phy_rf_serial_read(hw,
 								    rfpath,
 								    regaddr);
-			bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
+			bitshift = calculate_bit_shift(bitmask);
 			data =
 			    ((original_value & (~bitmask)) |
 			     (data << bitshift));
@@ -232,17 +231,6 @@ static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw,
 		 rfpath, pphyreg->rf3wire_offset, data_and_addr);
 }
 
-static u32 _rtl88e_phy_calculate_bit_shift(u32 bitmask)
-{
-	u32 i;
-
-	for (i = 0; i <= 31; i++) {
-		if (((bitmask >> i) & 0x1) == 1)
-			break;
-	}
-	return i;
-}
-
 bool rtl88e_phy_mac_config(struct ieee80211_hw *hw)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
index 7c6e5d91..bc2b384 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c

@@ -39,7 +39,7 @@ u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
 	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n",
 		 regaddr, bitmask);
 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
-	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	returnvalue = (originalvalue & bitmask) >> bitshift;
 
 	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
@@ -62,7 +62,7 @@ void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw,
 
 	if (bitmask != MASKDWORD) {
 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
-		bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+		bitshift = calculate_bit_shift(bitmask);
 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
 	}
 
@@ -165,18 +165,6 @@ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(_rtl92c_phy_rf_serial_write);
 
-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask)
-{
-	u32 i;
-
-	for (i = 0; i <= 31; i++) {
-		if (((bitmask >> i) & 0x1) == 1)
-			break;
-	}
-	return i;
-}
-EXPORT_SYMBOL(_rtl92c_phy_calculate_bit_shift);
-
 static void _rtl92c_phy_bb_config_1t(struct ieee80211_hw *hw)
 {
 	rtl_set_bbreg(hw, RFPGA0_TXINFO, 0x3, 0x2);

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
index d11261e..76f5740 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h

@@ -218,7 +218,6 @@ bool rtl92c_phy_set_rf_power_state(struct ieee80211_hw *hw,
 void rtl92ce_phy_set_rf_on(struct ieee80211_hw *hw);
 void rtl92c_phy_set_io(struct ieee80211_hw *hw);
 void rtl92c_bb_block_on(struct ieee80211_hw *hw);
-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
 long _rtl92c_phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw,
 				  enum wireless_mode wirelessmode,
 				  u8 txpwridx);

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
index 7c6d7fc..9f478d8 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c

@@ -61,7 +61,7 @@ u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw,
 							       rfpath, regaddr);
 	}
 
-	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	readback_value = (original_value & bitmask) >> bitshift;
 
 	spin_unlock(&rtlpriv->locks.rf_lock);
@@ -132,7 +132,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
 			original_value = _rtl92c_phy_rf_serial_read(hw,
 								    rfpath,
 								    regaddr);
-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+			bitshift = calculate_bit_shift(bitmask);
 			data =
 			    ((original_value & (~bitmask)) |
 			     (data << bitshift));
@@ -144,7 +144,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
 			original_value = _rtl92c_phy_fw_rf_serial_read(hw,
 								       rfpath,
 								       regaddr);
-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+			bitshift = calculate_bit_shift(bitmask);
 			data =
 			    ((original_value & (~bitmask)) |
 			     (data << bitshift));

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
index 93f3bc0..e084a91 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h

@@ -116,7 +116,6 @@ u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath,
 			       u32 offset);
 u32 _rtl92c_phy_fw_rf_serial_read(struct ieee80211_hw *hw,
 				  enum radio_path rfpath, u32 offset);
-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
 void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
 				 enum radio_path rfpath, u32 offset, u32 data);
 void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw,

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
index f068dd5..5a5476a 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c

@@ -54,7 +54,7 @@ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw,
 		original_value = _rtl92c_phy_fw_rf_serial_read(hw,
 							       rfpath, regaddr);
 	}
-	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	readback_value = (original_value & bitmask) >> bitshift;
 	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
 		 "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n",
@@ -78,7 +78,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw,
 			original_value = _rtl92c_phy_rf_serial_read(hw,
 								    rfpath,
 								    regaddr);
-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+			bitshift = calculate_bit_shift(bitmask);
 			data =
 			    ((original_value & (~bitmask)) |
 			     (data << bitshift));
@@ -89,7 +89,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw,
 			original_value = _rtl92c_phy_fw_rf_serial_read(hw,
 								       rfpath,
 								       regaddr);
-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+			bitshift = calculate_bit_shift(bitmask);
 			data =
 			    ((original_value & (~bitmask)) |
 			     (data << bitshift));

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
index 5373425..2ee7796 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c

@@ -182,17 +182,14 @@ static u32 targetchnl_2g[TARGET_CHNL_NUM_2G] = {
 	25711, 25658, 25606, 25554, 25502, 25451, 25328
 };
 
-static u32 _rtl92d_phy_calculate_bit_shift(u32 bitmask)
-{
-	u32 i;
-
-	for (i = 0; i <= 31; i++) {
-		if (((bitmask >> i) & 0x1) == 1)
-			break;
-	}
-
-	return i;
-}
+static const u8 channel_all[59] = {
+	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
+	36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58,
+	60, 62, 64, 100, 102, 104, 106, 108, 110, 112,
+	114, 116, 118, 120, 122, 124, 126, 128,	130,
+	132, 134, 136, 138, 140, 149, 151, 153, 155,
+	157, 159, 161, 163, 165
+};
 
 u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
 {
@@ -216,7 +213,7 @@ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
 	} else {
 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
 	}
-	bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	returnvalue = (originalvalue & bitmask) >> bitshift;
 	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
 		 "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
@@ -248,7 +245,7 @@ void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw,
 					dbi_direct);
 		else
 			originalvalue = rtl_read_dword(rtlpriv, regaddr);
-		bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
+		bitshift = calculate_bit_shift(bitmask);
 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
 	}
 	if (rtlhal->during_mac1init_radioa || rtlhal->during_mac0init_radiob)
@@ -336,7 +333,7 @@ u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw,
 		 regaddr, rfpath, bitmask);
 	spin_lock_irqsave(&rtlpriv->locks.rf_lock, flags);
 	original_value = _rtl92d_phy_rf_serial_read(hw, rfpath, regaddr);
-	bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	readback_value = (original_value & bitmask) >> bitshift;
 	spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
 	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
@@ -363,7 +360,7 @@ void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
 		if (bitmask != RFREG_OFFSET_MASK) {
 			original_value = _rtl92d_phy_rf_serial_read(hw,
 				rfpath, regaddr);
-			bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
+			bitshift = calculate_bit_shift(bitmask);
 			data = ((original_value & (~bitmask)) |
 				(data << bitshift));
 		}
@@ -1383,14 +1380,6 @@ static void _rtl92d_phy_switch_rf_setting(struct ieee80211_hw *hw, u8 channel)
 
 u8 rtl92d_get_rightchnlplace_for_iqk(u8 chnl)
 {
-	u8 channel_all[59] = {
-		1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
-		36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58,
-		60, 62, 64, 100, 102, 104, 106, 108, 110, 112,
-		114, 116, 118, 120, 122, 124, 126, 128,	130,
-		132, 134, 136, 138, 140, 149, 151, 153, 155,
-		157, 159, 161, 163, 165
-	};
 	u8 place = chnl;
 
 	if (chnl > 14) {
@@ -3245,37 +3234,28 @@ void rtl92d_phy_config_macphymode_info(struct ieee80211_hw *hw)
 u8 rtl92d_get_chnlgroup_fromarray(u8 chnl)
 {
 	u8 group;
-	u8 channel_info[59] = {
-		1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
-		36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56,
-		58, 60, 62, 64, 100, 102, 104, 106, 108,
-		110, 112, 114, 116, 118, 120, 122, 124,
-		126, 128, 130, 132, 134, 136, 138, 140,
-		149, 151, 153, 155, 157, 159, 161, 163,
-		165
-	};
 
-	if (channel_info[chnl] <= 3)
+	if (channel_all[chnl] <= 3)
 		group = 0;
-	else if (channel_info[chnl] <= 9)
+	else if (channel_all[chnl] <= 9)
 		group = 1;
-	else if (channel_info[chnl] <= 14)
+	else if (channel_all[chnl] <= 14)
 		group = 2;
-	else if (channel_info[chnl] <= 44)
+	else if (channel_all[chnl] <= 44)
 		group = 3;
-	else if (channel_info[chnl] <= 54)
+	else if (channel_all[chnl] <= 54)
 		group = 4;
-	else if (channel_info[chnl] <= 64)
+	else if (channel_all[chnl] <= 64)
 		group = 5;
-	else if (channel_info[chnl] <= 112)
+	else if (channel_all[chnl] <= 112)
 		group = 6;
-	else if (channel_info[chnl] <= 126)
+	else if (channel_all[chnl] <= 126)
 		group = 7;
-	else if (channel_info[chnl] <= 140)
+	else if (channel_all[chnl] <= 140)
 		group = 8;
-	else if (channel_info[chnl] <= 153)
+	else if (channel_all[chnl] <= 153)
 		group = 9;
-	else if (channel_info[chnl] <= 159)
+	else if (channel_all[chnl] <= 159)
 		group = 10;
 	else
 		group = 11;

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
index 8b072ee..9a3e88d 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c

@@ -38,7 +38,6 @@ static u32 _rtl92ee_phy_rf_serial_read(struct ieee80211_hw *hw,
 static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,
 					 enum radio_path rfpath, u32 offset,
 					 u32 data);
-static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask);
 static bool _rtl92ee_phy_bb8192ee_config_parafile(struct ieee80211_hw *hw);
 static bool _rtl92ee_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
 static bool phy_config_bb_with_hdr_file(struct ieee80211_hw *hw,
@@ -68,7 +67,7 @@ u32 rtl92ee_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
 	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
 		 "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
-	bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	returnvalue = (originalvalue & bitmask) >> bitshift;
 
 	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
@@ -90,7 +89,7 @@ void rtl92ee_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr,
 
 	if (bitmask != MASKDWORD) {
 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
-		bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
+		bitshift = calculate_bit_shift(bitmask);
 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
 	}
 
@@ -115,7 +114,7 @@ u32 rtl92ee_phy_query_rf_reg(struct ieee80211_hw *hw,
 	spin_lock_irqsave(&rtlpriv->locks.rf_lock, flags);
 
 	original_value = _rtl92ee_phy_rf_serial_read(hw , rfpath, regaddr);
-	bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	readback_value = (original_value & bitmask) >> bitshift;
 
 	spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
@@ -143,7 +142,7 @@ void rtl92ee_phy_set_rf_reg(struct ieee80211_hw *hw,
 
 	if (bitmask != RFREG_OFFSET_MASK) {
 		original_value = _rtl92ee_phy_rf_serial_read(hw, rfpath, addr);
-		bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
+		bitshift = calculate_bit_shift(bitmask);
 		data = (original_value & (~bitmask)) | (data << bitshift);
 	}
 
@@ -226,17 +225,6 @@ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,
 		 pphyreg->rf3wire_offset, data_and_addr);
 }
 
-static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask)
-{
-	u32 i;
-
-	for (i = 0; i <= 31; i++) {
-		if (((bitmask >> i) & 0x1) == 1)
-			break;
-	}
-	return i;
-}
-
 bool rtl92ee_phy_mac_config(struct ieee80211_hw *hw)
 {
 	return _rtl92ee_phy_config_mac_with_headerfile(hw);

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
index 86cb853..0430a3b 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c

@@ -36,18 +36,6 @@
 #include "hw.h"
 #include "table.h"
 
-static u32 _rtl92s_phy_calculate_bit_shift(u32 bitmask)
-{
-	u32 i;
-
-	for (i = 0; i <= 31; i++) {
-		if (((bitmask >> i) & 0x1) == 1)
-			break;
-	}
-
-	return i;
-}
-
 u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -57,7 +45,7 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
 		 regaddr, bitmask);
 
 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
-	bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	returnvalue = (originalvalue & bitmask) >> bitshift;
 
 	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
@@ -79,7 +67,7 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask,
 
 	if (bitmask != MASKDWORD) {
 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
-		bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
+		bitshift = calculate_bit_shift(bitmask);
 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
 	}
 
@@ -187,7 +175,7 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
 
 	original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, regaddr);
 
-	bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	readback_value = (original_value & bitmask) >> bitshift;
 
 	spin_unlock(&rtlpriv->locks.rf_lock);
@@ -218,7 +206,7 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
 	if (bitmask != RFREG_OFFSET_MASK) {
 		original_value = _rtl92s_phy_rf_serial_read(hw, rfpath,
 							    regaddr);
-		bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
+		bitshift = calculate_bit_shift(bitmask);
 		data = ((original_value & (~bitmask)) | (data << bitshift));
 	}
 

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c
index 5cf29f5..e6ac496e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c

@@ -72,7 +72,7 @@ u32 rtl8723e_phy_query_rf_reg(struct ieee80211_hw *hw,
 							    rfpath, regaddr);
 	}
 
-	bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	readback_value = (original_value & bitmask) >> bitshift;
 
 	spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
@@ -104,7 +104,7 @@ void rtl8723e_phy_set_rf_reg(struct ieee80211_hw *hw,
 			original_value = rtl8723_phy_rf_serial_read(hw,
 								    rfpath,
 								    regaddr);
-			bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
+			bitshift = calculate_bit_shift(bitmask);
 			data =
 			    ((original_value & (~bitmask)) |
 			     (data << bitshift));
@@ -113,7 +113,7 @@ void rtl8723e_phy_set_rf_reg(struct ieee80211_hw *hw,
 		rtl8723_phy_rf_serial_write(hw, rfpath, regaddr, data);
 	} else {
 		if (bitmask != RFREG_OFFSET_MASK) {
-			bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
+			bitshift = calculate_bit_shift(bitmask);
 			data =
 			    ((original_value & (~bitmask)) |
 			     (data << bitshift));

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c
index 9606641..f1b42f9 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c

@@ -63,7 +63,7 @@ u32 rtl8723be_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
 	spin_lock_irqsave(&rtlpriv->locks.rf_lock, flags);
 
 	original_value = rtl8723_phy_rf_serial_read(hw, rfpath, regaddr);
-	bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
+	bitshift = calculate_bit_shift(bitmask);
 	readback_value = (original_value & bitmask) >> bitshift;
 
 	spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
@@ -91,7 +91,7 @@ void rtl8723be_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path path,
 	if (bitmask != RFREG_OFFSET_MASK) {
 			original_value = rtl8723_phy_rf_serial_read(hw, path,
 								    regaddr);
-			bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
+			bitshift = calculate_bit_shift(bitmask);
 			data = ((original_value & (~bitmask)) |
 				(data << bitshift));
 		}

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723com/phy_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723com/phy_common.c
index 43d24e1..af9cd74 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723com/phy_common.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723com/phy_common.c

@@ -75,13 +75,9 @@ EXPORT_SYMBOL_GPL(rtl8723_phy_set_bb_reg);
 
 u32 rtl8723_phy_calculate_bit_shift(u32 bitmask)
 {
-	u32 i;
+	u32 i = ffs(bitmask);
 
-	for (i = 0; i <= 31; i++) {
-		if (((bitmask >> i) & 0x1) == 1)
-			break;
-	}
-	return i;
+	return i ? i - 1 : 32;
 }
 EXPORT_SYMBOL_GPL(rtl8723_phy_calculate_bit_shift);
 

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
index 176deb2..f96d823 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c

@@ -49,7 +49,13 @@ static u32 _rtl8821ae_phy_rf_serial_read(struct ieee80211_hw *hw,
 static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw,
 					   enum radio_path rfpath, u32 offset,
 					   u32 data);
-static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask);
+static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask)
+{
+	if (WARN_ON_ONCE(!bitmask))
+		return 0;
+
+	return __ffs(bitmask);
+}
 static bool _rtl8821ae_phy_bb8821a_config_parafile(struct ieee80211_hw *hw);
 /*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/
 static bool _rtl8821ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
@@ -296,17 +302,6 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw,
 		 rfpath, pphyreg->rf3wire_offset, data_and_addr);
 }
 
-static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask)
-{
-	u32 i;
-
-	for (i = 0; i <= 31; i++) {
-		if (((bitmask >> i) & 0x1) == 1)
-			break;
-	}
-	return i;
-}
-
 bool rtl8821ae_phy_mac_config(struct ieee80211_hw *hw)
 {
 	bool rtstatus = 0;

diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index c73ce33..61f5b6f 100644
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h

@@ -3095,4 +3095,11 @@ static inline struct ieee80211_sta *rtl_find_sta(struct ieee80211_hw *hw,
 	return ieee80211_find_sta(mac->vif, mac_addr);
 }
 
+static inline u32 calculate_bit_shift(u32 bitmask)
+{
+	if (WARN_ON_ONCE(!bitmask))
+		return 0;
+
+	return __ffs(bitmask);
+}
 #endif

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 47e7e9a..901ddea 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c

@@ -97,13 +97,12 @@ module_param_named(hash_cache_size, xenvif_hash_cache_size, uint, 0644);
 MODULE_PARM_DESC(hash_cache_size, "Number of flows in the hash cache");
 
 static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
-			       u8 status);
+			       s8 status);
 
 static void make_tx_response(struct xenvif_queue *queue,
-			     struct xen_netif_tx_request *txp,
+			     const struct xen_netif_tx_request *txp,
 			     unsigned int extra_count,
-			     s8       st);
-static void push_tx_responses(struct xenvif_queue *queue);
+			     s8 status);
 
 static void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx);
 
@@ -201,13 +200,9 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
 			  unsigned int extra_count, RING_IDX end)
 {
 	RING_IDX cons = queue->tx.req_cons;
-	unsigned long flags;
 
 	do {
-		spin_lock_irqsave(&queue->response_lock, flags);
 		make_tx_response(queue, txp, extra_count, XEN_NETIF_RSP_ERROR);
-		push_tx_responses(queue);
-		spin_unlock_irqrestore(&queue->response_lock, flags);
 		if (cons == end)
 			break;
 		RING_COPY_REQUEST(&queue->tx, cons++, txp);
@@ -456,12 +451,20 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
 	}
 
 	for (shinfo->nr_frags = 0; nr_slots > 0 && shinfo->nr_frags < MAX_SKB_FRAGS;
-	     shinfo->nr_frags++, gop++, nr_slots--) {
+	     nr_slots--) {
+		if (unlikely(!txp->size)) {
+			make_tx_response(queue, txp, 0, XEN_NETIF_RSP_OKAY);
+			++txp;
+			continue;
+		}
+
 		index = pending_index(queue->pending_cons++);
 		pending_idx = queue->pending_ring[index];
 		xenvif_tx_create_map_op(queue, pending_idx, txp,
 				        txp == first ? extra_count : 0, gop);
 		frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx);
+		++shinfo->nr_frags;
+		++gop;
 
 		if (txp == first)
 			txp = txfrags;
@@ -474,20 +477,33 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
 		shinfo = skb_shinfo(nskb);
 		frags = shinfo->frags;
 
-		for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots;
-		     shinfo->nr_frags++, txp++, gop++) {
+		for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; ++txp) {
+			if (unlikely(!txp->size)) {
+				make_tx_response(queue, txp, 0,
+						 XEN_NETIF_RSP_OKAY);
+				continue;
+			}
+
 			index = pending_index(queue->pending_cons++);
 			pending_idx = queue->pending_ring[index];
 			xenvif_tx_create_map_op(queue, pending_idx, txp, 0,
 						gop);
 			frag_set_pending_idx(&frags[shinfo->nr_frags],
 					     pending_idx);
+			++shinfo->nr_frags;
+			++gop;
 		}
 
-		skb_shinfo(skb)->frag_list = nskb;
-	} else if (nskb) {
+		if (shinfo->nr_frags) {
+			skb_shinfo(skb)->frag_list = nskb;
+			nskb = NULL;
+		}
+	}
+
+	if (nskb) {
 		/* A frag_list skb was allocated but it is no longer needed
-		 * because enough slots were converted to copy ops above.
+		 * because enough slots were converted to copy ops above or some
+		 * were empty.
 		 */
 		kfree_skb(nskb);
 	}
@@ -960,7 +976,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
 					 (ret == 0) ?
 					 XEN_NETIF_RSP_OKAY :
 					 XEN_NETIF_RSP_ERROR);
-			push_tx_responses(queue);
 			continue;
 		}
 
@@ -972,7 +987,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
 
 			make_tx_response(queue, &txreq, extra_count,
 					 XEN_NETIF_RSP_OKAY);
-			push_tx_responses(queue);
 			continue;
 		}
 
@@ -1398,44 +1412,17 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget)
 	return work_done;
 }
 
-static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
-			       u8 status)
-{
-	struct pending_tx_info *pending_tx_info;
-	pending_ring_idx_t index;
-	unsigned long flags;
-
-	pending_tx_info = &queue->pending_tx_info[pending_idx];
-
-	spin_lock_irqsave(&queue->response_lock, flags);
-
-	make_tx_response(queue, &pending_tx_info->req,
-			 pending_tx_info->extra_count, status);
-
-	/* Release the pending index before pusing the Tx response so
-	 * its available before a new Tx request is pushed by the
-	 * frontend.
-	 */
-	index = pending_index(queue->pending_prod++);
-	queue->pending_ring[index] = pending_idx;
-
-	push_tx_responses(queue);
-
-	spin_unlock_irqrestore(&queue->response_lock, flags);
-}
-
-
-static void make_tx_response(struct xenvif_queue *queue,
-			     struct xen_netif_tx_request *txp,
+static void _make_tx_response(struct xenvif_queue *queue,
+			     const struct xen_netif_tx_request *txp,
 			     unsigned int extra_count,
-			     s8       st)
+			     s8 status)
 {
 	RING_IDX i = queue->tx.rsp_prod_pvt;
 	struct xen_netif_tx_response *resp;
 
 	resp = RING_GET_RESPONSE(&queue->tx, i);
 	resp->id     = txp->id;
-	resp->status = st;
+	resp->status = status;
 
 	while (extra_count-- != 0)
 		RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL;
@@ -1452,6 +1439,47 @@ static void push_tx_responses(struct xenvif_queue *queue)
 		notify_remote_via_irq(queue->tx_irq);
 }
 
