diff --git a/.elts/config.yaml b/.elts/config.yaml
index 03fdce3..c9967f9 100644
--- a/.elts/config.yaml
+++ b/.elts/config.yaml
@@ -1,5 +1,5 @@
 upstream_repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
 upstream_base: 4.19.304
 base: 4.14.336
-upstream_version: 4.19.311
-version: 4.14.344
+upstream_version: 4.19.312
+version: 4.14.345
diff --git a/.elts/meta/4.14.345.yaml b/.elts/meta/4.14.345.yaml
new file mode 100644
index 0000000..d754d46
--- /dev/null
+++ b/.elts/meta/4.14.345.yaml
@@ -0,0 +1,559 @@
+30155e4316fd08d7ca77ca14772dc3fd32088ab7:
+  title: 'Documentation/hw-vuln: Update spectre doc'
+  mainline: 06cb31cc761823ef444ba4e1df11347342a6e745
+  upstream: 3e4f86cfda46ef6320f385b80496d3f65d5ed63d
+169885159d59ee3cb6482d4ec9799d11ee61477d:
+  title: 'x86/cpu: Support AMD Automatic IBRS'
+  mainline: e7862eda309ecfccc36bb5558d937ed3ace07f3f
+  upstream: a7268b3424863578814d99a1dd603f6bb5b9f977
+2c6281927b58e02df6ffda6f8f860207634d8616:
+  title: 'x86/pti: Don''t report XenPV as vulnerable'
+  mainline: 6cb2b08ff92460290979de4be91363e5d1b6cec1
+a50c4e98d9d3103cd8b418fdac2aff45d6a91cf6:
+  title: 'x86/bugs: Use sysfs_emit()'
+  mainline: 1d30800c0c0ae1d086ffad2bdf0ba4403370f132
+  upstream: 205bf06008b8ea128ae8f643c21fb32fe4165416
+b361dfb73f7cf65487d75cc4b7e755ddc22db3cf:
+  title: 'wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach'
+  mainline: 0f7352557a35ab7888bc7831411ec8a3cbe20d78
+  upstream: 202c503935042272e2f9e1bb549d5f69a8681169
+d780b7417a456b366c4ca6a8cfe0e439769e8656:
+  title: 'smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()'
+  mainline: 9c82169208dde516510aaba6bbd8b13976690c5d
+  upstream: b4cbf54183220cc35e19c21d970505c4eae0faa4
+003fe24b3f4ffda82e27f3301099888060f01c97:
+  title: 'smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()'
+  mainline: ac02f007d64eb2769d0bde742aac4d7a5fc6e8a5
+  upstream: 8ff12bd997f54f1075f2242a10bff2e3c1bbad02
+15e5a3ae7f084b993ef68e998a29f119de8e24ec:
+  title: 'ARM: dts: mmp2-brownstone: Don''t redeclare phandle references'
+  mainline: 5a56cf3e8738f5d31d8c024d0c62a4c2bfe76fb2
+  upstream: b8dd364515493630ea3a6ece252ba79533e00354
+59bd54acd4b8cf21883b7e3ed1d9f7556d0e524e:
+  title: 'arm: dts: marvell: Fix maxium->maxim typo in brownstone dts'
+  mainline: 831e0cd4f9ee15a4f02ae10b67e7fdc10eb2b4fc
+  upstream: d2285ff966088aa5e6ff1a85d40b23ea7b4d2cf9
+49486ded3cf00d844277c258f4c6170b7ba0792b:
+  title: 'media: xc4000: Fix atomicity violation in xc4000_get_frequency'
+  mainline: 36d503ad547d1c75758a6fcdbec2806f1b6aeb41
+  upstream: 72ddb259a4d09f8e0d06cb2abc9a3eedfcb4200e
+270a92c92373a65c649de646996a14f2523076c1:
+  title: 'KVM: Always flush async #PF workqueue when vCPU is being destroyed'
+  mainline: 3d75b8aa5c29058a512db29da7cbee8052724157
+  upstream: ab2c2f5d9576112ad22cfd3798071cb74693b1f5
+66476cee65989ef662adc023102b54206faa056a:
+  title: 'sparc64: NMI watchdog: fix return value of __setup handler'
+  mainline: 3ed7c61e49d65dacb96db798c0ab6fcd55a1f20f
+  upstream: 452529f9b6094f32d9143ef54af5bffd374a9c27
+2eb2a9ca28c54db784293209ef58babd54d359ed:
+  title: 'crypto: qat - fix double free during reset'
+  mainline: 01aed663e6c421aeafc9c330bda630976b50a764
+  upstream: 277035d2da928bb50ff5ba8723dc4f0284284223
+80509311946cbc5c9b71cb2730c5cb0cbc8ebd45:
+  title: 'crypto: qat - resolve race condition during AER recovery'
+  mainline: 7d42e097607c4d246d99225bf2b195b6167a210c
+  upstream: daba62d9eeddcc5b1081be7d348ca836c83c59d7
+e5e642ae8fb37cc06046bebf193cd4957d945c73:
+  title: 'fat: fix uninitialized field in nostale filehandles'