+static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
+			       s8 status)
+{
+	struct pending_tx_info *pending_tx_info;
+	pending_ring_idx_t index;
+	unsigned long flags;
+
+	pending_tx_info = &queue->pending_tx_info[pending_idx];
+
+	spin_lock_irqsave(&queue->response_lock, flags);
+
+	_make_tx_response(queue, &pending_tx_info->req,
+			  pending_tx_info->extra_count, status);
+
+	/* Release the pending index before pusing the Tx response so
+	 * its available before a new Tx request is pushed by the
+	 * frontend.
+	 */
+	index = pending_index(queue->pending_prod++);
+	queue->pending_ring[index] = pending_idx;
+
+	push_tx_responses(queue);
+
+	spin_unlock_irqrestore(&queue->response_lock, flags);
+}
+
+static void make_tx_response(struct xenvif_queue *queue,
+			     const struct xen_netif_tx_request *txp,
+			     unsigned int extra_count,
+			     s8 status)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&queue->response_lock, flags);
+
+	_make_tx_response(queue, txp, extra_count, status);
+	push_tx_responses(queue);
+
+	spin_unlock_irqrestore(&queue->response_lock, flags);
+}
+
 static void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
 {
 	int ret;

diff --git a/drivers/pci/host/pcie-mediatek.c b/drivers/pci/host/pcie-mediatek.c
index 60c3110..6a47a66 100644
--- a/drivers/pci/host/pcie-mediatek.c
+++ b/drivers/pci/host/pcie-mediatek.c

@@ -628,6 +628,14 @@ static irqreturn_t mtk_pcie_intr_handler(int irq, void *data)
 		while ((status = readl(port->base + PCIE_INT_STATUS)) & MSI_STATUS) {
 			unsigned long imsi_status;
 
+			/*
+			 * The interrupt status can be cleared even if the
+			 * MSI status remains pending. As such, given the
+			 * edge-triggered interrupt type, its status should
+			 * be cleared before being dispatched to the
+			 * handler of the underlying device.
+			 */
+			writel(MSI_STATUS, port->base + PCIE_INT_STATUS);
 			while ((imsi_status = readl(port->base + PCIE_IMSI_STATUS))) {
 				for_each_set_bit(bit, &imsi_status, MTK_MSI_IRQS_NUM) {
 					/* Clear the MSI */
@@ -636,8 +644,6 @@ static irqreturn_t mtk_pcie_intr_handler(int irq, void *data)
 					generic_handle_irq(virq);
 				}
 			}
-			/* Clear MSI interrupt status */
-			writel(MSI_STATUS, port->base + PCIE_INT_STATUS);
 		}
 	}
 

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index e321479..ef93035 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c

@@ -441,10 +441,13 @@ static void quirk_amd_dwc_class(struct pci_dev *pdev)
 {
 	u32 class = pdev->class;
 
-	/* Use "USB Device (not host controller)" class */
-	pdev->class = PCI_CLASS_SERIAL_USB_DEVICE;
-	dev_info(&pdev->dev, "PCI class overridden (%#08x -> %#08x) so dwc3 driver can claim this instead of xhci\n",
-		 class, pdev->class);
+	if (class != PCI_CLASS_SERIAL_USB_DEVICE) {
+		/* Use "USB Device (not host controller)" class */
+		pdev->class = PCI_CLASS_SERIAL_USB_DEVICE;
+		dev_info(&pdev->dev,
+			"PCI class overridden (%#08x -> %#08x) so dwc3 driver can claim this instead of xhci\n",
+			class, pdev->class);
+	}
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB,
 		quirk_amd_dwc_class);
@@ -3451,6 +3454,19 @@ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_ATI, PCI_ANY_ID,
 			       PCI_CLASS_DISPLAY_VGA, 8, quirk_no_pm_reset);
 
 /*
+ * Spectrum-{1,2,3,4} devices report that a D3hot->D0 transition causes a reset
+ * (i.e., they advertise NoSoftRst-). However, this transition does not have
+ * any effect on the device: It continues to be operational and network ports
+ * remain up. Advertising this support makes it seem as if a PM reset is viable
+ * for these devices. Mark it as unavailable to skip it when testing reset
+ * methods.
+ */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcb84, quirk_no_pm_reset);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf6c, quirk_no_pm_reset);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf70, quirk_no_pm_reset);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset);
+
+/*
  * Thunderbolt controllers with broken MSI hotplug signaling:
  * Entire 1st generation (Light Ridge, Eagle Ridge, Light Peak) and part
  * of the 2nd generation (Cactus Ridge 4C up to revision 1, Port Ridge).

diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c
index fe909fd..ae94e1e 100644
--- a/drivers/phy/ti/phy-omap-usb2.c
+++ b/drivers/phy/ti/phy-omap-usb2.c

@@ -64,7 +64,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled)
 {
 	struct omap_usb *phy = phy_to_omapusb(otg->usb_phy);
 
-	if (!phy->comparator)
+	if (!phy->comparator || !phy->comparator->set_vbus)
 		return -ENODEV;
 
 	return phy->comparator->set_vbus(phy->comparator, enabled);
@@ -74,7 +74,7 @@ static int omap_usb_start_srp(struct usb_otg *otg)
 {
 	struct omap_usb *phy = phy_to_omapusb(otg->usb_phy);
 
-	if (!phy->comparator)
+	if (!phy->comparator || !phy->comparator->start_srp)
 		return -ENODEV;
 
 	return phy->comparator->start_srp(phy->comparator);

diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 43d8ed5..d8cee80 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c

@@ -160,13 +160,13 @@ static int vendor_resource_matches(struct pnp_dev *dev,
 static void pnpacpi_parse_allocated_vendor(struct pnp_dev *dev,
 				    struct acpi_resource_vendor_typed *vendor)
 {
-	if (vendor_resource_matches(dev, vendor, &hp_ccsr_uuid, 16)) {
-		u64 start, length;
+	struct { u64 start, length; } range;
 
-		memcpy(&start, vendor->byte_data, sizeof(start));
-		memcpy(&length, vendor->byte_data + 8, sizeof(length));
-
-		pnp_add_mem_resource(dev, start, start + length - 1, 0);
+	if (vendor_resource_matches(dev, vendor, &hp_ccsr_uuid,
+				    sizeof(range))) {
+		memcpy(&range, vendor->byte_data, sizeof(range));
+		pnp_add_mem_resource(dev, range.start, range.start +
+				     range.length - 1, 0);
 	}
 }
 

diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c
index d5e5229..d77a7ad 100644
--- a/drivers/reset/hisilicon/hi6220_reset.c
+++ b/drivers/reset/hisilicon/hi6220_reset.c

@@ -107,7 +107,7 @@ static int hi6220_reset_probe(struct platform_device *pdev)
 	if (!data)
 		return -ENOMEM;
 
-	type = (enum hi6220_reset_ctrl_type)of_device_get_match_data(dev);
+	type = (uintptr_t)of_device_get_match_data(dev);
 
 	regmap = syscon_node_to_regmap(np);
 	if (IS_ERR(regmap)) {

diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 82b8300..5aeb976 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c

@@ -389,6 +389,7 @@ static void virtio_rpmsg_release_device(struct device *dev)
 	struct rpmsg_device *rpdev = to_rpmsg_device(dev);
 	struct virtio_rpmsg_channel *vch = to_virtio_rpmsg_channel(rpdev);
 
+	kfree(rpdev->driver_override);
 	kfree(vch);
 }
 

diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
index 5c944ee..a37fd27 100644
--- a/drivers/s390/block/scm_blk.c
+++ b/drivers/s390/block/scm_blk.c

@@ -17,6 +17,7 @@
 #include <linux/genhd.h>
 #include <linux/slab.h>
 #include <linux/list.h>
+#include <linux/io.h>
 #include <asm/eadm.h>
 #include "scm_blk.h"
 
@@ -130,7 +131,7 @@ static void scm_request_done(struct scm_request *scmrq)
 
 	for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) {
 		msb = &scmrq->aob->msb[i];
-		aidaw = msb->data_addr;
+		aidaw = (u64)phys_to_virt(msb->data_addr);
 
 		if ((msb->flags & MSB_FLAG_IDA) && aidaw &&
 		    IS_ALIGNED(aidaw, PAGE_SIZE))
@@ -195,12 +196,12 @@ static int scm_request_prepare(struct scm_request *scmrq)
 	msb->scm_addr = scmdev->address + ((u64) blk_rq_pos(req) << 9);
 	msb->oc = (rq_data_dir(req) == READ) ? MSB_OC_READ : MSB_OC_WRITE;
 	msb->flags |= MSB_FLAG_IDA;
-	msb->data_addr = (u64) aidaw;
+	msb->data_addr = (u64)virt_to_phys(aidaw);
 
 	rq_for_each_segment(bv, req, iter) {
 		WARN_ON(bv.bv_offset);
 		msb->blk_count += bv.bv_len >> 12;
-		aidaw->data_addr = (u64) page_address(bv.bv_page);
+		aidaw->data_addr = virt_to_phys(page_address(bv.bv_page));
 		aidaw++;
 	}
 

diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 57826f7..1c8fa41 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c

@@ -330,17 +330,16 @@ static void fcoe_ctlr_announce(struct fcoe_ctlr *fip)
 {
 	struct fcoe_fcf *sel;
 	struct fcoe_fcf *fcf;
-	unsigned long flags;
 
 	mutex_lock(&fip->ctlr_mutex);
-	spin_lock_irqsave(&fip->ctlr_lock, flags);
+	spin_lock_bh(&fip->ctlr_lock);
 
 	kfree_skb(fip->flogi_req);
 	fip->flogi_req = NULL;
 	list_for_each_entry(fcf, &fip->fcfs, list)
 		fcf->flogi_sent = 0;
 
-	spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+	spin_unlock_bh(&fip->ctlr_lock);
 	sel = fip->sel_fcf;
 
 	if (sel && ether_addr_equal(sel->fcf_mac, fip->dest_addr))
@@ -710,7 +709,6 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
 {
 	struct fc_frame *fp;
 	struct fc_frame_header *fh;
-	unsigned long flags;
 	u16 old_xid;
 	u8 op;
 	u8 mac[ETH_ALEN];
@@ -744,11 +742,11 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
 		op = FIP_DT_FLOGI;
 		if (fip->mode == FIP_MODE_VN2VN)
 			break;
-		spin_lock_irqsave(&fip->ctlr_lock, flags);
+		spin_lock_bh(&fip->ctlr_lock);
 		kfree_skb(fip->flogi_req);
 		fip->flogi_req = skb;
 		fip->flogi_req_send = 1;
-		spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+		spin_unlock_bh(&fip->ctlr_lock);
 		schedule_work(&fip->timer_work);
 		return -EINPROGRESS;
 	case ELS_FDISC:
@@ -1725,11 +1723,10 @@ static int fcoe_ctlr_flogi_send_locked(struct fcoe_ctlr *fip)
 static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
 {
 	struct fcoe_fcf *fcf;
-	unsigned long flags;
 	int error;
 
 	mutex_lock(&fip->ctlr_mutex);
-	spin_lock_irqsave(&fip->ctlr_lock, flags);
+	spin_lock_bh(&fip->ctlr_lock);
 	LIBFCOE_FIP_DBG(fip, "re-sending FLOGI - reselect\n");
 	fcf = fcoe_ctlr_select(fip);
 	if (!fcf || fcf->flogi_sent) {
@@ -1740,7 +1737,7 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
 		fcoe_ctlr_solicit(fip, NULL);
 		error = fcoe_ctlr_flogi_send_locked(fip);
 	}
-	spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+	spin_unlock_bh(&fip->ctlr_lock);
 	mutex_unlock(&fip->ctlr_mutex);
 	return error;
 }
@@ -1757,9 +1754,8 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
 static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
 {
 	struct fcoe_fcf *fcf;
-	unsigned long flags;
 
-	spin_lock_irqsave(&fip->ctlr_lock, flags);
+	spin_lock_bh(&fip->ctlr_lock);
 	fcf = fip->sel_fcf;
 	if (!fcf || !fip->flogi_req_send)
 		goto unlock;
@@ -1786,7 +1782,7 @@ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
 	} else /* XXX */
 		LIBFCOE_FIP_DBG(fip, "No FCF selected - defer send\n");
 unlock:
-	spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+	spin_unlock_bh(&fip->ctlr_lock);
 }
 
 /**

diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
index 2f15170..13ecf55 100644
--- a/drivers/scsi/isci/request.c
+++ b/drivers/scsi/isci/request.c

@@ -3398,7 +3398,7 @@ static enum sci_status isci_io_request_build(struct isci_host *ihost,
 		return SCI_FAILURE;
 	}
 
-	return SCI_SUCCESS;
+	return status;
 }
 
 static struct isci_request *isci_request_from_tag(struct isci_host *ihost, u16 tag)

diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index 772c35a..72ceffc 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c

@@ -283,6 +283,11 @@ static int fc_fcp_send_abort(struct fc_fcp_pkt *fsp)
 	if (!fsp->seq_ptr)
 		return -EINVAL;
 
+	if (fsp->state & FC_SRB_ABORT_PENDING) {
+		FC_FCP_DBG(fsp, "abort already pending\n");
+		return -EBUSY;
+	}
+
 	per_cpu_ptr(fsp->lp->stats, get_cpu())->FcpPktAborts++;
 	put_cpu();
 
@@ -1693,7 +1698,7 @@ static void fc_fcp_rec_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 		if (fsp->recov_retry++ < FC_MAX_RECOV_RETRY)
 			fc_fcp_rec(fsp);
 		else
-			fc_fcp_recovery(fsp, FC_ERROR);
+			fc_fcp_recovery(fsp, FC_TIMED_OUT);
 		break;
 	}
 	fc_fcp_unlock_pkt(fsp);
@@ -1711,11 +1716,12 @@ static void fc_fcp_recovery(struct fc_fcp_pkt *fsp, u8 code)
 	fsp->status_code = code;
 	fsp->cdb_status = 0;
 	fsp->io_status = 0;
-	/*
-	 * if this fails then we let the scsi command timer fire and
-	 * scsi-ml escalate.
-	 */
-	fc_fcp_send_abort(fsp);
+	if (!fsp->cmd)
+		/*
+		 * Only abort non-scsi commands; otherwise let the
+		 * scsi command timer fire and scsi-ml escalate.
+		 */
+		fc_fcp_send_abort(fsp);
 }
 
 /**

diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 5fc41aa..97a2f6c 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h

@@ -31,6 +31,7 @@
 struct lpfc_sli2_slim;
 
 #define ELX_MODEL_NAME_SIZE	80
+#define ELX_FW_NAME_SIZE	84
 
 #define LPFC_PCI_DEV_LP		0x1
 #define LPFC_PCI_DEV_OC		0x2

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 3e9574e..0f95485 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c

@@ -11086,7 +11086,7 @@ lpfc_write_firmware(const struct firmware *fw, void *context)
 int
 lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade)
 {
-	uint8_t file_name[ELX_MODEL_NAME_SIZE];
+	char file_name[ELX_FW_NAME_SIZE] = {0};
 	int ret;
 	const struct firmware *fw;
 
@@ -11095,7 +11095,7 @@ lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade)
 	    LPFC_SLI_INTF_IF_TYPE_2)
 		return -EPERM;
 
-	snprintf(file_name, ELX_MODEL_NAME_SIZE, "%s.grp", phba->ModelName);
+	scnprintf(file_name, sizeof(file_name), "%s.grp", phba->ModelName);
 
 	if (fw_upgrade == INT_FW_UPGRADE) {
 		ret = request_firmware_nowait(THIS_MODULE, FW_ACTION_HOTPLUG,

diff --git a/drivers/spi/spi-ppc4xx.c b/drivers/spi/spi-ppc4xx.c
index 967d948..58765a6 100644
--- a/drivers/spi/spi-ppc4xx.c
+++ b/drivers/spi/spi-ppc4xx.c

@@ -173,10 +173,8 @@ static int spi_ppc4xx_setupxfer(struct spi_device *spi, struct spi_transfer *t)
 	int scr;
 	u8 cdm = 0;
 	u32 speed;
-	u8 bits_per_word;
 
 	/* Start with the generic configuration for this device. */
-	bits_per_word = spi->bits_per_word;
 	speed = spi->max_speed_hz;
 
 	/*
@@ -184,9 +182,6 @@ static int spi_ppc4xx_setupxfer(struct spi_device *spi, struct spi_transfer *t)
 	 * the transfer to overwrite the generic configuration with zeros.
 	 */
 	if (t) {
-		if (t->bits_per_word)
-			bits_per_word = t->bits_per_word;
-
 		if (t->speed_hz)
 			speed = min(t->speed_hz, spi->max_speed_hz);
 	}

diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 6d31001..344053d 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c

@@ -658,7 +658,7 @@ static void ad5933_work(struct work_struct *work)
 		struct ad5933_state, work.work);
 	struct iio_dev *indio_dev = i2c_get_clientdata(st->client);
 	__be16 buf[2];
-	int val[2];
+	u16 val[2];
 	unsigned char status;
 	int ret;
 

diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 7fccf69..6cfa6a9 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c

@@ -2215,7 +2215,7 @@ static int serial_imx_probe(struct platform_device *pdev)
 	/* For register access, we only need to enable the ipg clock. */
 	ret = clk_prepare_enable(sport->clk_ipg);
 	if (ret) {
-		dev_err(&pdev->dev, "failed to enable per clk: %d\n", ret);
+		dev_err(&pdev->dev, "failed to enable ipg clk: %d\n", ret);
 		return ret;
 	}
 

diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 73280d4..3afaab6 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c

@@ -29,6 +29,7 @@
 #include <linux/tty_flip.h>
 #include <linux/spi/spi.h>
 #include <linux/uaccess.h>
+#include <linux/units.h>
 #include <uapi/linux/sched/types.h>
 
 #define SC16IS7XX_NAME			"sc16is7xx"
@@ -1401,9 +1402,12 @@ static int sc16is7xx_spi_probe(struct spi_device *spi)
 
 	/* Setup SPI bus */
 	spi->bits_per_word	= 8;
-	/* only supports mode 0 on SC16IS762 */
+	/* For all variants, only mode 0 is supported */
+	if ((spi->mode & SPI_MODE_X_MASK) != SPI_MODE_0)
+		return dev_err_probe(&spi->dev, -EINVAL, "Unsupported SPI mode\n");
+
 	spi->mode		= spi->mode ? : SPI_MODE_0;
-	spi->max_speed_hz	= spi->max_speed_hz ? : 15000000;
+	spi->max_speed_hz	= spi->max_speed_hz ? : 4 * HZ_PER_MHZ;
 	ret = spi_setup(spi);
 	if (ret)
 		return ret;

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index be33a5c..3ebea63 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c

@@ -465,13 +465,13 @@ static int uio_open(struct inode *inode, struct file *filep)
 
 	mutex_lock(&minor_lock);
 	idev = idr_find(&uio_idr, iminor(inode));
-	mutex_unlock(&minor_lock);
 	if (!idev) {
 		ret = -ENODEV;
+		mutex_unlock(&minor_lock);
 		goto out;
 	}
-
 	get_device(&idev->dev);
+	mutex_unlock(&minor_lock);
 
 	if (!try_module_get(idev->owner)) {
 		ret = -ENODEV;
@@ -1020,9 +1020,8 @@ void uio_unregister_device(struct uio_info *info)
 	idev->info = NULL;
 	mutex_unlock(&idev->info_lock);
 
-	device_unregister(&idev->dev);
-
 	uio_free_minor(minor);
+	device_unregister(&idev->dev);
 
 	return;
 }

diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 4cacb91..a4880b1 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c

@@ -542,6 +542,13 @@ static irqreturn_t ci_irq_handler(int irq, void *data)
 	u32 otgsc = 0;
 
 	if (ci->in_lpm) {
+		/*
+		 * If we already have a wakeup irq pending there,
+		 * let's just return to wait resume finished firstly.
+		 */
+		if (ci->wakeup_int)
+			return IRQ_HANDLED;
+
 		disable_irq_nosync(irq);
 		ci->wakeup_int = true;
 		pm_runtime_get(ci->dev);

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index fb5604d..0f58962 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c

@@ -44,8 +44,8 @@
 #define USB_VENDOR_TEXAS_INSTRUMENTS		0x0451
 #define USB_PRODUCT_TUSB8041_USB3		0x8140
 #define USB_PRODUCT_TUSB8041_USB2		0x8142
-#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND	0x01
-#define HUB_QUIRK_DISABLE_AUTOSUSPEND		0x02
+#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND	BIT(0)
+#define HUB_QUIRK_DISABLE_AUTOSUSPEND		BIT(1)
 
 /* Protect struct usb_device->state and ->children members
  * Note: Both are also protected by ->dev.sem, except that ->state can
@@ -2309,17 +2309,25 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
 			}
 		} else if (desc->bLength == sizeof
 				(struct usb_otg_descriptor)) {
-			/* Set a_alt_hnp_support for legacy otg device */
-			err = usb_control_msg(udev,
-				usb_sndctrlpipe(udev, 0),
-				USB_REQ_SET_FEATURE, 0,
-				USB_DEVICE_A_ALT_HNP_SUPPORT,
-				0, NULL, 0,
-				USB_CTRL_SET_TIMEOUT);
-			if (err < 0)
-				dev_err(&udev->dev,
-					"set a_alt_hnp_support failed: %d\n",
-					err);
+			/*
+			 * We are operating on a legacy OTP device
+			 * These should be told that they are operating
+			 * on the wrong port if we have another port that does
+			 * support HNP
+			 */
+			if (bus->otg_port != 0) {
+				/* Set a_alt_hnp_support for legacy otg device */
+				err = usb_control_msg(udev,
+					usb_sndctrlpipe(udev, 0),
+					USB_REQ_SET_FEATURE, 0,
+					USB_DEVICE_A_ALT_HNP_SUPPORT,
+					0, NULL, 0,
+					USB_CTRL_SET_TIMEOUT);
+				if (err < 0)
+					dev_err(&udev->dev,
+						"set a_alt_hnp_support failed: %d\n",
+						err);
+			}
 		}
 	}
 #endif

diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 17bc5b9..f3f9fca 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c

@@ -246,7 +246,10 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
 		struct dwc3_request	*req;
 
 		req = next_request(&dep->pending_list);
-		dwc3_gadget_giveback(dep, req, -ECONNRESET);
+		if (!dwc->connected)
+			dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
+		else
+			dwc3_gadget_giveback(dep, req, -ECONNRESET);
 	}
 
 	dwc->ep0state = EP0_SETUP_PHASE;

diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index 6aee3cf..43bceee1 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c

@@ -576,21 +576,37 @@ static int start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
 
 static bool start_in_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
 {
+	int rc;
+
 	if (!fsg_is_set(common))
 		return false;
 	bh->state = BUF_STATE_SENDING;
-	if (start_transfer(common->fsg, common->fsg->bulk_in, bh->inreq))
+	rc = start_transfer(common->fsg, common->fsg->bulk_in, bh->inreq);
+	if (rc) {
 		bh->state = BUF_STATE_EMPTY;
+		if (rc == -ESHUTDOWN) {
+			common->running = 0;
+			return false;
+		}
+	}
 	return true;
 }
 
 static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
 {
+	int rc;
+
 	if (!fsg_is_set(common))
 		return false;
 	bh->state = BUF_STATE_RECEIVING;
-	if (start_transfer(common->fsg, common->fsg->bulk_out, bh->outreq))
+	rc = start_transfer(common->fsg, common->fsg->bulk_out, bh->outreq);
+	if (rc) {
 		bh->state = BUF_STATE_FULL;
+		if (rc == -ESHUTDOWN) {
+			common->running = 0;
+			return false;
+		}
+	}
 	return true;
 }
 

diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index a6da9b7..21b184d 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c

@@ -1246,14 +1246,19 @@ static int mon_bin_vma_fault(struct vm_fault *vmf)
 	struct mon_reader_bin *rp = vmf->vma->vm_private_data;
 	unsigned long offset, chunk_idx;
 	struct page *pageptr;
+	unsigned long flags;
 
+	spin_lock_irqsave(&rp->b_lock, flags);
 	offset = vmf->pgoff << PAGE_SHIFT;
-	if (offset >= rp->b_size)
+	if (offset >= rp->b_size) {
+		spin_unlock_irqrestore(&rp->b_lock, flags);
 		return VM_FAULT_SIGBUS;
+	}
 	chunk_idx = offset / CHUNK_SIZE;
 	pageptr = rp->b_vec[chunk_idx].pg;
 	get_page(pageptr);
 	vmf->page = pageptr;
+	spin_unlock_irqrestore(&rp->b_lock, flags);
 	return 0;
 }
 

diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index 6e462a8..bbfdd92 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c

@@ -303,8 +303,7 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect)
 
 static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy)
 {
-	return IS_ENABLED(CONFIG_USB_OTG) &&
-		mxs_phy->phy.last_event == USB_EVENT_ID;
+	return mxs_phy->phy.last_event == USB_EVENT_ID;
 }
 
 static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index df524ce..4158432 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c

@@ -150,6 +150,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
 	{ USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
 	{ USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+	{ USB_DEVICE(0x10C4, 0x87ED) }, /* IMST USB-Stick for Smart Meter */
 	{ USB_DEVICE(0x10C4, 0x8856) },	/* CEL EM357 ZigBee USB Stick - LR */
 	{ USB_DEVICE(0x10C4, 0x8857) },	/* CEL EM357 ZigBee USB Stick */
 	{ USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 902bbe5..8744d91 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c

@@ -2271,6 +2271,7 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) },			/* Fibocom FM160 (MBIM mode) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) },			/* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) },			/* Fibocom FM101-GL (laptop MBIM) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) },			/* Fibocom FM101-GL (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff),			/* Fibocom FM101-GL (laptop MBIM) */
 	  .driver_info = RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) },			/* LongSung M5710 */

diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 6ea6cbb..03dc869 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c

@@ -188,6 +188,8 @@ static const struct usb_device_id id_table[] = {
 	{DEVICE_SWI(0x413c, 0x81d0)},   /* Dell Wireless 5819 */
 	{DEVICE_SWI(0x413c, 0x81d1)},   /* Dell Wireless 5818 */
 	{DEVICE_SWI(0x413c, 0x81d2)},   /* Dell Wireless 5818 */
+	{DEVICE_SWI(0x413c, 0x8217)},	/* Dell Wireless DW5826e */
+	{DEVICE_SWI(0x413c, 0x8218)},	/* Dell Wireless DW5826e QDL */
 
 	/* Huawei devices */
 	{DEVICE_HWI(0x03f0, 0x581d)},	/* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index c60c860..3fe32d3 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c

@@ -2489,12 +2489,11 @@ EXPORT_SYMBOL_GPL(vhost_disable_notify);
 /* Create a new message. */
 struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type)
 {
-	struct vhost_msg_node *node = kmalloc(sizeof *node, GFP_KERNEL);
+	/* Make sure all padding within the structure is initialized. */
+	struct vhost_msg_node *node = kzalloc(sizeof(*node), GFP_KERNEL);
 	if (!node)
 		return NULL;
 
-	/* Make sure all padding within the structure is initialized. */
-	memset(&node->msg, 0, sizeof node->msg);
 	node->vq = vq;
 	node->msg.type = type;
 	return node;

diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c
index 487d5e3..3697213 100644
--- a/drivers/video/fbdev/core/fb_defio.c
+++ b/drivers/video/fbdev/core/fb_defio.c

@@ -78,11 +78,7 @@ int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int datasy
 		return 0;
 
 	inode_lock(inode);
-	/* Kill off the delayed work */
-	cancel_delayed_work_sync(&info->deferred_work);
-
-	/* Run it immediately */
-	schedule_delayed_work(&info->deferred_work, 0);
+	flush_delayed_work(&info->deferred_work);
 	inode_unlock(inode);
 
 	return 0;

diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index adb6991..4e653e7 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c

@@ -44,6 +44,7 @@
 
 #define SECS_TO_WDOG_TICKS(x) ((x) << 16)
 #define WDOG_TICKS_TO_SECS(x) ((x) >> 16)
+#define WDOG_TICKS_TO_MSECS(x) ((x) * 1000 >> 16)
 
 struct bcm2835_wdt {
 	void __iomem		*base;
@@ -140,7 +141,7 @@ static struct watchdog_device bcm2835_wdt_wdd = {
 	.info =		&bcm2835_wdt_info,
 	.ops =		&bcm2835_wdt_ops,
 	.min_timeout =	1,
-	.max_timeout =	WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET),
+	.max_hw_heartbeat_ms =	WDOG_TICKS_TO_MSECS(PM_WDOG_TIME_SET),
 	.timeout =	WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET),
 };
 

diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
index 337ca36..d26fb901 100644
--- a/drivers/watchdog/watchdog_dev.c
+++ b/drivers/watchdog/watchdog_dev.c

@@ -956,6 +956,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
 
 	/* Fill in the data structures */
 	cdev_init(&wd_data->cdev, &watchdog_fops);
+	wd_data->cdev.owner = wdd->ops->owner;
 
 	/* Add the device */
 	err = cdev_device_add(&wd_data->cdev, &wd_data->dev);
@@ -970,8 +971,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
 		return err;
 	}
 
-	wd_data->cdev.owner = wdd->ops->owner;
-
 	/* Record time of most recent heartbeat as 'just before now'. */
 	wd_data->last_hw_keepalive = jiffies - 1;
 

diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index deb01e5..6741710 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c

@@ -2070,7 +2070,8 @@ static int btrfs_issue_discard(struct block_device *bdev, u64 start, u64 len,
 	u64 bytes_left, end;
 	u64 aligned_start = ALIGN(start, 1 << 9);
 
-	if (WARN_ON(start != aligned_start)) {
+	/* Adjust the range to be aligned to 512B sectors if necessary. */
+	if (start != aligned_start) {
 		len -= aligned_start - start;
 		len = round_down(len, 1 << 9);
 		start = aligned_start;

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 93b83dc..c8bc8cf 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c

@@ -2668,6 +2668,10 @@ static int btrfs_ioctl_defrag(struct file *file, void __user *argp)
 				kfree(range);
 				goto out;
 			}
+			if (range->flags & ~BTRFS_DEFRAG_RANGE_FLAGS_SUPP) {
+				ret = -EOPNOTSUPP;
+				goto out;
+			}
 			/* compression requires us to start the IO */
 			if ((range->flags & BTRFS_DEFRAG_RANGE_COMPRESS)) {
 				range->flags |= BTRFS_DEFRAG_RANGE_START_IO;

diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index f2cb7fe..fa9797f 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c

@@ -6662,7 +6662,7 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
 	}
 
 	if (arg->flags & ~BTRFS_SEND_FLAG_MASK) {
-		ret = -EINVAL;
+		ret = -EOPNOTSUPP;
 		goto out;
 	}
 

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index e36786f..b84ce90 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c

@@ -4026,12 +4026,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry,
 			       struct inode *dir,
 			       int mds, int drop, int unless)
 {
-	struct dentry *parent = NULL;
 	struct ceph_mds_request_release *rel = *p;
 	struct ceph_dentry_info *di = ceph_dentry(dentry);
 	int force = 0;
 	int ret;
 
+	/* This shouldn't happen */
+	BUG_ON(!dir);
+
 	/*
 	 * force an record for the directory caps if we have a dentry lease.
 	 * this is racy (can't take i_ceph_lock and d_lock together), but it
@@ -4041,14 +4043,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry,
 	spin_lock(&dentry->d_lock);
 	if (di->lease_session && di->lease_session->s_mds == mds)
 		force = 1;
-	if (!dir) {
-		parent = dget(dentry->d_parent);
-		dir = d_inode(parent);
-	}
 	spin_unlock(&dentry->d_lock);
 
 	ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force);
-	dput(parent);
 
 	spin_lock(&dentry->d_lock);
 	if (ret && di->lease_session && di->lease_session->s_mds == mds) {

diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index f445bc9..74e8507 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c

@@ -1546,8 +1546,7 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd,
 	if (!f.file)
 		goto out;
 
-	/* RED-PEN how should LSM module know it's handling 32bit? */
-	error = security_file_ioctl(f.file, cmd, arg);
+	error = security_file_ioctl_compat(f.file, cmd, arg);
 	if (error)
 		goto out_fput;
 

diff --git a/fs/dcache.c b/fs/dcache.c
index 2f01b27..896ee03 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c

@@ -695,12 +695,12 @@ static inline bool fast_dput(struct dentry *dentry)
 	 */
 	if (unlikely(ret < 0)) {
 		spin_lock(&dentry->d_lock);
-		if (dentry->d_lockref.count > 1) {
-			dentry->d_lockref.count--;
+		if (WARN_ON_ONCE(dentry->d_lockref.count <= 0)) {
 			spin_unlock(&dentry->d_lock);
 			return 1;
 		}
-		return 0;
+		dentry->d_lockref.count--;
+		goto locked;
 	}
 
 	/*
@@ -751,6 +751,7 @@ static inline bool fast_dput(struct dentry *dentry)
 	 * else could have killed it and marked it dead. Either way, we
 	 * don't need to do anything else.
 	 */
+locked:
 	if (dentry->d_lockref.count) {
 		spin_unlock(&dentry->d_lock);
 		return 1;

diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index ced39d4..229f00c 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c

@@ -627,6 +627,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
 		goto out;
 	o_end = o_start + len;
 
+	*moved_len = 0;
 	while (o_start < o_end) {
 		struct ext4_extent *ex;
 		ext4_lblk_t cur_blk, next_blk;
@@ -682,7 +683,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
 		 */
 		ext4_double_up_write_data_sem(orig_inode, donor_inode);
 		/* Swap original branches with new branches */
-		move_extent_per_page(o_filp, donor_inode,
+		*moved_len += move_extent_per_page(o_filp, donor_inode,
 				     orig_page_index, donor_page_index,
 				     offset_in_page, cur_len,
 				     unwritten, &ret);
@@ -692,9 +693,6 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
 		o_start += cur_len;
 		d_start += cur_len;
 	}
-	*moved_len = o_start - orig_blk;
-	if (*moved_len > len)
-		*moved_len = len;
 
 out:
 	if (*moved_len) {

diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index f0b27be..47ecf08 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c

@@ -237,7 +237,7 @@ struct ext4_new_flex_group_data {
  *
  * Returns NULL on failure otherwise address of the allocated structure.
  */
-static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
+static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)
 {
 	struct ext4_new_flex_group_data *flex_gd;
 
@@ -290,7 +290,7 @@ static void free_flex_gd(struct ext4_new_flex_group_data *flex_gd)
  */
 static int ext4_alloc_group_tables(struct super_block *sb,
 				struct ext4_new_flex_group_data *flex_gd,
-				int flexbg_size)
+				unsigned int flexbg_size)
 {
 	struct ext4_new_group_data *group_data = flex_gd->groups;
 	ext4_fsblk_t start_blk;
@@ -383,12 +383,12 @@ static int ext4_alloc_group_tables(struct super_block *sb,
 		group = group_data[0].group;
 
 		printk(KERN_DEBUG "EXT4-fs: adding a flex group with "
-		       "%d groups, flexbg size is %d:\n", flex_gd->count,
+		       "%u groups, flexbg size is %u:\n", flex_gd->count,
 		       flexbg_size);
 
 		for (i = 0; i < flex_gd->count; i++) {
 			printk(KERN_DEBUG "adding %s group %u: %u "
-			       "blocks (%d free)\n",
+			       "blocks (%u free)\n",
 			       ext4_bg_has_super(sb, group + i) ? "normal" :
 			       "no-super", group + i,
 			       group_data[i].blocks_count,
@@ -1558,7 +1558,7 @@ static int ext4_flex_group_add(struct super_block *sb,
 static int ext4_setup_next_flex_gd(struct super_block *sb,
 				    struct ext4_new_flex_group_data *flex_gd,
 				    ext4_fsblk_t n_blocks_count,
-				    unsigned long flexbg_size)
+				    unsigned int flexbg_size)
 {
 	struct ext4_super_block *es = EXT4_SB(sb)->s_es;
 	struct ext4_new_group_data *group_data = flex_gd->groups;
@@ -1935,8 +1935,9 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
 	ext4_fsblk_t o_blocks_count;
 	ext4_fsblk_t n_blocks_count_retry = 0;
 	unsigned long last_update_time = 0;
-	int err = 0, flexbg_size = 1 << sbi->s_log_groups_per_flex;
+	int err = 0;
 	int meta_bg;
+	unsigned int flexbg_size = ext4_flex_bg_size(sbi);
 
 	/* See if the device is actually as big as what was requested */
 	bh = sb_bread(sb, n_blocks_count - 1);

diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 2114528..47da00e 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c

@@ -1039,7 +1039,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
 	}
 
 	if (old_dir_entry) {
-		if (old_dir != new_dir && !whiteout)
+		if (old_dir != new_dir)
 			f2fs_set_link(old_inode, old_dir_entry,
 						old_dir_page, new_dir);
 		else

diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
index 1afe078..59b807f 100644
--- a/fs/f2fs/xattr.c
+++ b/fs/f2fs/xattr.c

@@ -739,6 +739,12 @@ static int __f2fs_setxattr(struct inode *inode, int index,
 		memcpy(pval, value, size);
 		last->e_value_size = cpu_to_le16(size);
 		new_hsize += newsize;
+		/*
+		 * Explicitly add the null terminator.  The unused xattr space
+		 * is supposed to always be zeroed, which would make this
+		 * unnecessary, but don't depend on that.
+		 */
+		*(u32 *)((u8 *)last + newsize) = 0;
 	}
 
 	error = write_all_xattrs(inode, new_hsize, base_addr, ipage);

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 7e8caab..6b4fe9d 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c

@@ -1346,8 +1346,16 @@ static int fuse_direntplus_link(struct file *file,
 			dput(dentry);
 			dentry = alias;
 		}
-		if (IS_ERR(dentry))
+		if (IS_ERR(dentry)) {
+			if (!IS_ERR(inode)) {
+				struct fuse_inode *fi = get_fuse_inode(inode);
+
+				spin_lock(&fc->lock);
+				fi->nlookup--;
+				spin_unlock(&fc->lock);
+			}
 			return PTR_ERR(dentry);
+		}
 	}
 	if (fc->readdirplus_auto)
 		set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state);

diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 93a466c..ee114f0 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c

@@ -1361,9 +1361,11 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)
 		return -EIO;
 	}
 
-	trace_jbd2_write_superblock(journal, write_flags);
 	if (!(journal->j_flags & JBD2_BARRIER))
 		write_flags &= ~(REQ_FUA | REQ_PREFLUSH);
+
+	trace_jbd2_write_superblock(journal, write_flags);
+
 	if (buffer_write_io_error(bh)) {
 		/*
 		 * Oh, dear.  A previous attempt to write the journal

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index ed7989d..6c6efb5 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c

@@ -76,10 +76,10 @@
  */
 static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
 			int nblocks);
-static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval);
-static int dbBackSplit(dmtree_t * tp, int leafno);
-static int dbJoin(dmtree_t * tp, int leafno, int newval);
-static void dbAdjTree(dmtree_t * tp, int leafno, int newval);
+static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl);
+static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl);
+static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl);
+static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl);
 static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc,
 		    int level);
 static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results);
@@ -2184,7 +2184,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno,
 		 * system.
 		 */
 		if (dp->tree.stree[word] == NOFREE)
-			dbBackSplit((dmtree_t *) & dp->tree, word);
+			dbBackSplit((dmtree_t *)&dp->tree, word, false);
 
 		dbAllocBits(bmp, dp, blkno, nblocks);
 	}
@@ -2270,7 +2270,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
 			 * the binary system of the leaves if need be.
 			 */
 			dbSplit(tp, word, BUDMIN,
-				dbMaxBud((u8 *) & dp->wmap[word]));
+				dbMaxBud((u8 *)&dp->wmap[word]), false);
 
 			word += 1;
 		} else {
@@ -2310,7 +2310,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
 				 * system of the leaves to reflect the current
 				 * allocation (size).
 				 */
-				dbSplit(tp, word, size, NOFREE);
+				dbSplit(tp, word, size, NOFREE, false);
 
 				/* get the number of dmap words handled */
 				nw = BUDSIZE(size, BUDMIN);
@@ -2417,7 +2417,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
 			/* update the leaf for this dmap word.
 			 */
 			rc = dbJoin(tp, word,
-				    dbMaxBud((u8 *) & dp->wmap[word]));
+				    dbMaxBud((u8 *)&dp->wmap[word]), false);
 			if (rc)
 				return rc;
 
@@ -2450,7 +2450,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
 
 				/* update the leaf.
 				 */
-				rc = dbJoin(tp, word, size);
+				rc = dbJoin(tp, word, size, false);
 				if (rc)
 					return rc;
 
@@ -2602,14 +2602,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
 		 * that it is at the front of a binary buddy system.
 		 */
 		if (oldval == NOFREE) {
-			rc = dbBackSplit((dmtree_t *) dcp, leafno);
+			rc = dbBackSplit((dmtree_t *)dcp, leafno, true);
 			if (rc)
 				return rc;
 			oldval = dcp->stree[ti];
 		}
-		dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval);
+		dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true);
 	} else {
-		rc = dbJoin((dmtree_t *) dcp, leafno, newval);
+		rc = dbJoin((dmtree_t *) dcp, leafno, newval, true);
 		if (rc)
 			return rc;
 	}
@@ -2638,7 +2638,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
 				 */
 				if (alloc) {
 					dbJoin((dmtree_t *) dcp, leafno,
-					       oldval);
+					       oldval, true);
 				} else {
 					/* the dbJoin() above might have
 					 * caused a larger binary buddy system
@@ -2648,9 +2648,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
 					 */
 					if (dcp->stree[ti] == NOFREE)
 						dbBackSplit((dmtree_t *)
-							    dcp, leafno);
+							    dcp, leafno, true);
 					dbSplit((dmtree_t *) dcp, leafno,
-						dcp->budmin, oldval);
+						dcp->budmin, oldval, true);
 				}
 