+  mainline: fde2497d2bc3a063d8af88b258dbadc86bd7b57c
+  upstream: 9840d1897e28f8733cc1e38f97e044f987dc0a63
+5109254ba7cb8452f154b8c5dbb4a7e1224a9f8b:
+  title: 'ubifs: Set page uptodate in the correct place'
+  mainline: 723012cab779eee8228376754e22c6594229bf8f
+  upstream: 4aa554832b9dc9e66249df75b8f447d87853e12e
+c05dbbe027edbe0f2cb9514f8d8084eb96fc2256:
+  title: 'ubi: Check for too small LEB size in VTBL code'
+  mainline: 68a24aba7c593eafa8fd00f2f76407b9b32b47a9
+  upstream: ff818a59ecdfb13a8eb4a38a87b869090dd1745c
+13e3ca30e708d8efed15b15f6d0cf232c071aa9c:
+  title: 'ubi: correct the calculation of fastmap size'
+  mainline: 7f174ae4f39e8475adcc09d26c5a43394689ad6c
+  upstream: 113d2c358fe9b9c2b307b4984ed41dfce6f78347
+0f8a1215c497c27c788e2c7399b1aaac9c205e75:
+  title: 'parisc: Do not hardcode registers in checksum functions'
+  mainline: 52b2d91752a82d9350981eb3b3ffc4b325c84ba9
+  upstream: 32248b37aa141fa9d9dccf24d67295de39d68e6f
+f221d4640d25832bbee599d5c24cda1a040125a1:
+  title: 'parisc: Fix ip_fast_csum'
+  mainline: a2abae8f0b638c31bb9799d9dd847306e0d005bd
+  upstream: 5cdd5e21c16369dd334e38b6c1aa6c2eaecaebdd
+b8cb20b9c4c197de9d905518f4227ed7dcaa7aaa:
+  title: 'parisc: Fix csum_ipv6_magic on 32-bit systems'
+  mainline: 4408ba75e4ba80c91fde7e10bccccf388f5c09be
+  upstream: 103616f04373ce99dc8fb601100163292c9d9700
+bff540549bd2b5c312c5dc43a094b685467a9fa6:
+  title: 'parisc: Fix csum_ipv6_magic on 64-bit systems'
+  mainline: 4b75b12d70506e31fc02356bbca60f8d5ca012d0
+  upstream: ee185ae2b97933193cf1e44e959a80690f835fb3
+6711300be2eb4c7d6f43ac023b5ec484166c79c2:
+  title: 'parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds'
+  mainline: 0568b6f0d863643db2edcc7be31165740c89fa82
+  upstream: 7d27b71af7262ec53ec49f2679fdb3509ee28098
+56a2eacb2e9155c55916bd4eab07d7c4204b683f:
+  title: 'PM: suspend: Set mem_sleep_current during kernel command line setup'
+  mainline: 9bc4ffd32ef8943f5c5a42c9637cfd04771d021b
+  upstream: 312ead3c0e23315596560e9cc1d6ebbee1282e40
+504cb476a9133b6c59bf54d9b267b1196544226e:
+  title: 'clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays'
+  mainline: a903cfd38d8dee7e754fb89fd1bebed99e28003d
+  upstream: 5533686e99b04994d7c4877dc0e4282adc9444a2
+9fcafc89b8ec3ad253f9ad9a67012141893aee44:
+  title: 'clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays'
+  mainline: e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96
+  upstream: 99740c4791dc8019b0d758c5389ca6d1c0604d95
+822a0ce90098854047b7088afd2dae656b90bdcb:
+  title: 'powerpc/fsl: Fix mfpmr build errors with newer binutils'
+  mainline: 5f491356b7149564ab22323ccce79c8d595bfd0c
+  upstream: 8f7f583ce3393580eb8a55942d05e3ab6eb161ba
+9598535c6526853f78a891421f12783174e05482:
+  title: 'USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB'
+  mainline: 3fb7bc4f3a98c48981318b87cf553c5f115fd5ca
+  upstream: fd3b0646012973dcef107f614300076c35aec30e
+8a13c955082f3d8ce5ea1badda9e72fcdb0908d9:
+  title: 'USB: serial: add device ID for VeriFone adapter'
+  mainline: cda704809797a8a86284f9df3eef5e62ec8a3175
+  upstream: 64d0643a8b7bed28f011bf1f942a4d6972d815ca
+24dc68b8236fd0ccb59be9dd9492e5bcfb89f3aa:
+  title: 'USB: serial: cp210x: add ID for MGP Instruments PDS100'
+  mainline: a0d9d868491a362d421521499d98308c8e3a0398
+  upstream: dea245d8c104a2977d79e2310b83fd5d9a39861f
+618c54ca2dd86b503e06c8df9ced140e53a48d99:
+  title: 'USB: serial: option: add MeiG Smart SLM320 product'
+  mainline: 46809c51565b83881aede6cdf3b0d25254966a41
+  upstream: 03c0edfa0533fbc9fd9ecd5350c5c3639e3171b1