 				/* release the buffer and return the error.
@@ -2698,7 +2698,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
  *
  * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit;
  */
-static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
+static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl)
 {
 	int budsz;
 	int cursz;
@@ -2720,7 +2720,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
 		while (cursz >= splitsz) {
 			/* update the buddy's leaf with its new value.
 			 */
-			dbAdjTree(tp, leafno ^ budsz, cursz);
+			dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl);
 
 			/* on to the next size and buddy.
 			 */
@@ -2732,7 +2732,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
 	/* adjust the dmap tree to reflect the specified leaf's new
 	 * value.
 	 */
-	dbAdjTree(tp, leafno, newval);
+	dbAdjTree(tp, leafno, newval, is_ctl);
 }
 
 
@@ -2763,7 +2763,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
  *
  * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit;
  */
-static int dbBackSplit(dmtree_t * tp, int leafno)
+static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl)
 {
 	int budsz, bud, w, bsz, size;
 	int cursz;
@@ -2814,7 +2814,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno)
 				 * system in two.
 				 */
 				cursz = leaf[bud] - 1;
-				dbSplit(tp, bud, cursz, cursz);
+				dbSplit(tp, bud, cursz, cursz, is_ctl);
 				break;
 			}
 		}
@@ -2842,7 +2842,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno)
  *
  * RETURN VALUES: none
  */
-static int dbJoin(dmtree_t * tp, int leafno, int newval)
+static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)
 {
 	int budsz, buddy;
 	s8 *leaf;
@@ -2897,12 +2897,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)
 			if (leafno < buddy) {
 				/* leafno is the left buddy.
 				 */
-				dbAdjTree(tp, buddy, NOFREE);
+				dbAdjTree(tp, buddy, NOFREE, is_ctl);
 			} else {
 				/* buddy is the left buddy and becomes
 				 * leafno.
 				 */
-				dbAdjTree(tp, leafno, NOFREE);
+				dbAdjTree(tp, leafno, NOFREE, is_ctl);
 				leafno = buddy;
 			}
 
@@ -2915,7 +2915,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)
 
 	/* update the leaf value.
 	 */
-	dbAdjTree(tp, leafno, newval);
+	dbAdjTree(tp, leafno, newval, is_ctl);
 
 	return 0;
 }
@@ -2936,15 +2936,20 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)
  *
  * RETURN VALUES: none
  */
-static void dbAdjTree(dmtree_t * tp, int leafno, int newval)
+static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl)
 {
 	int lp, pp, k;
-	int max;
+	int max, size;
+
+	size = is_ctl ? CTLTREESIZE : TREESIZE;
 
 	/* pick up the index of the leaf for this leafno.
 	 */
 	lp = leafno + le32_to_cpu(tp->dmt_leafidx);
 
+	if (WARN_ON_ONCE(lp >= size || lp < 0))
+		return;
+
 	/* is the current value the same as the old value ?  if so,
 	 * there is nothing to do.
 	 */

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index de2bcb3..14a16bb 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c

@@ -645,6 +645,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
 		for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) {
 			index = base + (lim >> 1);
 
+			if (stbl[index] < 0) {
+				rc = -EIO;
+				goto out;
+			}
+
 			if (p->header.flag & BT_LEAF) {
 				/* uppercase leaf name to compare */
 				cmp =
@@ -1982,7 +1987,7 @@ static int dtSplitRoot(tid_t tid,
 		do {
 			f = &rp->slot[fsi];
 			fsi = f->next;
-		} while (fsi != -1);
+		} while (fsi >= 0);
 
 		f->next = n;
 	}

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 131dce5..5cdcf68 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c

@@ -2200,6 +2200,9 @@ static int diNewExt(struct inomap * imap, struct iag * iagp, int extno)
 	/* get the ag and iag numbers for this iag.
 	 */
 	agno = BLKTOAG(le64_to_cpu(iagp->agstart), sbi);
+	if (agno >= MAXAG || agno < 0)
+		return -EIO;
+
 	iagno = le32_to_cpu(iagp->iagnum);
 
 	/* check if this is the last free extent within the

diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
index f1a705d..97d91c1 100644
--- a/fs/jfs/jfs_mount.c
+++ b/fs/jfs/jfs_mount.c

@@ -184,15 +184,15 @@ int jfs_mount(struct super_block *sb)
 	}
 	jfs_info("jfs_mount: ipimap:0x%p", ipimap);
 
-	/* map further access of per fileset inodes by the fileset inode */
-	sbi->ipimap = ipimap;
-
 	/* initialize fileset inode allocation map */
 	if ((rc = diMount(ipimap))) {
 		jfs_err("jfs_mount: diMount failed w/rc = %d", rc);
 		goto err_ipimap;
 	}
 
+	/* map further access of per fileset inodes by the fileset inode */
+	sbi->ipimap = ipimap;
+
 	return rc;
 
 	/*

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ff41d72..77c207a 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c

@@ -161,6 +161,7 @@ static int nfs4_map_errors(int err)
 	case -NFS4ERR_RESOURCE:
 	case -NFS4ERR_LAYOUTTRYLATER:
 	case -NFS4ERR_RECALLCONFLICT:
+	case -NFS4ERR_RETURNCONFLICT:
 		return -EREMOTEIO;
 	case -NFS4ERR_WRONGSEC:
 	case -NFS4ERR_WRONG_CRED:
@@ -472,6 +473,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server,
 		case -NFS4ERR_GRACE:
 		case -NFS4ERR_LAYOUTTRYLATER:
 		case -NFS4ERR_RECALLCONFLICT:
+		case -NFS4ERR_RETURNCONFLICT:
 			exception->delay = 1;
 			return 0;
 
@@ -8540,6 +8542,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
 		status = -EBUSY;
 		break;
 	case -NFS4ERR_RECALLCONFLICT:
+	case -NFS4ERR_RETURNCONFLICT:
 		status = -ERECALLCONFLICT;
 		break;
 	case -NFS4ERR_DELEG_REVOKED:

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 2adbf47..6720c82 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c

@@ -6351,12 +6351,16 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp,
 		if (sop->so_is_open_owner || !same_owner_str(sop, owner))
 			continue;
 
-		if (atomic_read(&sop->so_count) != 1) {
-			spin_unlock(&clp->cl_lock);
-			return nfserr_locks_held;
+		/* see if there are still any locks associated with it */
+		lo = lockowner(sop);
+		list_for_each_entry(stp, &sop->so_stateids, st_perstateowner) {
+			if (check_for_locks(stp->st_stid.sc_file, lo)) {
+				status = nfserr_locks_held;
+				spin_unlock(&clp->cl_lock);
+				return status;
+			}
 		}
 
-		lo = lockowner(sop);
 		nfs4_get_stateowner(sop);
 		break;
 	}

diff --git a/fs/nilfs2/file.c b/fs/nilfs2/file.c
index c5fa3de..43501da 100644
--- a/fs/nilfs2/file.c
+++ b/fs/nilfs2/file.c

@@ -114,7 +114,13 @@ static int nilfs_page_mkwrite(struct vm_fault *vmf)
 	nilfs_transaction_commit(inode->i_sb);
 
  mapped:
-	wait_for_stable_page(page);
+	/*
+	 * Since checksumming including data blocks is performed to determine
+	 * the validity of the log to be written and used for recovery, it is
+	 * necessary to wait for writeback to finish here, regardless of the
+	 * stable write requirement of the backing device.
+	 */
+	wait_on_page_writeback(page);
  out:
 	sb_end_pagefault(inode->i_sb);
 	return block_page_mkwrite_return(ret);

diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index 5139efe..cff5973 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c

@@ -481,9 +481,10 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs,
 
 static int nilfs_recovery_copy_block(struct the_nilfs *nilfs,
 				     struct nilfs_recovery_block *rb,
-				     struct page *page)
+				     loff_t pos, struct page *page)
 {
 	struct buffer_head *bh_org;
+	size_t from = pos & ~PAGE_MASK;
 	void *kaddr;
 
 	bh_org = __bread(nilfs->ns_bdev, rb->blocknr, nilfs->ns_blocksize);
@@ -491,7 +492,7 @@ static int nilfs_recovery_copy_block(struct the_nilfs *nilfs,
 		return -EIO;
 
 	kaddr = kmap_atomic(page);
-	memcpy(kaddr + bh_offset(bh_org), bh_org->b_data, bh_org->b_size);
+	memcpy(kaddr + from, bh_org->b_data, bh_org->b_size);
 	kunmap_atomic(kaddr);
 	brelse(bh_org);
 	return 0;
@@ -530,7 +531,7 @@ static int nilfs_recover_dsync_blocks(struct the_nilfs *nilfs,
 			goto failed_inode;
 		}
 
-		err = nilfs_recovery_copy_block(nilfs, rb, page);
+		err = nilfs_recovery_copy_block(nilfs, rb, pos, page);
 		if (unlikely(err))
 			goto failed_page;
 

diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index d3a9dc9..d918b9d 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c

@@ -1711,7 +1711,6 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
 
 		list_for_each_entry(bh, &segbuf->sb_payload_buffers,
 				    b_assoc_buffers) {
-			set_buffer_async_write(bh);
 			if (bh == segbuf->sb_super_root) {
 				if (bh->b_page != bd_page) {
 					lock_page(bd_page);
@@ -1722,6 +1721,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
 				}
 				break;
 			}
+			set_buffer_async_write(bh);
 			if (bh->b_page != fs_page) {
 				nilfs_begin_page_io(fs_page);
 				fs_page = bh->b_page;
@@ -1807,7 +1807,6 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
 
 		list_for_each_entry(bh, &segbuf->sb_payload_buffers,
 				    b_assoc_buffers) {
-			clear_buffer_async_write(bh);
 			if (bh == segbuf->sb_super_root) {
 				clear_buffer_uptodate(bh);
 				if (bh->b_page != bd_page) {
@@ -1816,6 +1815,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
 				}
 				break;
 			}
+			clear_buffer_async_write(bh);
 			if (bh->b_page != fs_page) {
 				nilfs_end_page_io(fs_page, err);
 				fs_page = bh->b_page;
@@ -1903,8 +1903,9 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
 				 BIT(BH_Delay) | BIT(BH_NILFS_Volatile) |
 				 BIT(BH_NILFS_Redirected));
 
-			set_mask_bits(&bh->b_state, clear_bits, set_bits);
 			if (bh == segbuf->sb_super_root) {
+				set_buffer_uptodate(bh);
+				clear_buffer_dirty(bh);
 				if (bh->b_page != bd_page) {
 					end_page_writeback(bd_page);
 					bd_page = bh->b_page;
@@ -1912,6 +1913,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
 				update_sr = true;
 				break;
 			}
+			set_mask_bits(&bh->b_state, clear_bits, set_bits);
 			if (bh->b_page != fs_page) {
 				nilfs_end_page_io(fs_page, 0);
 				fs_page = bh->b_page;

diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
index c476d88..66e55bc 100644
--- a/fs/pstore/ram.c
+++ b/fs/pstore/ram.c

@@ -586,6 +586,7 @@ static int ramoops_init_przs(const char *name,
 	}
 
 	zone_sz = mem_sz / *cnt;
+	zone_sz = ALIGN_DOWN(zone_sz, 2);
 	if (!zone_sz) {
 		dev_err(dev, "%s zone size == 0\n", name);
 		goto fail;

diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
index 58ac4e1..a323ed9 100644
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c

@@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz,
 {
 	int numerr;
 	struct persistent_ram_buffer *buffer = prz->buffer;
-	int ecc_blocks;
+	size_t ecc_blocks;
 	size_t ecc_total;
 
 	if (!ecc_info || !ecc_info->ecc_size)

diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index 2ea6a95..f803dc8 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h

@@ -146,6 +146,7 @@ struct af_alg_async_req {
  * @enc:		Cryptographic operation to be performed when
  *			recvmsg is invoked.
  * @len:		Length of memory allocated for this data structure.
+ * @inflight:		Non-zero when AIO requests are in flight.
  */
 struct af_alg_ctx {
 	struct list_head tsgl_list;
@@ -163,6 +164,8 @@ struct af_alg_ctx {
 	bool enc;
 
 	unsigned int len;
+
+	unsigned int inflight;
 };
 
 int af_alg_register_type(const struct af_alg_type *type);

diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h
index 6522d4cb..bfbd38c 100644
--- a/include/drm/drm_bridge.h
+++ b/include/drm/drm_bridge.h

@@ -161,7 +161,7 @@ struct drm_bridge_funcs {
 	 * or &drm_encoder_helper_funcs.dpms hook.
 	 *
 	 * The bridge must assume that the display pipe (i.e. clocks and timing
-	 * singals) feeding it is no longer running when this callback is
+	 * signals) feeding it is no longer running when this callback is
 	 * called.
 	 *
 	 * The post_disable callback is optional.

diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h
index 689f615..a059f1d 100644
--- a/include/drm/drm_mipi_dsi.h
+++ b/include/drm/drm_mipi_dsi.h

@@ -163,6 +163,7 @@ struct mipi_dsi_device_info {
  * struct mipi_dsi_device - DSI peripheral device
  * @host: DSI host for this peripheral
  * @dev: driver model device node for this peripheral
+ * @attached: the DSI device has been successfully attached
  * @name: DSI peripheral chip type
  * @channel: virtual channel assigned to the peripheral
  * @format: pixel format for video mode
@@ -172,6 +173,7 @@ struct mipi_dsi_device_info {
 struct mipi_dsi_device {
 	struct mipi_dsi_host *host;
 	struct device dev;
+	bool attached;
 
 	char name[DSI_DEV_NAME_SIZE];
 	unsigned int channel;

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 0863a22..88b24b9 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h

@@ -39,7 +39,11 @@ struct bpf_map_ops {
 	/* funcs called by prog_array and perf_event_array map */
 	void *(*map_fd_get_ptr)(struct bpf_map *map, struct file *map_file,
 				int fd);
-	void (*map_fd_put_ptr)(void *ptr);
+	/* If need_defer is true, the implementation should guarantee that
+	 * the to-be-put element is still alive before the bpf program, which
+	 * may manipulate it, exists.
+	 */
+	void (*map_fd_put_ptr)(struct bpf_map *map, void *ptr, bool need_defer);
 	u32 (*map_gen_lookup)(struct bpf_map *map, struct bpf_insn *insn_buf);
 	u32 (*map_fd_sys_lookup_elem)(void *ptr);
 };

diff --git a/include/linux/device.h b/include/linux/device.h
index 6c14dcd..4c89f7c 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h

@@ -1484,6 +1484,9 @@ do {									\
 	WARN_ONCE(condition, "%s %s: " format, \
 			dev_driver_string(dev), dev_name(dev), ## arg)
 
+extern __printf(3, 4)
+int dev_err_probe(const struct device *dev, int err, const char *fmt, ...);
+
 /* Create alias, so I can be autoloaded. */
 #define MODULE_ALIAS_CHARDEV(major,minor) \
 	MODULE_ALIAS("char-major-" __stringify(major) "-" __stringify(minor))

diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 8089e28..d5a7d32 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h

@@ -816,7 +816,8 @@ static inline int dmaengine_slave_config(struct dma_chan *chan,
 
 static inline bool is_slave_direction(enum dma_transfer_direction direction)
 {
-	return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM);
+	return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM) ||
+	       (direction == DMA_DEV_TO_DEV);
 }
 
 static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single(

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index ecf1510..1db7dde 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h

@@ -466,6 +466,12 @@
  *	simple integer value.  When @arg represents a user space pointer, it
  *	should never be used by the security module.
  *	Return 0 if permission is granted.
+ * @file_ioctl_compat:
+ *	@file contains the file structure.
+ *	@cmd contains the operation to perform.
+ *	@arg contains the operational arguments.
+ *	Check permission for a compat ioctl operation on @file.
+ *	Return 0 if permission is granted.
  * @mmap_addr :
  *	Check permissions for a mmap operation at @addr.
  *	@addr contains virtual address that will be used for the operation.
@@ -1520,6 +1526,8 @@ union security_list_options {
 	void (*file_free_security)(struct file *file);
 	int (*file_ioctl)(struct file *file, unsigned int cmd,
 				unsigned long arg);
+	int (*file_ioctl_compat)(struct file *file, unsigned int cmd,
+				unsigned long arg);
 	int (*mmap_addr)(unsigned long addr);
 	int (*mmap_file)(struct file *file, unsigned long reqprot,
 				unsigned long prot, unsigned long flags);
@@ -1817,6 +1825,7 @@ struct security_hook_heads {
 	struct list_head file_alloc_security;
 	struct list_head file_free_security;
 	struct list_head file_ioctl;
+	struct list_head file_ioctl_compat;
 	struct list_head mmap_addr;
 	struct list_head mmap_file;
 	struct list_head file_mprotect;

diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 83f576d..c977e63 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h

@@ -2953,6 +2953,7 @@
 #define PCI_DEVICE_ID_INTEL_82443GX_0	0x71a0
 #define PCI_DEVICE_ID_INTEL_82443GX_2	0x71a2
 #define PCI_DEVICE_ID_INTEL_82372FB_1	0x7601
+#define PCI_DEVICE_ID_INTEL_HDA_ARL	0x7728
 #define PCI_DEVICE_ID_INTEL_SCH_LPC	0x8119
 #define PCI_DEVICE_ID_INTEL_SCH_IDE	0x811a
 #define PCI_DEVICE_ID_INTEL_E6XX_CU	0x8183

diff --git a/include/linux/security.h b/include/linux/security.h
index 382e4e5..c2a9784 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h

@@ -306,6 +306,8 @@ int security_file_permission(struct file *file, int mask);
 int security_file_alloc(struct file *file);
 void security_file_free(struct file *file);
 int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+int security_file_ioctl_compat(struct file *file, unsigned int cmd,
+			       unsigned long arg);
 int security_mmap_file(struct file *file, unsigned long prot,
 			unsigned long flags);
 int security_mmap_addr(unsigned long addr);
@@ -827,6 +829,13 @@ static inline int security_file_ioctl(struct file *file, unsigned int cmd,
 	return 0;
 }
 
+static inline int security_file_ioctl_compat(struct file *file,
+					     unsigned int cmd,
+					     unsigned long arg)
+{
+	return 0;
+}
+
 static inline int security_mmap_file(struct file *file, unsigned long prot,
 				     unsigned long flags)
 {

diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index a8f6606..5c7741c 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h

@@ -153,6 +153,7 @@ struct spi_device {
 #define	SPI_MODE_1	(0|SPI_CPHA)
 #define	SPI_MODE_2	(SPI_CPOL|0)
 #define	SPI_MODE_3	(SPI_CPOL|SPI_CPHA)
+#define	SPI_MODE_X_MASK	(SPI_CPOL|SPI_CPHA)
 #define	SPI_CS_HIGH	0x04			/* chipselect active high? */
 #define	SPI_LSB_FIRST	0x08			/* per-word bits-on-wire */
 #define	SPI_3WIRE	0x10			/* SI/SO signals shared */

diff --git a/include/linux/units.h b/include/linux/units.h
new file mode 100644
index 0000000..a0af6d2
--- /dev/null
+++ b/include/linux/units.h

@@ -0,0 +1,92 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_UNITS_H
+#define _LINUX_UNITS_H
+
+#include <linux/kernel.h>
+
+#define HZ_PER_KHZ		1000UL
+#define KHZ_PER_MHZ		1000UL
+#define HZ_PER_MHZ		1000000UL
+
+#define MILLIWATT_PER_WATT	1000UL
+#define MICROWATT_PER_MILLIWATT	1000UL
+#define MICROWATT_PER_WATT	1000000UL
+
+#define ABSOLUTE_ZERO_MILLICELSIUS -273150
+
+static inline long milli_kelvin_to_millicelsius(long t)
+{
+	return t + ABSOLUTE_ZERO_MILLICELSIUS;
+}
+
+static inline long millicelsius_to_milli_kelvin(long t)
+{
+	return t - ABSOLUTE_ZERO_MILLICELSIUS;
+}
+
+#define MILLIDEGREE_PER_DEGREE 1000
+#define MILLIDEGREE_PER_DECIDEGREE 100
+
+static inline long kelvin_to_millicelsius(long t)
+{
+	return milli_kelvin_to_millicelsius(t * MILLIDEGREE_PER_DEGREE);
+}
+
+static inline long millicelsius_to_kelvin(long t)
+{
+	t = millicelsius_to_milli_kelvin(t);
+
+	return DIV_ROUND_CLOSEST(t, MILLIDEGREE_PER_DEGREE);
+}
+
+static inline long deci_kelvin_to_celsius(long t)
+{
+	t = milli_kelvin_to_millicelsius(t * MILLIDEGREE_PER_DECIDEGREE);
+
+	return DIV_ROUND_CLOSEST(t, MILLIDEGREE_PER_DEGREE);
+}
+
+static inline long celsius_to_deci_kelvin(long t)
+{
+	t = millicelsius_to_milli_kelvin(t * MILLIDEGREE_PER_DEGREE);
+
+	return DIV_ROUND_CLOSEST(t, MILLIDEGREE_PER_DECIDEGREE);
+}
+
+/**
+ * deci_kelvin_to_millicelsius_with_offset - convert Kelvin to Celsius
+ * @t: temperature value in decidegrees Kelvin
+ * @offset: difference between Kelvin and Celsius in millidegrees
+ *
+ * Return: temperature value in millidegrees Celsius
+ */
+static inline long deci_kelvin_to_millicelsius_with_offset(long t, long offset)
+{
+	return t * MILLIDEGREE_PER_DECIDEGREE - offset;
+}
+
+static inline long deci_kelvin_to_millicelsius(long t)
+{
+	return milli_kelvin_to_millicelsius(t * MILLIDEGREE_PER_DECIDEGREE);
+}
+
+static inline long millicelsius_to_deci_kelvin(long t)
+{
+	t = millicelsius_to_milli_kelvin(t);
+
+	return DIV_ROUND_CLOSEST(t, MILLIDEGREE_PER_DECIDEGREE);
+}
+
+static inline long kelvin_to_celsius(long t)
+{
+	return t + DIV_ROUND_CLOSEST(ABSOLUTE_ZERO_MILLICELSIUS,
+				     MILLIDEGREE_PER_DEGREE);
+}
+
+static inline long celsius_to_kelvin(long t)
+{
+	return t - DIV_ROUND_CLOSEST(ABSOLUTE_ZERO_MILLICELSIUS,
+				     MILLIDEGREE_PER_DEGREE);
+}
+
+#endif /* _LINUX_UNITS_H */

diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 7ec1cdb..e514508 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h

@@ -43,12 +43,6 @@ struct unix_skb_parms {
 
 #define UNIXCB(skb) 	(*(struct unix_skb_parms *)&((skb)->cb))
 
-#define unix_state_lock(s)	spin_lock(&unix_sk(s)->lock)
-#define unix_state_unlock(s)	spin_unlock(&unix_sk(s)->lock)
-#define unix_state_lock_nested(s) \
-				spin_lock_nested(&unix_sk(s)->lock, \
-				SINGLE_DEPTH_NESTING)
-
 /* The AF_UNIX socket */
 struct unix_sock {
 	/* WARNING: sk has to be the first member */
@@ -72,6 +66,20 @@ static inline struct unix_sock *unix_sk(const struct sock *sk)
 	return (struct unix_sock *)sk;
 }
 
+#define unix_state_lock(s)	spin_lock(&unix_sk(s)->lock)
+#define unix_state_unlock(s)	spin_unlock(&unix_sk(s)->lock)
+enum unix_socket_lock_class {
+	U_LOCK_NORMAL,
+	U_LOCK_SECOND,	/* for double locking, see unix_state_double_lock(). */
+	U_LOCK_DIAG, /* used while dumping icons, see sk_diag_dump_icons(). */
+};
+
+static inline void unix_state_lock_nested(struct sock *sk,
+				   enum unix_socket_lock_class subclass)
+{
+	spin_lock_nested(&unix_sk(sk)->lock, subclass);
+}
+
 #define peer_wait peer_wq.wait
 
 long unix_inq_len(struct sock *sk);

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 8f899ad..bac3d79 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h

@@ -647,7 +647,6 @@ void hci_inquiry_cache_flush(struct hci_dev *hdev);
 /* ----- HCI Connections ----- */
 enum {
 	HCI_CONN_AUTH_PEND,
-	HCI_CONN_REAUTH_PEND,
 	HCI_CONN_ENCRYPT_PEND,
 	HCI_CONN_RSWITCH_PEND,
 	HCI_CONN_MODE_CHANGE_PEND,

diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
index 443863c..632086b 100644
--- a/include/net/dst_ops.h
+++ b/include/net/dst_ops.h

@@ -16,7 +16,7 @@ struct dst_ops {
 	unsigned short		family;
 	unsigned int		gc_thresh;
 
-	int			(*gc)(struct dst_ops *ops);
+	void			(*gc)(struct dst_ops *ops);
 	struct dst_entry *	(*check)(struct dst_entry *, __u32 cookie);
 	unsigned int		(*default_advmss)(const struct dst_entry *);
 	unsigned int		(*mtu)(const struct dst_entry *);
@@ -53,9 +53,11 @@ static inline int dst_entries_get_slow(struct dst_ops *dst)
 	return percpu_counter_sum_positive(&dst->pcpuc_entries);
 }
 
+#define DST_PERCPU_COUNTER_BATCH 32
 static inline void dst_entries_add(struct dst_ops *dst, int val)
 {
-	percpu_counter_add(&dst->pcpuc_entries, val);
+	percpu_counter_add_batch(&dst->pcpuc_entries, val,
+				 DST_PERCPU_COUNTER_BATCH);
 }
 
 static inline int dst_entries_init(struct dst_ops *dst)

diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
index 49aa79c..581cd37 100644
--- a/include/net/llc_pdu.h
+++ b/include/net/llc_pdu.h

@@ -262,8 +262,7 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type,
  */
 static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa)
 {
-	if (skb->protocol == htons(ETH_P_802_2))
-		memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN);
+	memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN);
 }
 
 /**
@@ -275,8 +274,7 @@ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa)
  */
 static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da)
 {
-	if (skb->protocol == htons(ETH_P_802_2))
-		memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN);
+	memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN);
 }
 
 /**

diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index c004d05..290ca18 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h

@@ -64,8 +64,8 @@ struct netns_ipv6 {
 	struct dst_ops		ip6_dst_ops;
 	rwlock_t		fib6_walker_lock;
 	spinlock_t		fib6_gc_lock;
-	unsigned int		 ip6_rt_gc_expire;
-	unsigned long		 ip6_rt_last_gc;
+	atomic_t		ip6_rt_gc_expire;
+	unsigned long		ip6_rt_last_gc;
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 	bool			 fib6_has_custom_rules;
 	struct rt6_info         *ip6_prohibit_entry;

diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
index 86d2a52..ee7a34c 100644
--- a/include/uapi/linux/btrfs.h
+++ b/include/uapi/linux/btrfs.h

@@ -522,6 +522,9 @@ struct btrfs_ioctl_clone_range_args {
  */
 #define BTRFS_DEFRAG_RANGE_COMPRESS 1
 #define BTRFS_DEFRAG_RANGE_START_IO 2
+#define BTRFS_DEFRAG_RANGE_FLAGS_SUPP	(BTRFS_DEFRAG_RANGE_COMPRESS |		\
+					 BTRFS_DEFRAG_RANGE_START_IO)
+
 struct btrfs_ioctl_defrag_range_args {
 	/* start of the defrag operation */
 	__u64 start;

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index c7bb18e..835e9f3 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h

@@ -229,9 +229,11 @@ enum nft_rule_attributes {
 /**
  * enum nft_rule_compat_flags - nf_tables rule compat flags
  *
+ * @NFT_RULE_COMPAT_F_UNUSED: unused
  * @NFT_RULE_COMPAT_F_INV: invert the check result
  */
 enum nft_rule_compat_flags {
+	NFT_RULE_COMPAT_F_UNUSED = (1 << 0),
 	NFT_RULE_COMPAT_F_INV	= (1 << 1),
 	NFT_RULE_COMPAT_F_MASK	= NFT_RULE_COMPAT_F_INV,
 };

diff --git a/kernel/audit.c b/kernel/audit.c
index b694a26..819bdf0 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c

@@ -458,15 +458,19 @@ static int audit_set_failure(u32 state)
  * @pid: auditd PID
  * @portid: auditd netlink portid
  * @net: auditd network namespace pointer
+ * @skb: the netlink command from the audit daemon
+ * @ack: netlink ack flag, cleared if ack'd here
  *
  * Description:
  * This function will obtain and drop network namespace references as
  * necessary.  Returns zero on success, negative values on failure.
  */
-static int auditd_set(struct pid *pid, u32 portid, struct net *net)
+static int auditd_set(struct pid *pid, u32 portid, struct net *net,
+		      struct sk_buff *skb, bool *ack)
 {
 	unsigned long flags;
 	struct auditd_connection *ac_old, *ac_new;
+	struct nlmsghdr *nlh;
 
 	if (!pid || !net)
 		return -EINVAL;
@@ -478,6 +482,13 @@ static int auditd_set(struct pid *pid, u32 portid, struct net *net)
 	ac_new->portid = portid;
 	ac_new->net = get_net(net);
 
+	/* send the ack now to avoid a race with the queue backlog */
+	if (*ack) {
+		nlh = nlmsg_hdr(skb);
+		netlink_ack(skb, nlh, 0, NULL);
+		*ack = false;
+	}
+
 	spin_lock_irqsave(&auditd_conn_lock, flags);
 	ac_old = rcu_dereference_protected(auditd_conn,
 					   lockdep_is_held(&auditd_conn_lock));
@@ -1165,7 +1176,8 @@ static int audit_replace(struct pid *pid)
 	return auditd_send_unicast_skb(skb);
 }
 
-static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+			     bool *ack)
 {
 	u32			seq;
 	void			*data;
@@ -1257,7 +1269,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 				/* register a new auditd connection */
 				err = auditd_set(req_pid,
 						 NETLINK_CB(skb).portid,
-						 sock_net(NETLINK_CB(skb).sk));
+						 sock_net(NETLINK_CB(skb).sk),
+						 skb, ack);
 				if (audit_enabled != AUDIT_OFF)
 					audit_log_config_change("audit_pid",
 								new_pid,
@@ -1490,9 +1503,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
  * Parse the provided skb and deal with any messages that may be present,
  * malformed skbs are discarded.
  */
-static void audit_receive(struct sk_buff  *skb)
+static void audit_receive(struct sk_buff *skb)
 {
 	struct nlmsghdr *nlh;
+	bool ack;
 	/*
 	 * len MUST be signed for nlmsg_next to be able to dec it below 0
 	 * if the nlmsg_len was not aligned
@@ -1505,9 +1519,12 @@ static void audit_receive(struct sk_buff  *skb)
 
 	mutex_lock(&audit_cmd_mutex);
 	while (nlmsg_ok(nlh, len)) {
-		err = audit_receive_msg(skb, nlh);
-		/* if err or if this message says it wants a response */
-		if (err || (nlh->nlmsg_flags & NLM_F_ACK))
+		ack = nlh->nlmsg_flags & NLM_F_ACK;
+		err = audit_receive_msg(skb, nlh, &ack);
+
+		/* send an ack if the user asked for one and audit_receive_msg
+		 * didn't already do it, or if there was an error. */
+		if (ack || err)
 			netlink_ack(skb, nlh, err, NULL);
 
 		nlh = nlmsg_next(nlh, &len);

diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 148895e..aede918 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c

@@ -420,7 +420,7 @@ int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,
 
 	old_ptr = xchg(array->ptrs + index, new_ptr);
 	if (old_ptr)
-		map->ops->map_fd_put_ptr(old_ptr);
+		map->ops->map_fd_put_ptr(map, old_ptr, true);
 
 	return 0;
 }
@@ -436,7 +436,7 @@ static int fd_array_map_delete_elem(struct bpf_map *map, void *key)
 
 	old_ptr = xchg(array->ptrs + index, NULL);
 	if (old_ptr) {
-		map->ops->map_fd_put_ptr(old_ptr);
+		map->ops->map_fd_put_ptr(map, old_ptr, true);
 		return 0;
 	} else {
 		return -ENOENT;
@@ -460,8 +460,9 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map,
 	return prog;
 }
 
-static void prog_fd_array_put_ptr(void *ptr)
+static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
 {
+	/* bpf_prog is freed after one RCU or tasks trace grace period */
 	bpf_prog_put(ptr);
 }
 
@@ -547,8 +548,9 @@ static void *perf_event_fd_array_get_ptr(struct bpf_map *map,
 	return ee;
 }
 
-static void perf_event_fd_array_put_ptr(void *ptr)
+static void perf_event_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
 {
+	/* bpf_perf_event is freed after one RCU grace period */
 	bpf_event_entry_free_rcu(ptr);
 }
 
@@ -587,7 +589,7 @@ static void *cgroup_fd_array_get_ptr(struct bpf_map *map,
 	return cgroup_get_from_fd(fd);
 }
 
-static void cgroup_fd_array_put_ptr(void *ptr)
+static void cgroup_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
 {
 	/* cgroup_put free cgrp after a rcu grace period */
 	cgroup_put(ptr);

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 9426680..e501e87 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c

@@ -656,7 +656,7 @@ static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
 
 	if (map->ops->map_fd_put_ptr) {
 		ptr = fd_htab_map_get_ptr(map, l);
-		map->ops->map_fd_put_ptr(ptr);
+		map->ops->map_fd_put_ptr(map, ptr, true);
 	}
 }
 
@@ -1289,7 +1289,7 @@ static void fd_htab_map_free(struct bpf_map *map)
 		hlist_nulls_for_each_entry_safe(l, n, head, hash_node) {
 			void *ptr = fd_htab_map_get_ptr(map, l);
 
-			map->ops->map_fd_put_ptr(ptr);
+			map->ops->map_fd_put_ptr(map, ptr, false);
 		}
 	}
 
@@ -1330,7 +1330,7 @@ int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file,
 
 	ret = htab_map_update_elem(map, key, &ptr, map_flags);
 	if (ret)
-		map->ops->map_fd_put_ptr(ptr);
+		map->ops->map_fd_put_ptr(map, ptr, false);
 
 	return ret;
 }

diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index 224362f..3925794 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c

@@ -192,6 +192,9 @@ static void *trie_lookup_elem(struct bpf_map *map, void *_key)
 	struct lpm_trie_node *node, *found = NULL;
 	struct bpf_lpm_trie_key *key = _key;
 
+	if (key->prefixlen > trie->max_prefixlen)
+		return NULL;
+
 	/* Start walking the trie from the root node ... */
 
 	for (node = rcu_dereference(trie->root); node;) {

diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
index c0c494b..1878aac 100644
--- a/kernel/bpf/map_in_map.c
+++ b/kernel/bpf/map_in_map.c

@@ -101,7 +101,7 @@ void *bpf_map_fd_get_ptr(struct bpf_map *map,
 	return inner_map;
 }
 
-void bpf_map_fd_put_ptr(void *ptr)
+void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
 {
 	/* ptr->ops->map_free() has to go through one
 	 * rcu grace period by itself.

diff --git a/kernel/bpf/map_in_map.h b/kernel/bpf/map_in_map.h
index 6183db9..1e652a7 100644
--- a/kernel/bpf/map_in_map.h
+++ b/kernel/bpf/map_in_map.h

@@ -18,7 +18,7 @@ bool bpf_map_meta_equal(const struct bpf_map *meta0,
 			const struct bpf_map *meta1);
 void *bpf_map_fd_get_ptr(struct bpf_map *map, struct file *map_file,
 			 int ufd);
-void bpf_map_fd_put_ptr(void *ptr);
+void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer);
 u32 bpf_map_fd_sys_lookup_elem(void *ptr);
 
 #endif

diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 90bd789..d7e25d7 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c

@@ -400,6 +400,13 @@ int kdb_set(int argc, const char **argv)
 		return KDB_ARGCOUNT;
 
 	/*
+	 * Censor sensitive variables
+	 */
+	if (strcmp(argv[1], "PROMPT") == 0 &&
+	    !kdb_check_flags(KDB_ENABLE_MEM_READ, kdb_cmd_enabled, false))
+		return KDB_NOPERM;
+
+	/*
 	 * Check for internal variables
 	 */
 	if (strcmp(argv[1], "KDBDEBUG") == 0) {
@@ -1289,14 +1296,9 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
 		*(cmd_hist[cmd_head]) = '\0';
 
 do_full_getstr:
-#if defined(CONFIG_SMP)
+		/* PROMPT can only be set if we have MEM_READ permission. */
 		snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"),
 			 raw_smp_processor_id());
-#else
-		snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"));
-#endif
-		if (defcmd_in_progress)
-			strncat(kdb_prompt_str, "[defcmd]", CMD_BUFLEN);
 
 		/*
 		 * Fetch command from keyboard

diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 8b37085..b62a56d 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c

@@ -595,11 +595,11 @@ static int crc32_threadfn(void *data)
 	unsigned i;
 
 	while (1) {
-		wait_event(d->go, atomic_read(&d->ready) ||
+		wait_event(d->go, atomic_read_acquire(&d->ready) ||
 		                  kthread_should_stop());
 		if (kthread_should_stop()) {
 			d->thr = NULL;
-			atomic_set(&d->stop, 1);
+			atomic_set_release(&d->stop, 1);
 			wake_up(&d->done);
 			break;
 		}
@@ -608,7 +608,7 @@ static int crc32_threadfn(void *data)
 		for (i = 0; i < d->run_threads; i++)
 			*d->crc32 = crc32_le(*d->crc32,
 			                     d->unc[i], *d->unc_len[i]);
-		atomic_set(&d->stop, 1);
+		atomic_set_release(&d->stop, 1);
 		wake_up(&d->done);
 	}
 	return 0;
@@ -638,12 +638,12 @@ static int lzo_compress_threadfn(void *data)
 	struct cmp_data *d = data;
 
 	while (1) {
-		wait_event(d->go, atomic_read(&d->ready) ||
+		wait_event(d->go, atomic_read_acquire(&d->ready) ||
 		                  kthread_should_stop());
 		if (kthread_should_stop()) {
 			d->thr = NULL;
 			d->ret = -1;
-			atomic_set(&d->stop, 1);
+			atomic_set_release(&d->stop, 1);
 			wake_up(&d->done);
 			break;
 		}
@@ -652,7 +652,7 @@ static int lzo_compress_threadfn(void *data)
 		d->ret = lzo1x_1_compress(d->unc, d->unc_len,
 		                          d->cmp + LZO_HEADER, &d->cmp_len,
 		                          d->wrk);
-		atomic_set(&d->stop, 1);
+		atomic_set_release(&d->stop, 1);
 		wake_up(&d->done);
 	}
 	return 0;
@@ -794,7 +794,7 @@ static int save_image_lzo(struct swap_map_handle *handle,
 
 			data[thr].unc_len = off;
 
-			atomic_set(&data[thr].ready, 1);
+			atomic_set_release(&data[thr].ready, 1);
 			wake_up(&data[thr].go);
 		}
 
@@ -802,12 +802,12 @@ static int save_image_lzo(struct swap_map_handle *handle,
 			break;
 
 		crc->run_threads = thr;
-		atomic_set(&crc->ready, 1);
+		atomic_set_release(&crc->ready, 1);
 		wake_up(&crc->go);
 
 		for (run_threads = thr, thr = 0; thr < run_threads; thr++) {
 			wait_event(data[thr].done,
-			           atomic_read(&data[thr].stop));
+				atomic_read_acquire(&data[thr].stop));
 			atomic_set(&data[thr].stop, 0);
 
 			ret = data[thr].ret;
@@ -847,7 +847,7 @@ static int save_image_lzo(struct swap_map_handle *handle,
 			}
 		}
 
-		wait_event(crc->done, atomic_read(&crc->stop));
+		wait_event(crc->done, atomic_read_acquire(&crc->stop));
 		atomic_set(&crc->stop, 0);
 	}
 
@@ -1129,12 +1129,12 @@ static int lzo_decompress_threadfn(void *data)
 	struct dec_data *d = data;
 
 	while (1) {
-		wait_event(d->go, atomic_read(&d->ready) ||
+		wait_event(d->go, atomic_read_acquire(&d->ready) ||
 		                  kthread_should_stop());
 		if (kthread_should_stop()) {
 			d->thr = NULL;
 			d->ret = -1;
-			atomic_set(&d->stop, 1);
+			atomic_set_release(&d->stop, 1);
 			wake_up(&d->done);
 			break;
 		}
@@ -1147,7 +1147,7 @@ static int lzo_decompress_threadfn(void *data)
 			flush_icache_range((unsigned long)d->unc,
 					   (unsigned long)d->unc + d->unc_len);
 
-		atomic_set(&d->stop, 1);
+		atomic_set_release(&d->stop, 1);
 		wake_up(&d->done);
 	}
 	return 0;
@@ -1338,7 +1338,7 @@ static int load_image_lzo(struct swap_map_handle *handle,
 		}
 
 		if (crc->run_threads) {
-			wait_event(crc->done, atomic_read(&crc->stop));
+			wait_event(crc->done, atomic_read_acquire(&crc->stop));
 			atomic_set(&crc->stop, 0);
 			crc->run_threads = 0;
 		}
@@ -1375,7 +1375,7 @@ static int load_image_lzo(struct swap_map_handle *handle,
 					pg = 0;
 			}
 
-			atomic_set(&data[thr].ready, 1);
+			atomic_set_release(&data[thr].ready, 1);
 			wake_up(&data[thr].go);
 		}
 
@@ -1394,7 +1394,7 @@ static int load_image_lzo(struct swap_map_handle *handle,
 
 		for (run_threads = thr, thr = 0; thr < run_threads; thr++) {
 			wait_event(data[thr].done,
-			           atomic_read(&data[thr].stop));
+				atomic_read_acquire(&data[thr].stop));
 			atomic_set(&data[thr].stop, 0);
 
 			ret = data[thr].ret;
@@ -1429,7 +1429,7 @@ static int load_image_lzo(struct swap_map_handle *handle,
 				ret = snapshot_write_next(snapshot);
 				if (ret <= 0) {
 					crc->run_threads = thr + 1;
-					atomic_set(&crc->ready, 1);
+					atomic_set_release(&crc->ready, 1);
 					wake_up(&crc->go);
 					goto out_finish;
 				}
@@ -1437,13 +1437,13 @@ static int load_image_lzo(struct swap_map_handle *handle,
 		}
 
 		crc->run_threads = thr;
-		atomic_set(&crc->ready, 1);
+		atomic_set_release(&crc->ready, 1);
 		wake_up(&crc->go);
 	}
 
 out_finish:
 	if (crc->run_threads) {
-		wait_event(crc->done, atomic_read(&crc->stop));
+		wait_event(crc->done, atomic_read_acquire(&crc->stop));
 		atomic_set(&crc->stop, 0);
 	}
 	stop = ktime_get();

diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
index 9bcbacb..d936a13 100644
--- a/kernel/sched/membarrier.c
+++ b/kernel/sched/membarrier.c

@@ -30,6 +30,8 @@
 	(MEMBARRIER_CMD_SHARED | MEMBARRIER_CMD_PRIVATE_EXPEDITED	\
 	| MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED)
 
+static DEFINE_MUTEX(membarrier_ipi_mutex);
+
 static void ipi_mb(void *info)
 {
 	smp_mb();	/* IPIs should be serializing but paranoid. */
@@ -64,6 +66,7 @@ static int membarrier_private_expedited(void)
 		fallback = true;
 	}
 
+	mutex_lock(&membarrier_ipi_mutex);
 	cpus_read_lock();
 	for_each_online_cpu(cpu) {
 		struct task_struct *p;
@@ -102,6 +105,7 @@ static int membarrier_private_expedited(void)
 	 * rq->curr modification in scheduler.
 	 */
 	smp_mb();	/* exit from system call is not a mb */
+	mutex_unlock(&membarrier_ipi_mutex);
 	return 0;
 }
 

diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 710505b..0ac2e4a 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c

@@ -1380,13 +1380,23 @@ void tick_setup_sched_timer(void)
 void tick_cancel_sched_timer(int cpu)
 {
 	struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
+	ktime_t idle_sleeptime, iowait_sleeptime;
+	unsigned long idle_calls, idle_sleeps;
 
 # ifdef CONFIG_HIGH_RES_TIMERS
 	if (ts->sched_timer.base)
 		hrtimer_cancel(&ts->sched_timer);
 # endif
 
+	idle_sleeptime = ts->idle_sleeptime;
+	iowait_sleeptime = ts->iowait_sleeptime;
+	idle_calls = ts->idle_calls;
+	idle_sleeps = ts->idle_sleeps;
 	memset(ts, 0, sizeof(*ts));
+	ts->idle_sleeptime = idle_sleeptime;
+	ts->iowait_sleeptime = iowait_sleeptime;
+	ts->idle_calls = idle_calls;
+	ts->idle_sleeps = idle_sleeps;
 }
 #endif
 

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 3fc09d7..8c09e8c 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c

@@ -2776,6 +2776,12 @@ rb_reserve_next_event(struct ring_buffer *buffer,
 	int nr_loops = 0;
 	u64 diff;
 
+	/* ring buffer does cmpxchg, make sure it is safe in NMI context */
+	if (!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG) &&
+	    (unlikely(in_nmi()))) {
+		return NULL;
+	}
+
 	rb_start_commit(cpu_buffer);
 
 #ifdef CONFIG_RING_BUFFER_ALLOW_SWAP

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c5fe020..755d614 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c

@@ -3826,7 +3826,11 @@ static int s_show(struct seq_file *m, void *v)
 		iter->leftover = ret;
 
 	} else {
-		print_trace_line(iter);
+		ret = print_trace_line(iter);
+		if (ret == TRACE_TYPE_PARTIAL_LINE) {
+			iter->seq.full = 0;
+			trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n");
+		}
 		ret = trace_print_seq(m, &iter->seq);
 		/*
 		 * If we overflow the seq_file buffer, then it will

diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 40c1a2d..871ea0f 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c

@@ -1127,8 +1127,10 @@ register_snapshot_trigger(char *glob, struct event_trigger_ops *ops,
 			  struct event_trigger_data *data,
 			  struct trace_event_file *file)
 {
-	if (tracing_alloc_snapshot_instance(file->tr) != 0)
-		return 0;
+	int ret = tracing_alloc_snapshot_instance(file->tr);
+
+	if (ret < 0)
+		return ret;
 
 	return register_trigger(glob, ops, data, file);
 }

diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index 1116448..75bc24f 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c

@@ -1487,11 +1487,12 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter,
 {
 	struct print_entry *field;
 	struct trace_seq *s = &iter->seq;
+	int max = iter->ent_size - offsetof(struct print_entry, buf);
 
 	trace_assign_type(field, iter->ent);
 
 	seq_print_ip_sym(s, field->ip, flags);
-	trace_seq_printf(s, ": %s", field->buf);
+	trace_seq_printf(s, ": %.*s", max, field->buf);
 
 	return trace_handle_return(s);
 }
@@ -1500,10 +1501,11 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags,
 					 struct trace_event *event)
 {
 	struct print_entry *field;
+	int max = iter->ent_size - offsetof(struct print_entry, buf);
 
 	trace_assign_type(field, iter->ent);
 
-	trace_seq_printf(&iter->seq, "# %lx %s", field->ip, field->buf);
+	trace_seq_printf(&iter->seq, "# %lx %.*s", field->ip, max, field->buf);
 
 	return trace_handle_return(&iter->seq);
 }

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index e7827b9..e179ffa 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c

@@ -952,7 +952,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
 	 * This check implies we don't kill processes if their pages
 	 * are in the swap cache early. Those are always late kills.
 	 */
-	if (!page_mapped(hpage))
+	if (!page_mapped(p))
 		return true;
 
 	if (PageKsm(p)) {
@@ -996,10 +996,10 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
 	if (kill)
 		collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED);
 
-	unmap_success = try_to_unmap(hpage, ttu);
+	unmap_success = try_to_unmap(p, ttu);
 	if (!unmap_success)
 		pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n",
-		       pfn, page_mapcount(hpage));
+		       pfn, page_mapcount(p));
 
 	/*
 	 * try_to_unmap() might put mlocked page in lru cache, so call

diff --git a/mm/memory.c b/mm/memory.c
index 1702989..dda7f79 100644
--- a/mm/memory.c
+++ b/mm/memory.c

@@ -2950,8 +2950,8 @@ void unmap_mapping_range(struct address_space *mapping,
 		loff_t const holebegin, loff_t const holelen, int even_cows)
 {
 	struct zap_details details = { };
-	pgoff_t hba = holebegin >> PAGE_SHIFT;
-	pgoff_t hlen = (holelen + PAGE_SIZE - 1) >> PAGE_SHIFT;
+	pgoff_t hba = (pgoff_t)(holebegin) >> PAGE_SHIFT;
+	pgoff_t hlen = ((pgoff_t)(holelen) + PAGE_SIZE - 1) >> PAGE_SHIFT;
 
 	/* Check for overflow. */
 	if (sizeof(holelen) > sizeof(hlen)) {

diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 5b405e9..47f4a48 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c

@@ -1531,7 +1531,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc)
 	 */
 	dtc->wb_thresh = __wb_calc_thresh(dtc);
 	dtc->wb_bg_thresh = dtc->thresh ?
-		div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0;
+		div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0;
 
 	/*
 	 * In order to avoid the stacked BDI deadlock we need

diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index fdf39dd..aad0971 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c

@@ -105,12 +105,16 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[],
 	}
 	if (data[IFLA_VLAN_INGRESS_QOS]) {
 		nla_for_each_nested(attr, data[IFLA_VLAN_INGRESS_QOS], rem) {
+			if (nla_type(attr) != IFLA_VLAN_QOS_MAPPING)
+				continue;
 			m = nla_data(attr);
 			vlan_dev_set_ingress_priority(dev, m->to, m->from);
 		}
 	}
 	if (data[IFLA_VLAN_EGRESS_QOS]) {
 		nla_for_each_nested(attr, data[IFLA_VLAN_EGRESS_QOS], rem) {
+			if (nla_type(attr) != IFLA_VLAN_QOS_MAPPING)
+				continue;
 			m = nla_data(attr);
 			err = vlan_dev_set_egress_priority(dev, m->from, m->to);
 			if (err)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index ce4bbc4..017abff 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c

@@ -1221,12 +1221,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
 			     sizeof(cp), &cp);
 
-		/* If we're already encrypted set the REAUTH_PEND flag,
-		 * otherwise set the ENCRYPT_PEND.
+		/* Set the ENCRYPT_PEND to trigger encryption after
+		 * authentication.
 		 */
-		if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
-			set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
-		else
+		if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
 			set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 	}
 

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 07605fc..5104e8e 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c

@@ -2459,14 +2459,8 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
 	if (!ev->status) {
 		clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
-
-		if (!hci_conn_ssp_enabled(conn) &&
-		    test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
-			BT_INFO("re-auth of legacy device is not possible.");
-		} else {
-			set_bit(HCI_CONN_AUTH, &conn->flags);
-			conn->sec_level = conn->pending_sec_level;
-		}
+		set_bit(HCI_CONN_AUTH, &conn->flags);
+		conn->sec_level = conn->pending_sec_level;
 	} else {
 		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
 			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
@@ -2475,7 +2469,6 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	}
 
 	clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
-	clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
 
 	if (conn->state == BT_CONFIG) {
 		if (!ev->status && hci_conn_ssp_enabled(conn)) {

diff --git a/net/core/dst.c b/net/core/dst.c
index a6c47da..2d12195 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c

@@ -99,10 +99,10 @@ void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
 {
 	struct dst_entry *dst;
 
-	if (ops->gc && dst_entries_get_fast(ops) > ops->gc_thresh) {
-		if (ops->gc(ops))
-			return NULL;
-	}
+	if (ops->gc &&
+	    !(flags & DST_NOCOUNT) &&
+	    dst_entries_get_fast(ops) > ops->gc_thresh)
+		ops->gc(ops);
 
 	dst = kmem_cache_alloc(ops->kmem_cachep, GFP_ATOMIC);
 	if (!dst)

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 8e1741e..d221744 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c

@@ -1514,10 +1514,12 @@ EXPORT_SYMBOL(inet_current_timestamp);
 
 int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
-	if (sk->sk_family == AF_INET)
+	unsigned int family = READ_ONCE(sk->sk_family);
+
+	if (family == AF_INET)
 		return ip_recv_error(sk, msg, len, addr_len);
 #if IS_ENABLED(CONFIG_IPV6)
-	if (sk->sk_family == AF_INET6)
+	if (family == AF_INET6)
 		return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len);
 #endif
 	return -EINVAL;

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index c242c41..947655e 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c

@@ -1114,6 +1114,16 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
 	struct ip_options_rcu *opt;
 	struct rtable *rt;
 
+	rt = *rtp;
+	if (unlikely(!rt))
+		return -EFAULT;
+
+	cork->fragsize = ip_sk_use_pmtu(sk) ?
+			 dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);
+
+	if (!inetdev_valid_mtu(cork->fragsize))
+		return -ENETUNREACH;
+
 	/*
 	 * setup for corking.
 	 */
@@ -1129,15 +1139,6 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
 		cork->flags |= IPCORK_OPT;
 		cork->addr = ipc->addr;
 	}
-	rt = *rtp;
-	if (unlikely(!rt))
-		return -EFAULT;
-
-	cork->fragsize = ip_sk_use_pmtu(sk) ?
-			 dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);
-
-	if (!inetdev_valid_mtu(cork->fragsize))
-		return -ENETUNREACH;
 
 	cork->dst = &rt->dst;
 	/* We stole this route, caller should not release it. */

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index c0d54be..b620d72 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c

@@ -701,6 +701,7 @@ static void tcp_push(struct sock *sk, int flags, int mss_now,
 		if (!test_bit(TSQ_THROTTLED, &sk->sk_tsq_flags)) {
 			NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAUTOCORKING);
 			set_bit(TSQ_THROTTLED, &sk->sk_tsq_flags);
+			smp_mb__after_atomic();
 		}
 		/* It is possible TX completion already happened
 		 * before we set TSQ_THROTTLED.

diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index e6c5a4b..f5a2679 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c

@@ -140,19 +140,26 @@ const struct ipv6_stub *ipv6_stub __read_mostly = &(struct ipv6_stub) {
 EXPORT_SYMBOL_GPL(ipv6_stub);
 
 /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
-const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
+const struct in6_addr in6addr_loopback __aligned(BITS_PER_LONG/8)
+	= IN6ADDR_LOOPBACK_INIT;
 EXPORT_SYMBOL(in6addr_loopback);
-const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
+const struct in6_addr in6addr_any __aligned(BITS_PER_LONG/8)
+	= IN6ADDR_ANY_INIT;
 EXPORT_SYMBOL(in6addr_any);
-const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
+const struct in6_addr in6addr_linklocal_allnodes __aligned(BITS_PER_LONG/8)
+	= IN6ADDR_LINKLOCAL_ALLNODES_INIT;
 EXPORT_SYMBOL(in6addr_linklocal_allnodes);
-const struct in6_addr in6addr_linklocal_allrouters = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
+const struct in6_addr in6addr_linklocal_allrouters __aligned(BITS_PER_LONG/8)
+	= IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
 EXPORT_SYMBOL(in6addr_linklocal_allrouters);
-const struct in6_addr in6addr_interfacelocal_allnodes = IN6ADDR_INTERFACELOCAL_ALLNODES_INIT;
+const struct in6_addr in6addr_interfacelocal_allnodes __aligned(BITS_PER_LONG/8)
+	= IN6ADDR_INTERFACELOCAL_ALLNODES_INIT;
 EXPORT_SYMBOL(in6addr_interfacelocal_allnodes);
-const struct in6_addr in6addr_interfacelocal_allrouters = IN6ADDR_INTERFACELOCAL_ALLROUTERS_INIT;
+const struct in6_addr in6addr_interfacelocal_allrouters __aligned(BITS_PER_LONG/8)
+	= IN6ADDR_INTERFACELOCAL_ALLROUTERS_INIT;
 EXPORT_SYMBOL(in6addr_interfacelocal_allrouters);
-const struct in6_addr in6addr_sitelocal_allrouters = IN6ADDR_SITELOCAL_ALLROUTERS_INIT;
+const struct in6_addr in6addr_sitelocal_allrouters __aligned(BITS_PER_LONG/8)
+	= IN6ADDR_SITELOCAL_ALLROUTERS_INIT;
 EXPORT_SYMBOL(in6addr_sitelocal_allrouters);
 
 static void snmp6_free_dev(struct inet6_dev *idev)

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index d59bf0d..cfe3a72 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c

@@ -404,7 +404,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
 	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
 	unsigned int nhoff = raw - skb->data;
 	unsigned int off = nhoff + sizeof(*ipv6h);
-	u8 next, nexthdr = ipv6h->nexthdr;
+	u8 nexthdr = ipv6h->nexthdr;
 
 	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
 		struct ipv6_opt_hdr *hdr;
@@ -415,26 +415,26 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
 
 		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
 		if (nexthdr == NEXTHDR_FRAGMENT) {
-			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
-			if (frag_hdr->frag_off)
-				break;
 			optlen = 8;
 		} else if (nexthdr == NEXTHDR_AUTH) {
 			optlen = (hdr->hdrlen + 2) << 2;
 		} else {
 			optlen = ipv6_optlen(hdr);
 		}
-		/* cache hdr->nexthdr, since pskb_may_pull() might
-		 * invalidate hdr
-		 */
-		next = hdr->nexthdr;
+
+		if (!pskb_may_pull(skb, off + optlen))
+			break;
+
+		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
+		if (nexthdr == NEXTHDR_FRAGMENT) {
+			struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr;
+
+			if (frag_hdr->frag_off)
+				break;
+		}
 		if (nexthdr == NEXTHDR_DEST) {
 			u16 i = 2;
 
-			/* Remember : hdr is no longer valid at this point. */
-			if (!pskb_may_pull(skb, off + optlen))
-				break;
-
 			while (1) {
 				struct ipv6_tlv_tnl_enc_lim *tel;
 
@@ -454,7 +454,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
 					i++;
 			}
 		}
-		nexthdr = next;
+		nexthdr = hdr->nexthdr;
 		off += optlen;
 	}
 	return 0;

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0cffb7d..7fa3da1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c

@@ -85,7 +85,7 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *);
 static void		ip6_dst_destroy(struct dst_entry *);
 static void		ip6_dst_ifdown(struct dst_entry *,
 				       struct net_device *dev, int how);
-static int		 ip6_dst_gc(struct dst_ops *ops);
+static void		 ip6_dst_gc(struct dst_ops *ops);
 
 static int		ip6_pkt_discard(struct sk_buff *skb);
 static int		ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb);
@@ -1792,29 +1792,30 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
 	return dst;
 }
 
-static int ip6_dst_gc(struct dst_ops *ops)
+static void ip6_dst_gc(struct dst_ops *ops)
 {
 	struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
 	int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
-	int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
 	int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
 	int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
 	unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
+	unsigned int val;
 	int entries;
 
 	entries = dst_entries_get_fast(ops);
-	if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
-	    entries <= rt_max_size)
+	if (entries > ops->gc_thresh)
+		entries = dst_entries_get_slow(ops);
+
+	if (time_after(rt_last_gc + rt_min_interval, jiffies))
 		goto out;
 
-	net->ipv6.ip6_rt_gc_expire++;
-	fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, true);
+	fib6_run_gc(atomic_inc_return(&net->ipv6.ip6_rt_gc_expire), net, true);
 	entries = dst_entries_get_slow(ops);
 	if (entries < ops->gc_thresh)
-		net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
+		atomic_set(&net->ipv6.ip6_rt_gc_expire, rt_gc_timeout >> 1);
 out:
-	net->ipv6.ip6_rt_gc_expire -= net->ipv6.ip6_rt_gc_expire>>rt_elasticity;
-	return entries > rt_max_size;
+	val = atomic_read(&net->ipv6.ip6_rt_gc_expire);
+	atomic_set(&net->ipv6.ip6_rt_gc_expire, val - (val >> rt_elasticity));
 }
 
 static int ip6_convert_metrics(struct mx6_config *mxc,
@@ -4064,7 +4065,7 @@ static int __net_init ip6_route_net_init(struct net *net)
 #endif
 
 	net->ipv6.sysctl.flush_delay = 0;
-	net->ipv6.sysctl.ip6_rt_max_size = 4096;
+	net->ipv6.sysctl.ip6_rt_max_size = INT_MAX;
 	net->ipv6.sysctl.ip6_rt_gc_min_interval = HZ / 2;
 	net->ipv6.sysctl.ip6_rt_gc_timeout = 60*HZ;
 	net->ipv6.sysctl.ip6_rt_gc_interval = 30*HZ;
@@ -4072,7 +4073,7 @@ static int __net_init ip6_route_net_init(struct net *net)
 	net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
 	net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;
 
-	net->ipv6.ip6_rt_gc_expire = 30*HZ;
+	atomic_set(&net->ipv6.ip6_rt_gc_expire, 30*HZ);
 
 	ret = 0;
 out:

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 07e397a..d7dd922 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c

@@ -2458,7 +2458,7 @@ static int __init afiucv_init(void)
 {
 	int err;
 
-	if (MACHINE_IS_VM) {
+	if (MACHINE_IS_VM && IS_ENABLED(CONFIG_IUCV)) {
 		cpcmd("QUERY USERID", iucv_userid, sizeof(iucv_userid), &err);
 		if (unlikely(err)) {
 			WARN_ON(err);
@@ -2466,11 +2466,7 @@ static int __init afiucv_init(void)
 			goto out;
 		}
 
-		pr_iucv = try_then_request_module(symbol_get(iucv_if), "iucv");
-		if (!pr_iucv) {
-			printk(KERN_WARNING "iucv_if lookup failed\n");
-			memset(&iucv_userid, 0, sizeof(iucv_userid));
-		}
+		pr_iucv = &iucv_if;
 	} else {
 		memset(&iucv_userid, 0, sizeof(iucv_userid));
 		pr_iucv = NULL;
@@ -2504,17 +2500,13 @@ static int __init afiucv_init(void)
 out_proto:
 	proto_unregister(&iucv_proto);
 out:
-	if (pr_iucv)
-		symbol_put(iucv_if);
 	return err;
 }
 
 static void __exit afiucv_exit(void)
 {
-	if (pr_iucv) {
+	if (pr_iucv)
 		afiucv_iucv_exit();
-		symbol_put(iucv_if);
-	}
 
 	unregister_netdevice_notifier(&afiucv_netdev_notifier);
 	dev_remove_pack(&iucv_packet_type);

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 1e20b71..727af51 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c

@@ -227,6 +227,8 @@ static int llc_ui_release(struct socket *sock)
 	if (llc->dev)
 		dev_put(llc->dev);
 	sock_put(sk);
+	sock_orphan(sk);
+	sock->sk = NULL;
 	llc_sk_free(sk);
 out:
 	return 0;
@@ -926,14 +928,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
  */
 static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 {
+	DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
 	struct sock *sk = sock->sk;
 	struct llc_sock *llc = llc_sk(sk);
-	DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
 	int flags = msg->msg_flags;
 	int noblock = flags & MSG_DONTWAIT;
+	int rc = -EINVAL, copied = 0, hdrlen, hh_len;
 	struct sk_buff *skb = NULL;
+	struct net_device *dev;
 	size_t size = 0;
-	int rc = -EINVAL, copied = 0, hdrlen;
 
 	dprintk("%s: sending from %02X to %02X\n", __func__,
 		llc->laddr.lsap, llc->daddr.lsap);
@@ -953,22 +956,29 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 		if (rc)
 			goto out;
 	}
-	hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
+	dev = llc->dev;
+	hh_len = LL_RESERVED_SPACE(dev);
+	hdrlen = llc_ui_header_len(sk, addr);
 	size = hdrlen + len;
-	if (size > llc->dev->mtu)
-		size = llc->dev->mtu;
+	size = min_t(size_t, size, READ_ONCE(dev->mtu));
 	copied = size - hdrlen;
 	rc = -EINVAL;
 	if (copied < 0)
 		goto out;
 	release_sock(sk);
-	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
+	skb = sock_alloc_send_skb(sk, hh_len + size, noblock, &rc);
 	lock_sock(sk);
 	if (!skb)
 		goto out;
-	skb->dev      = llc->dev;
+	if (sock_flag(sk, SOCK_ZAPPED) ||
+	    llc->dev != dev ||
+	    hdrlen != llc_ui_header_len(sk, addr) ||
+	    hh_len != LL_RESERVED_SPACE(dev) ||
+	    size > READ_ONCE(dev->mtu))
+		goto out;
+	skb->dev      = dev;
 	skb->protocol = llc_proto_type(addr->sllc_arphrd);
-	skb_reserve(skb, hdrlen);
+	skb_reserve(skb, hh_len + hdrlen);
 	rc = memcpy_from_msg(skb_put(skb, copied), msg, copied);
 	if (rc)
 		goto out;

diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index 64d4bef..4900a27 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c

@@ -135,22 +135,15 @@ static struct packet_type llc_packet_type __read_mostly = {
 	.func = llc_rcv,
 };
 
-static struct packet_type llc_tr_packet_type __read_mostly = {
-	.type = cpu_to_be16(ETH_P_TR_802_2),
-	.func = llc_rcv,
-};
-
 static int __init llc_init(void)
 {
 	dev_add_pack(&llc_packet_type);
-	dev_add_pack(&llc_tr_packet_type);
 	return 0;
 }
 
 static void __exit llc_exit(void)
 {
 	dev_remove_pack(&llc_packet_type);
-	dev_remove_pack(&llc_tr_packet_type);
 }
 
 module_init(llc_init);

diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h
index 8055e39..2477caf 100644
--- a/net/ncsi/internal.h
+++ b/net/ncsi/internal.h

@@ -69,9 +69,12 @@ enum {
 };
 
 struct ncsi_channel_version {
-	u32 version;		/* Supported BCD encoded NCSI version */
-	u32 alpha2;		/* Supported BCD encoded NCSI version */
-	u8  fw_name[12];	/* Firware name string                */
+	u8   major;		/* NCSI version major */
+	u8   minor;		/* NCSI version minor */
+	u8   update;		/* NCSI version update */
+	char alpha1;		/* NCSI version alpha1 */
+	char alpha2;		/* NCSI version alpha2 */
+	u8  fw_name[12];	/* Firmware name string                */
 	u32 fw_version;		/* Firmware version                   */
 	u16 pci_ids[4];		/* PCI identification                 */
 	u32 mf_id;		/* Manufacture ID                     */

diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
index 9073911..5c88201 100644
--- a/net/ncsi/ncsi-netlink.c
+++ b/net/ncsi/ncsi-netlink.c

@@ -71,8 +71,8 @@ static int ncsi_write_channel_info(struct sk_buff *skb,
 	if (ndp->force_channel == nc)
 		nla_put_flag(skb, NCSI_CHANNEL_ATTR_FORCED);
 
-	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.version);
-	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.alpha2);
+	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.major);
+	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.minor);
 	nla_put_string(skb, NCSI_CHANNEL_ATTR_VERSION_STR, nc->version.fw_name);
 
 	vid_nest = nla_nest_start(skb, NCSI_CHANNEL_ATTR_VLAN_LIST);

diff --git a/net/ncsi/ncsi-pkt.h b/net/ncsi/ncsi-pkt.h
index 91b4b66..0bf62b4 100644
--- a/net/ncsi/ncsi-pkt.h
+++ b/net/ncsi/ncsi-pkt.h

@@ -164,9 +164,12 @@ struct ncsi_rsp_gls_pkt {
 /* Get Version ID */
 struct ncsi_rsp_gvi_pkt {
 	struct ncsi_rsp_pkt_hdr rsp;          /* Response header */
-	__be32                  ncsi_version; /* NCSI version    */
+	unsigned char           major;        /* NCSI version major */
+	unsigned char           minor;        /* NCSI version minor */
+	unsigned char           update;       /* NCSI version update */
+	unsigned char           alpha1;       /* NCSI version alpha1 */
 	unsigned char           reserved[3];  /* Reserved        */
-	unsigned char           alpha2;       /* NCSI version    */
+	unsigned char           alpha2;       /* NCSI version alpha2 */
 	unsigned char           fw_name[12];  /* f/w name string */
 	__be32                  fw_version;   /* f/w version     */
 	__be16                  pci_ids[4];   /* PCI IDs         */

diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
index 42878d8..1ae1de2 100644
--- a/net/ncsi/ncsi-rsp.c
+++ b/net/ncsi/ncsi-rsp.c

@@ -20,6 +20,19 @@
 #include "internal.h"
 #include "ncsi-pkt.h"
 
+/* Nibbles within [0xA, 0xF] add zero "0" to the returned value.
+ * Optional fields (encoded as 0xFF) will default to zero.
+ */
+static u8 decode_bcd_u8(u8 x)
+{
+	int lo = x & 0xF;
+	int hi = x >> 4;
+
+	lo = lo < 0xA ? lo : 0;
+	hi = hi < 0xA ? hi : 0;
+	return lo + hi * 10;
+}
+
 static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
 				 unsigned short payload)
 {
@@ -610,9 +623,18 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr)
 	if (!nc)
 		return -ENODEV;
 
-	/* Update to channel's version info */
+	/* Update channel's version info
+	 *
+	 * Major, minor, and update fields are supposed to be
+	 * unsigned integers encoded as packed BCD.
+	 *
+	 * Alpha1 and alpha2 are ISO/IEC 8859-1 characters.
+	 */
 	ncv = &nc->version;
-	ncv->version = ntohl(rsp->ncsi_version);
+	ncv->major = decode_bcd_u8(rsp->major);
+	ncv->minor = decode_bcd_u8(rsp->minor);
+	ncv->update = decode_bcd_u8(rsp->update);
+	ncv->alpha1 = rsp->alpha1;
 	ncv->alpha2 = rsp->alpha2;
 	memcpy(ncv->fw_name, rsp->fw_name, 12);
 	ncv->fw_version = ntohl(rsp->fw_version);

diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 97d4110..8792cad 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c

@@ -270,8 +270,8 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs,
 			skb->dev = dst->dev;
 			icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 				    ICMPV6_EXC_HOPLIMIT, 0);
-			__IP6_INC_STATS(net, ip6_dst_idev(dst),
-					IPSTATS_MIB_INHDRERRORS);
+			IP6_INC_STATS(net, ip6_dst_idev(dst),
+				      IPSTATS_MIB_INHDRERRORS);
 
 			return false;
 		}
@@ -286,7 +286,7 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs,
 	{
 		if (ip_hdr(skb)->ttl <= 1) {
 			/* Tell the sender its packet died... */
-			__IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
+			IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
 			icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0);
 			return false;
 		}

diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index cdc744a..a161565 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c

@@ -202,11 +202,12 @@ void nf_logger_put(int pf, enum nf_log_type type)
 		return;
 	}
 
-	BUG_ON(loggers[pf][type] == NULL);
-
 	rcu_read_lock();
 	logger = rcu_dereference(loggers[pf][type]);
-	module_put(logger->me);
+	if (!logger)
+		WARN_ON_ONCE(1);
+	else
+		module_put(logger->me);
 	rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_logger_put);

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 27c24c9..407346b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c

@@ -22,6 +22,8 @@
 #include <net/net_namespace.h>
 #include <net/sock.h>
 
+#define NFT_SET_MAX_ANONLEN 16
+
 static LIST_HEAD(nf_tables_expressions);
 static LIST_HEAD(nf_tables_objects);
 
@@ -744,6 +746,30 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
 	return ret;
 }
 
+static bool nft_supported_family(u8 family)
+{
+	return false
+#ifdef CONFIG_NF_TABLES_INET
+		|| family == NFPROTO_INET
+#endif
+#ifdef CONFIG_NF_TABLES_IPV4
+		|| family == NFPROTO_IPV4
+#endif
+#ifdef CONFIG_NF_TABLES_ARP
+		|| family == NFPROTO_ARP
+#endif
+#ifdef CONFIG_NF_TABLES_NETDEV
+		|| family == NFPROTO_NETDEV
+#endif
+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
+		|| family == NFPROTO_BRIDGE
+#endif
+#ifdef CONFIG_NF_TABLES_IPV6
+		|| family == NFPROTO_IPV6
+#endif
+		;
+}
+
 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 			      struct sk_buff *skb, const struct nlmsghdr *nlh,
 			      const struct nlattr * const nla[],
@@ -759,6 +785,9 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 	struct nft_ctx ctx;
 	int err;
 
+	if (!nft_supported_family(family))
+		return -EOPNOTSUPP;
+
 	afi = nf_tables_afinfo_lookup(net, family, true);
 	if (IS_ERR(afi))
 		return PTR_ERR(afi);
@@ -2817,6 +2846,9 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
 		if (p[1] != 'd' || strchr(p + 2, '%'))
 			return -EINVAL;
 
+		if (strnlen(name, NFT_SET_MAX_ANONLEN) >= NFT_SET_MAX_ANONLEN)
+			return -EINVAL;
+
 		inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
 		if (inuse == NULL)
 			return -ENOMEM;
@@ -5889,16 +5921,10 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
 	data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
 
 	switch (data->verdict.code) {
-	default:
-		switch (data->verdict.code & NF_VERDICT_MASK) {
-		case NF_ACCEPT:
-		case NF_DROP:
-		case NF_QUEUE:
-			break;
-		default:
-			return -EINVAL;
-		}
-		/* fall through */
+	case NF_ACCEPT:
+	case NF_DROP:
+	case NF_QUEUE:
+		break;
 	case NFT_CONTINUE:
 	case NFT_BREAK:
 	case NFT_RETURN:
@@ -5918,6 +5944,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
 
 		data->verdict.chain = chain;
 		break;
+	default:
+		return -EINVAL;
 	}
 
 	desc->len = sizeof(data->verdict);

diff --git a/net/netfilter/nft_byteorder.c b/net/netfilter/nft_byteorder.c
index dba1612..8c4ee49 100644
--- a/net/netfilter/nft_byteorder.c
+++ b/net/netfilter/nft_byteorder.c

@@ -41,19 +41,20 @@ static void nft_byteorder_eval(const struct nft_expr *expr,
 
 	switch (priv->size) {
 	case 8: {
+		u64 *dst64 = (void *)dst;
 		u64 src64;
 
 		switch (priv->op) {
 		case NFT_BYTEORDER_NTOH:
 			for (i = 0; i < priv->len / 8; i++) {
 				src64 = get_unaligned((u64 *)&src[i]);
-				put_unaligned_be64(src64, &dst[i]);
+				put_unaligned_be64(src64, &dst64[i]);
 			}
 			break;
 		case NFT_BYTEORDER_HTON:
 			for (i = 0; i < priv->len / 8; i++) {
 				src64 = get_unaligned_be64(&src[i]);
-				put_unaligned(src64, (u64 *)&dst[i]);
+				put_unaligned(src64, &dst64[i]);
 			}
 			break;
 		}

diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 8281656..b87b733 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c

@@ -214,6 +214,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
 static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
 {
 	struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
+	u32 l4proto;
 	u32 flags;
 	int err;
 
@@ -226,12 +227,18 @@ static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
 		return -EINVAL;
 
 	flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS]));
-	if (flags & ~NFT_RULE_COMPAT_F_MASK)
+	if (flags & NFT_RULE_COMPAT_F_UNUSED ||
+	    flags & ~NFT_RULE_COMPAT_F_MASK)
 		return -EINVAL;
 	if (flags & NFT_RULE_COMPAT_F_INV)
 		*inv = true;
 
-	*proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
+	l4proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
+	if (l4proto > U16_MAX)
+		return -EINVAL;
+
+	*proto = l4proto;
+
 	return 0;
 }
 

diff --git a/net/netlabel/netlabel_calipso.c b/net/netlabel/netlabel_calipso.c
index d177dd0..e0d63fb 100644
--- a/net/netlabel/netlabel_calipso.c
+++ b/net/netlabel/netlabel_calipso.c

@@ -68,6 +68,28 @@ static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = {
 	[NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 },
 };
 
+static const struct netlbl_calipso_ops *calipso_ops;
+
+/**
+ * netlbl_calipso_ops_register - Register the CALIPSO operations
+ * @ops: ops to register
+ *
+ * Description:
+ * Register the CALIPSO packet engine operations.
+ *
+ */
+const struct netlbl_calipso_ops *
+netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
+{
+	return xchg(&calipso_ops, ops);
+}
+EXPORT_SYMBOL(netlbl_calipso_ops_register);
+
+static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
+{
+	return ACCESS_ONCE(calipso_ops);
+}
+
 /* NetLabel Command Handlers
  */
 /**
@@ -110,16 +132,19 @@ static int netlbl_calipso_add_pass(struct genl_info *info,
  *
  */
 static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info)
-
 {
 	int ret_val = -EINVAL;
 	struct netlbl_audit audit_info;
+	const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 
 	if (!info->attrs[NLBL_CALIPSO_A_DOI] ||
 	    !info->attrs[NLBL_CALIPSO_A_MTYPE])
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	if (!ops)
+		return -EOPNOTSUPP;
+
+	netlbl_netlink_auditinfo(&audit_info);
 	switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) {
 	case CALIPSO_MAP_PASS:
 		ret_val = netlbl_calipso_add_pass(info, &audit_info);
@@ -301,7 +326,7 @@ static int netlbl_calipso_remove(struct sk_buff *skb, struct genl_info *info)
 	if (!info->attrs[NLBL_CALIPSO_A_DOI])
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 	cb_arg.doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
 	cb_arg.audit_info = &audit_info;
 	ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
@@ -375,27 +400,6 @@ int __init netlbl_calipso_genl_init(void)
 	return genl_register_family(&netlbl_calipso_gnl_family);
 }
 
-static const struct netlbl_calipso_ops *calipso_ops;
-
-/**
- * netlbl_calipso_ops_register - Register the CALIPSO operations
- *
- * Description:
- * Register the CALIPSO packet engine operations.
- *
- */
-const struct netlbl_calipso_ops *
-netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
-{
-	return xchg(&calipso_ops, ops);
-}
-EXPORT_SYMBOL(netlbl_calipso_ops_register);
-
-static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
-{
-	return ACCESS_ONCE(calipso_ops);
-}
-
 /**
  * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
  * @doi_def: the DOI structure

diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index e252f62..a0a145d 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c

@@ -420,7 +420,7 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
 	    !info->attrs[NLBL_CIPSOV4_A_MTYPE])
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 	switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) {
 	case CIPSO_V4_MAP_TRANS:
 		ret_val = netlbl_cipsov4_add_std(info, &audit_info);
@@ -715,7 +715,7 @@ static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
 	if (!info->attrs[NLBL_CIPSOV4_A_DOI])
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 	cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
 	cb_arg.audit_info = &audit_info;
 	ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,

diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 71ba69c..43c5124 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c

@@ -447,7 +447,7 @@ static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info)
 	     (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL)))
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 
 	return netlbl_mgmt_add_common(info, &audit_info);
 }
@@ -470,7 +470,7 @@ static int netlbl_mgmt_remove(struct sk_buff *skb, struct genl_info *info)
 	if (!info->attrs[NLBL_MGMT_A_DOMAIN])
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 
 	domain = nla_data(info->attrs[NLBL_MGMT_A_DOMAIN]);
 	return netlbl_domhsh_remove(domain, AF_UNSPEC, &audit_info);
@@ -570,7 +570,7 @@ static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info)
 	     (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL)))
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 
 	return netlbl_mgmt_add_common(info, &audit_info);
 }
@@ -589,7 +589,7 @@ static int netlbl_mgmt_removedef(struct sk_buff *skb, struct genl_info *info)
 {
 	struct netlbl_audit audit_info;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 
 	return netlbl_domhsh_remove_default(AF_UNSPEC, &audit_info);
 }

diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 0067f47..ff52ff2 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c

@@ -827,7 +827,7 @@ static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
 	if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
 		value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
 		if (value == 1 || value == 0) {
-			netlbl_netlink_auditinfo(skb, &audit_info);
+			netlbl_netlink_auditinfo(&audit_info);
 			netlbl_unlabel_acceptflg_set(value, &audit_info);
 			return 0;
 		}
@@ -910,7 +910,7 @@ static int netlbl_unlabel_staticadd(struct sk_buff *skb,
 	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 
 	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
 	if (ret_val != 0)
@@ -960,7 +960,7 @@ static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
 	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 
 	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
 	if (ret_val != 0)
@@ -1007,7 +1007,7 @@ static int netlbl_unlabel_staticremove(struct sk_buff *skb,
 	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 
 	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
 	if (ret_val != 0)
@@ -1047,7 +1047,7 @@ static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
 	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
 		return -EINVAL;
 
-	netlbl_netlink_auditinfo(skb, &audit_info);
+	netlbl_netlink_auditinfo(&audit_info);
 
 	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
 	if (ret_val != 0)

diff --git a/net/netlabel/netlabel_user.h b/net/netlabel/netlabel_user.h
index 4a397cd..2c60867 100644
--- a/net/netlabel/netlabel_user.h
+++ b/net/netlabel/netlabel_user.h

@@ -42,11 +42,9 @@
 
 /**
  * netlbl_netlink_auditinfo - Fetch the audit information from a NETLINK msg
- * @skb: the packet
  * @audit_info: NetLabel audit information
  */
-static inline void netlbl_netlink_auditinfo(struct sk_buff *skb,
-					    struct netlbl_audit *audit_info)
+static inline void netlbl_netlink_auditinfo(struct netlbl_audit *audit_info)
 {
 	security_task_getsecid(current, &audit_info->secid);
 	audit_info->loginuid = audit_get_loginuid(current);

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 89ece1f..85f2f2b 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c

@@ -342,7 +342,7 @@ static void netlink_skb_destructor(struct sk_buff *skb)
 	if (is_vmalloc_addr(skb->head)) {
 		if (!skb->cloned ||
 		    !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
-			vfree(skb->head);
+			vfree_atomic(skb->head);
 
 		skb->head = NULL;
 	}

diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index d42c603..2d9934d 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c

@@ -1209,6 +1209,10 @@ void nci_free_device(struct nci_dev *ndev)
 {
 	nfc_free_device(ndev->nfc_dev);
 	nci_hci_deallocate(ndev);
+
+	/* drop partial rx data packet if present */
+	if (ndev->rx_data_reassembly)
+		kfree_skb(ndev->rx_data_reassembly);
 	kfree(ndev);
 }
 EXPORT_SYMBOL(nci_free_device);

diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index b405f77..2628c1d 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c

@@ -315,7 +315,7 @@ static int rds_recv_track_latency(struct rds_sock *rs, char __user *optval,
 
 	rs->rs_rx_traces = trace.rx_traces;
 	for (i = 0; i < rs->rs_rx_traces; i++) {
-		if (trace.rx_trace_pos[i] > RDS_MSG_RX_DGRAM_TRACE_MAX) {
+		if (trace.rx_trace_pos[i] >= RDS_MSG_RX_DGRAM_TRACE_MAX) {
 			rs->rs_rx_traces = 0;
 			return -EFAULT;
 		}

diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 2432c11..8d14aeb 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c

@@ -48,6 +48,14 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
 
 	_enter("%d", conn->debug_id);
 
+	if (sp && sp->hdr.type == RXRPC_PACKET_TYPE_ACK) {
+		if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
+				  &pkt.ack, sizeof(pkt.ack)) < 0)
+			return;
+		if (pkt.ack.reason == RXRPC_ACK_PING_RESPONSE)
+			return;
+	}
+
 	chan = &conn->channels[sp->hdr.cid & RXRPC_CHANNELMASK];
 
 	/* If the last call got moved on whilst we were waiting to run, just

diff --git a/net/rxrpc/conn_service.c b/net/rxrpc/conn_service.c
index f6fcdb3..7c57459 100644
--- a/net/rxrpc/conn_service.c
+++ b/net/rxrpc/conn_service.c

@@ -29,7 +29,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer,
 	struct rxrpc_conn_proto k;
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 	struct rb_node *p;
-	unsigned int seq = 0;
+	unsigned int seq = 1;
 
 	k.epoch	= sp->hdr.epoch;
 	k.cid	= sp->hdr.cid & RXRPC_CIDMASK;
@@ -39,6 +39,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer,
 		 * under just the RCU read lock, so we have to check for
 		 * changes.
 		 */
+		seq++; /* 2 on the 1st/lockless path, otherwise odd */
 		read_seqbegin_or_lock(&peer->service_conn_lock, &seq);
 
 		p = rcu_dereference_raw(peer->service_conns.rb_node);

diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c
index e2d64c7..699d5ba 100644
--- a/net/sunrpc/xprtmultipath.c
+++ b/net/sunrpc/xprtmultipath.c

@@ -235,8 +235,9 @@ struct rpc_xprt *xprt_iter_current_entry(struct rpc_xprt_iter *xpi)
 	return xprt_switch_find_current_entry(head, xpi->xpi_cursor);
 }
 
-bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
-			      const struct sockaddr *sap)
+static
+bool __rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
+				const struct sockaddr *sap)
 {
 	struct list_head *head;
 	struct rpc_xprt *pos;
@@ -255,6 +256,18 @@ bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
 	return false;
 }
 
+bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
+			      const struct sockaddr *sap)
+{
+	bool res;
+
+	rcu_read_lock();
+	res = __rpc_xprt_switch_has_addr(xps, sap);
+	rcu_read_unlock();
+
+	return res;
+}
+
 static
 struct rpc_xprt *xprt_switch_find_next_entry(struct list_head *head,
 		const struct rpc_xprt *cur)

diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 506cbd1..db21e00 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c

@@ -931,6 +931,12 @@ int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
 
 #ifdef CONFIG_TIPC_MEDIA_UDP
 	if (attrs[TIPC_NLA_BEARER_UDP_OPTS]) {
+		if (b->media->type_id != TIPC_MEDIA_TYPE_UDP) {
+			rtnl_unlock();
+			NL_SET_ERR_MSG(info->extack, "UDP option is unsupported");
+			return -EINVAL;
+		}
+
 		err = tipc_udp_nl_bearer_add(b,
 					     attrs[TIPC_NLA_BEARER_UDP_OPTS]);
 		if (err) {

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 8d25d50..b185577 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c

@@ -1127,13 +1127,11 @@ static void unix_state_double_lock(struct sock *sk1, struct sock *sk2)
 		unix_state_lock(sk1);
 		return;
 	}
-	if (sk1 < sk2) {
-		unix_state_lock(sk1);
-		unix_state_lock_nested(sk2);
-	} else {
-		unix_state_lock(sk2);
-		unix_state_lock_nested(sk1);
-	}
+	if (sk1 > sk2)
+		swap(sk1, sk2);
+
+	unix_state_lock(sk1);
+	unix_state_lock_nested(sk2, U_LOCK_SECOND);
 }
 
 static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2)
@@ -1352,7 +1350,7 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
 		goto out_unlock;
 	}
 
-	unix_state_lock_nested(sk);
+	unix_state_lock_nested(sk, U_LOCK_SECOND);
 
 	if (sk->sk_state != st) {
 		unix_state_unlock(sk);

diff --git a/net/unix/diag.c b/net/unix/diag.c
index 3183d9b..d6ceac6 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c

@@ -80,7 +80,7 @@ static int sk_diag_dump_icons(struct sock *sk, struct sk_buff *nlskb)
 			 * queue lock. With the other's queue locked it's
 			 * OK to lock the state.
 			 */
-			unix_state_lock_nested(req);
+			unix_state_lock_nested(req, U_LOCK_DIAG);
 			peer = unix_sk(req)->peer;
 			buf[i++] = (peer ? sock_i_ino(peer) : 0);
 			unix_state_unlock(req);

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 721e16e..dca5c9b 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c

@@ -1015,8 +1015,12 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,
 				list_add(&new->hidden_list,
 					 &hidden->hidden_list);
 				hidden->refcount++;
+
+				ies = (void *)rcu_access_pointer(new->pub.beacon_ies);
 				rcu_assign_pointer(new->pub.beacon_ies,
 						   hidden->pub.beacon_ies);
+				if (ies)
+					kfree_rcu(ies, rcu_head);
 			}
 		} else {
 			/*

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 2cef8d4..4f41aa6 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c

@@ -604,6 +604,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
 
 	tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
 	if (tmpns) {
+		if (!tmpname) {
+			info = "empty profile name";
+			goto fail;
+		}
 		*ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
 		if (!*ns_name) {
 			info = "out of memory";

diff --git a/security/security.c b/security/security.c
index 22bef42..dff185c 100644
--- a/security/security.c
+++ b/security/security.c

@@ -886,6 +886,23 @@ int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	return call_int_hook(file_ioctl, 0, file, cmd, arg);
 }
 
+/**
+ * security_file_ioctl_compat() - Check if an ioctl is allowed in compat mode
+ * @file: associated file
+ * @cmd: ioctl cmd
+ * @arg: ioctl arguments
+ *
+ * Compat version of security_file_ioctl() that correctly handles 32-bit
+ * processes running on 64-bit kernels.
+ *
+ * Return: Returns 0 if permission is granted.
+ */
+int security_file_ioctl_compat(struct file *file, unsigned int cmd,
+			       unsigned long arg)
+{
+	return call_int_hook(file_ioctl_compat, 0, file, cmd, arg);
+}
+
 static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
 {
 	/*

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index eaff639..bb24c8e 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c

@@ -3684,6 +3684,33 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
 	return error;
 }
 
+static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd,
+			      unsigned long arg)
+{
+	/*
+	 * If we are in a 64-bit kernel running 32-bit userspace, we need to
+	 * make sure we don't compare 32-bit flags to 64-bit flags.
+	 */
+	switch (cmd) {
+	case FS_IOC32_GETFLAGS:
+		cmd = FS_IOC_GETFLAGS;
+		break;
+	case FS_IOC32_SETFLAGS:
+		cmd = FS_IOC_SETFLAGS;
+		break;
+	case FS_IOC32_GETVERSION:
+		cmd = FS_IOC_GETVERSION;
+		break;
+	case FS_IOC32_SETVERSION:
+		cmd = FS_IOC_SETVERSION;
+		break;
+	default:
+		break;
+	}
+
+	return selinux_file_ioctl(file, cmd, arg);
+}
+
 static int default_noexec;
 
 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
@@ -6776,6 +6803,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
 	LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
 	LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
 	LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
+	LSM_HOOK_INIT(file_ioctl_compat, selinux_file_ioctl_compat),
 	LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
 	LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
 	LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index fe07066..a6e81ef 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c

@@ -4651,6 +4651,7 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
 	LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security),
 	LSM_HOOK_INIT(file_free_security, smack_file_free_security),
 	LSM_HOOK_INIT(file_ioctl, smack_file_ioctl),
+	LSM_HOOK_INIT(file_ioctl_compat, smack_file_ioctl),
 	LSM_HOOK_INIT(file_lock, smack_file_lock),
 	LSM_HOOK_INIT(file_fcntl, smack_file_fcntl),
 	LSM_HOOK_INIT(mmap_file, smack_mmap_file),

diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index 213b8c5..195f9b7 100644
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c

@@ -516,6 +516,7 @@ static struct security_hook_list tomoyo_hooks[] __lsm_ro_after_init = {
 	LSM_HOOK_INIT(path_rename, tomoyo_path_rename),
 	LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr),
 	LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl),
+	LSM_HOOK_INIT(file_ioctl_compat, tomoyo_file_ioctl),
 	LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod),
 	LSM_HOOK_INIT(path_chown, tomoyo_path_chown),
 	LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot),

diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 978719f..bb76b9c 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c

@@ -2545,6 +2545,12 @@ static const struct pci_device_id azx_ids[] = {
 	/* Cannonlake */
 	{ PCI_DEVICE(0x8086, 0x9dc8),
 	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
+	/* Icelake */
+	{ PCI_DEVICE(0x8086, 0x34c8),
+	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
+	/* Arrow Lake */
+	{ PCI_DEVICE(0x8086, 0x7728),
+	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
 	/* Broxton-P(Apollolake) */
 	{ PCI_DEVICE(0x8086, 0x5a98),
 	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON },

diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 9263cb5..6215d85 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c

@@ -263,6 +263,7 @@ enum {
 	CXT_FIXUP_MUTE_LED_GPIO,
 	CXT_FIXUP_HEADSET_MIC,
 	CXT_FIXUP_HP_MIC_NO_PRESENCE,
+	CXT_PINCFG_SWS_JS201D,
 };
 
 /* for hda_fixup_thinkpad_acpi() */
@@ -754,6 +755,17 @@ static const struct hda_pintbl cxt_pincfg_lemote[] = {
 	{}
 };
 
+/* SuoWoSi/South-holding JS201D with sn6140 */
+static const struct hda_pintbl cxt_pincfg_sws_js201d[] = {
+	{ 0x16, 0x03211040 }, /* hp out */
+	{ 0x17, 0x91170110 }, /* SPK/Class_D */
+	{ 0x18, 0x95a70130 }, /* Internal mic */
+	{ 0x19, 0x03a11020 }, /* Headset Mic */
+	{ 0x1a, 0x40f001f0 }, /* Not used */
+	{ 0x21, 0x40f001f0 }, /* Not used */
+	{}
+};
+
 static const struct hda_fixup cxt_fixups[] = {
 	[CXT_PINCFG_LENOVO_X200] = {
 		.type = HDA_FIXUP_PINS,
@@ -905,6 +917,10 @@ static const struct hda_fixup cxt_fixups[] = {
 		.chained = true,
 		.chain_id = CXT_FIXUP_HEADSET_MIC,
 	},
+	[CXT_PINCFG_SWS_JS201D] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = cxt_pincfg_sws_js201d,
+	},
 };
 
 static const struct snd_pci_quirk cxt5045_fixups[] = {
@@ -973,6 +989,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
 	SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO),
 	SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
+	SND_PCI_QUIRK(0x14f1, 0x0265, "SWS JS201D", CXT_PINCFG_SWS_JS201D),
 	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
 	SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
@@ -1011,6 +1028,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = {
 	{ .id = CXT_FIXUP_HP_DOCK, .name = "hp-dock" },
 	{ .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" },
 	{ .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" },
+	{ .id = CXT_PINCFG_SWS_JS201D, .name = "sws-js201d" },
 	{}
 };
 

diff --git a/sound/pci/oxygen/oxygen_mixer.c b/sound/pci/oxygen/oxygen_mixer.c
index 4ca1266..64a8268 100644
--- a/sound/pci/oxygen/oxygen_mixer.c
+++ b/sound/pci/oxygen/oxygen_mixer.c

@@ -730,7 +730,7 @@ static int ac97_fp_rec_volume_put(struct snd_kcontrol *ctl,
 	oldreg = oxygen_read_ac97(chip, 1, AC97_REC_GAIN);
 	newreg = oldreg & ~0x0707;
 	newreg = newreg | (value->value.integer.value[0] & 7);
-	newreg = newreg | ((value->value.integer.value[0] & 7) << 8);
+	newreg = newreg | ((value->value.integer.value[1] & 7) << 8);
 	change = newreg != oldreg;
 	if (change)
 		oxygen_write_ac97(chip, 1, AC97_REC_GAIN, newreg);

diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c
index e2c1194..32048c4 100644
--- a/sound/soc/codecs/cs35l33.c
+++ b/sound/soc/codecs/cs35l33.c

@@ -26,13 +26,11 @@
 #include <sound/soc-dapm.h>
 #include <sound/initval.h>
 #include <sound/tlv.h>
-#include <linux/gpio.h>
 #include <linux/gpio/consumer.h>
 #include <sound/cs35l33.h>
 #include <linux/pm_runtime.h>
 #include <linux/regulator/consumer.h>
 #include <linux/regulator/machine.h>
-#include <linux/of_gpio.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
 #include <linux/of_irq.h>
@@ -1173,7 +1171,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client,
 
 	/* We could issue !RST or skip it based on AMP topology */
 	cs35l33->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
-			"reset-gpios", GPIOD_OUT_HIGH);
+			"reset", GPIOD_OUT_HIGH);
 	if (IS_ERR(cs35l33->reset_gpio)) {
 		dev_err(&i2c_client->dev, "%s ERROR: Can't get reset GPIO\n",
 			__func__);

diff --git a/sound/soc/codecs/cs35l34.c b/sound/soc/codecs/cs35l34.c
index 1e05026..8a0ca34 100644
--- a/sound/soc/codecs/cs35l34.c
+++ b/sound/soc/codecs/cs35l34.c

@@ -24,14 +24,12 @@
 #include <linux/regulator/machine.h>
 #include <linux/pm_runtime.h>
 #include <linux/of_device.h>
-#include <linux/of_gpio.h>
 #include <linux/of_irq.h>
 #include <sound/core.h>
 #include <sound/pcm.h>
 #include <sound/pcm_params.h>
 #include <sound/soc.h>
 #include <sound/soc-dapm.h>
-#include <linux/gpio.h>
 #include <linux/gpio/consumer.h>
 #include <sound/initval.h>
 #include <sound/tlv.h>
@@ -1068,7 +1066,7 @@ static int cs35l34_i2c_probe(struct i2c_client *i2c_client,
 		dev_err(&i2c_client->dev, "Failed to request IRQ: %d\n", ret);
 
 	cs35l34->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
-				"reset-gpios", GPIOD_OUT_LOW);
+				"reset", GPIOD_OUT_LOW);
 	if (IS_ERR(cs35l34->reset_gpio))
 		return PTR_ERR(cs35l34->reset_gpio);
 

diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c
index 643e37f..ad5d527 100644
--- a/sound/soc/codecs/cs43130.c
+++ b/sound/soc/codecs/cs43130.c

@@ -581,7 +581,7 @@ static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk,
 		break;
 	case SND_SOC_DAIFMT_LEFT_J:
 		hi_size = bitwidth_sclk;
-		frm_delay = 2;
+		frm_delay = 0;
 		frm_phase = 1;
 		break;
 	case SND_SOC_DAIFMT_DSP_A:
@@ -1675,7 +1675,7 @@ static ssize_t cs43130_show_dc_r(struct device *dev,
 	return cs43130_show_dc(dev, buf, HP_RIGHT);
 }
 
-static u16 const cs43130_ac_freq[CS43130_AC_FREQ] = {
+static const u16 cs43130_ac_freq[CS43130_AC_FREQ] = {
 	24,
 	43,
 	93,
@@ -2351,7 +2351,7 @@ static const struct regmap_config cs43130_regmap = {
 	.use_single_rw		= true, /* needed for regcache_sync */
 };
 
-static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD] = {
+static const u16 cs43130_dc_threshold[CS43130_DC_THRESHOLD] = {
 	50,
 	120,
 };

diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c
index 793c876..5a31a4d 100644
--- a/sound/soc/codecs/da7219-aad.c
+++ b/sound/soc/codecs/da7219-aad.c

@@ -650,7 +650,7 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct snd_soc_codec *cod
 		aad_pdata->mic_det_thr =
 			da7219_aad_fw_mic_det_thr(codec, fw_val32);
 	else
-		aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_500_OHMS;
+		aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_200_OHMS;
 
 	if (fwnode_property_read_u32(aad_np, "dlg,jack-ins-deb", &fw_val32) >= 0)
 		aad_pdata->jack_ins_deb =

diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index 822c421..536a338 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c

@@ -417,6 +417,7 @@ struct rt5645_priv {
 	struct regulator_bulk_data supplies[ARRAY_SIZE(rt5645_supply_names)];
 	struct rt5645_eq_param_s *eq_param;
 	struct timer_list btn_check_timer;
+	struct mutex jd_mutex;
 
 	int codec_type;
 	int sysclk;
@@ -3158,6 +3159,8 @@ static int rt5645_jack_detect(struct snd_soc_codec *codec, int jack_insert)
 				rt5645_enable_push_button_irq(codec, true);
 			}
 		} else {
+			if (rt5645->en_button_func)
+				rt5645_enable_push_button_irq(codec, false);
 			snd_soc_dapm_disable_pin(dapm, "Mic Det Power");
 			snd_soc_dapm_sync(dapm);
 			rt5645->jack_type = SND_JACK_HEADPHONE;
@@ -3238,6 +3241,8 @@ static void rt5645_jack_detect_work(struct work_struct *work)
 	if (!rt5645->codec)
 		return;
 
+	mutex_lock(&rt5645->jd_mutex);
+
 	switch (rt5645->pdata.jd_mode) {
 	case 0: /* Not using rt5645 JD */
 		if (rt5645->gpiod_hp_det) {
@@ -3250,6 +3255,7 @@ static void rt5645_jack_detect_work(struct work_struct *work)
 				    report, SND_JACK_HEADPHONE);
 		snd_soc_jack_report(rt5645->mic_jack,
 				    report, SND_JACK_MICROPHONE);
+		mutex_unlock(&rt5645->jd_mutex);
 		return;
 	default: /* read rt5645 jd1_1 status */
 		val = snd_soc_read(rt5645->codec, RT5645_INT_IRQ_ST) & 0x1000;
@@ -3259,7 +3265,7 @@ static void rt5645_jack_detect_work(struct work_struct *work)
 
 	if (!val && (rt5645->jack_type == 0)) { /* jack in */
 		report = rt5645_jack_detect(rt5645->codec, 1);
-	} else if (!val && rt5645->jack_type != 0) {
+	} else if (!val && rt5645->jack_type == SND_JACK_HEADSET) {
 		/* for push button and jack out */
 		btn_type = 0;
 		if (snd_soc_read(rt5645->codec, RT5645_INT_IRQ_ST) & 0x4) {
@@ -3315,6 +3321,8 @@ static void rt5645_jack_detect_work(struct work_struct *work)
 		rt5645_jack_detect(rt5645->codec, 0);
 	}
 
+	mutex_unlock(&rt5645->jd_mutex);
+
 	snd_soc_jack_report(rt5645->hp_jack, report, SND_JACK_HEADPHONE);
 	snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE);
 	if (rt5645->en_button_func)
@@ -3939,6 +3947,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
 	setup_timer(&rt5645->btn_check_timer,
 		rt5645_btn_check_callback, (unsigned long)rt5645);
 
+	mutex_init(&rt5645->jd_mutex);
 	INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
 	INIT_DELAYED_WORK(&rt5645->rcclock_work, rt5645_rcclock_work);
 

diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
index 2859f10..4260c8b 100644
--- a/tools/lib/subcmd/help.c
+++ b/tools/lib/subcmd/help.c

@@ -50,11 +50,21 @@ void uniq(struct cmdnames *cmds)
 	if (!cmds->cnt)
 		return;
 
-	for (i = j = 1; i < cmds->cnt; i++)
-		if (strcmp(cmds->names[i]->name, cmds->names[i-1]->name))
-			cmds->names[j++] = cmds->names[i];
-
+	for (i = 1; i < cmds->cnt; i++) {
+		if (!strcmp(cmds->names[i]->name, cmds->names[i-1]->name))
+			zfree(&cmds->names[i - 1]);
+	}
+	for (i = 0, j = 0; i < cmds->cnt; i++) {
+		if (cmds->names[i]) {
+			if (i == j)
+				j++;
+			else
+				cmds->names[j++] = cmds->names[i];
+		}
+	}
 	cmds->cnt = j;
+	while (j < i)
+		cmds->names[j++] = NULL;
 }
 
 void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)

diff --git a/tools/testing/selftests/powerpc/math/fpu_preempt.c b/tools/testing/selftests/powerpc/math/fpu_preempt.c
index 0f85b79..c91f3b3 100644
--- a/tools/testing/selftests/powerpc/math/fpu_preempt.c
+++ b/tools/testing/selftests/powerpc/math/fpu_preempt.c

@@ -41,19 +41,20 @@ __thread double darray[] = {0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0,
 int threads_starting;
 int running;
 
-extern void preempt_fpu(double *darray, int *threads_starting, int *running);
+extern int preempt_fpu(double *darray, int *threads_starting, int *running);
 
 void *preempt_fpu_c(void *p)
 {
+	long rc;
 	int i;
+
 	srand(pthread_self());
 	for (i = 0; i < 21; i++)
 		darray[i] = rand();
 
-	/* Test failed if it ever returns */
-	preempt_fpu(darray, &threads_starting, &running);
+	rc = preempt_fpu(darray, &threads_starting, &running);
 
-	return p;
+	return (void *)rc;
 }
 
 int test_preempt_fpu(void)

diff --git a/tools/testing/selftests/powerpc/math/vmx_preempt.c b/tools/testing/selftests/powerpc/math/vmx_preempt.c
index 9ef376c..7ba95ce 100644
--- a/tools/testing/selftests/powerpc/math/vmx_preempt.c
+++ b/tools/testing/selftests/powerpc/math/vmx_preempt.c

@@ -41,19 +41,21 @@ __thread vector int varray[] = {{1, 2, 3, 4}, {5, 6, 7, 8}, {9, 10,11,12},
 int threads_starting;
 int running;
 
-extern void preempt_vmx(vector int *varray, int *threads_starting, int *running);
+extern int preempt_vmx(vector int *varray, int *threads_starting, int *running);
 
 void *preempt_vmx_c(void *p)
 {
 	int i, j;
+	long rc;
+
 	srand(pthread_self());
 	for (i = 0; i < 12; i++)
 		for (j = 0; j < 4; j++)
 			varray[i][j] = rand();
 
-	/* Test fails if it ever returns */
-	preempt_vmx(varray, &threads_starting, &running);
-	return p;
+	rc = preempt_vmx(varray, &threads_starting, &running);
+
+	return (void *)rc;
 }
 
 int test_preempt_vmx(void)
commit	2ebc6e4a761231b2772528c92152dd5ba7f87ecd	[log] [tgz]
author	Tim Zimmermann <tim@linux4.de>	Thu Mar 14 20:15:33 2024 +0100
committer	Tim Zimmermann <tim@linux4.de>	Thu Mar 14 20:21:45 2024 +0100
tree	02ae02073ce521ab27f82c406b57c79ab7390356
parent	dbb6769ccb7897a3e5f6930da2775e5b2f1a4491 [diff]
parent	b0df11ec78550503645b585157ed1782be8961d7 [diff]