+8436412b0d625fe55cd4ea391bf0cd606b7c748a:
+  title: 'USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M'
+  mainline: b1a8da9ff1395c4879b4bd41e55733d944f3d613
+  upstream: 99e7b5884bb1fa4703a03af0bb740eb797ed335c
+e28c7f715843eb54828e33d60ef14c0ebc8e3d47:
+  title: 'PM: sleep: wakeirq: fix wake irq warning in system suspend'
+  mainline: e7a7681c859643f3f2476b2a28a494877fd89442
+  upstream: 66ed532e73bdfdcdb4b49bf6e92db7758bd2ff21
+601d558db55ea0010315cbc4a4bb83e8eb7bf038:
+  title: 'mmc: tmio: avoid concurrent runs of mmc_request_done()'
+  mainline: e8d1b41e69d72c62865bebe8f441163ec00b3d44
+  upstream: c421a077bb1a4b0923792ee6fc9e1b246d5fa6d6
+0be0578f83ec594ad05ae6821a34de4b769c7db7:
+  title: 'fuse: don''t unhash root'
+  mainline: b1fe686a765e6c0d71811d825b5a1585a202b777
+  upstream: 0f8957f5077b29cda838be2f75ef6cd2668e6df4
+76c167a161ef90c6588ec0dda97ec68d8fd6e9a6:
+  title: 'PCI: Drop pci_device_remove() test of pci_dev->driver'
+  mainline: 097d9d414433315122f759ee6c2d8a7417a8ff0f
+  upstream: 064300ccb0e272adcedd96df96750d08c5a4d2f2
+1453f1042e621a4a7247c9069755473a0eefa1ba:
+  title: 'PCI/PM: Drain runtime-idle callbacks before driver removal'
+  mainline: 9d5286d4e7f68beab450deddbb6a32edd5ecf4bf
+  upstream: 9a87375bb586515c0af63d5dcdcd58ec4acf20a6
+050bbf8ca58f05c6f76244284ccb7942dfbb00c9:
+  title: 'Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""'
+  mainline: 3445139e3a594be77eff48bc17eff67cf983daed
+  upstream: 130e2ae1fdf361f3a5a9b21db10fe519c54ad470
+6ac966e0c64f616bf5ae8c9e3655827fafa2a288:
+  title: 'dm-raid: fix lockdep waring in "pers->hot_add_disk"'
+  mainline: 95009ae904b1e9dca8db6f649f2d7c18a6e42c75
+  upstream: da81cab62b4f48fc3800db68ed30f8dd94e78f92
+1c6f43992e92359208930b339fd57f04e157da73:
+  title: 'mmc: core: Fix switch on gp3 partition'
+  mainline: 4af59a8df5ea930038cd3355e822f5eedf4accc1
+  upstream: 14db3446d26511191088a941069bcdec97223728
+805bd3875b89fe0311ca2e530836ec10cb390798:
+  title: 'hwmon: (amc6821) add of_match table'
+  mainline: 3f003fda98a7a8d5f399057d92e6ed56b468657c
+  upstream: f6b084787b7d9bd4009e0d6d1f0cc79349f7efcd
+4c3c05340a8d2925c998e568db8c6199a08df5c4:
+  title: 'ext4: fix corruption during on-line resize'
+  mainline: a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc
+  upstream: 75cc31c2e7193b69f5d25650bda5bb42ed92f8a1
+4f84ef5651a0ae72ca8bc3f1529a9863a90862c7:
+  title: 'speakup: Fix 8bit characters from direct synth'
+  mainline: b6c8dafc9d86eb77e502bb018ec4105e8d2fbf78
+  upstream: 37f4f4f1ac2661c1cc7766a324d34b24f65e75e8
+49362eca812601c014d7006bd66b8b6484277d98:
+  title: 'kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1'
+  mainline: 75b5ab134bb5f657ef7979a59106dce0657e8d87
+  upstream: 39460da0515e5ef2afc67a184395daf8f97f74a1
+fbe0715512c3fca4b0d1c8e746f18bd2f24d042f:
+  title: 'vfio/platform: Disable virqfds on cleanup'
+  mainline: fcdc0d3d40bc26c105acf8467f7d9018970944ae
+  upstream: af47ec223f6d9d72d2ddd3fb31a7d1210eafd0bb
+94dcaef811b46fe6df7487a738e14e747c10e4f7:
+  title: 'soc: fsl: qbman: Always disable interrupts when taking cgr_lock'
+  mainline: 584c2a9184a33a40fceee838f856de3cffa19be3
+  upstream: b56a793f267679945d1fdb9a280013bd2d0ed7f9
+321e5b5b657ed28e3e12c00b1d1c7a1aed0080b6:
+  title: 'soc: fsl: qbman: Add helper for sanity checking cgr ops'
+  mainline: d0e17a4653cebc2c8a20251c837dd1fcec5014d9
+  upstream: 99fe1b21b5e5bf69d351adca3c594c46c5bf155b
+a8363db776a883cdbf0fd646f3133b3e3f110977:
+  title: 'soc: fsl: qbman: Add CGR update function'
+  mainline: 914f8b228ede709274b8c80514b352248ec9da00
+  upstream: e2bd2df406edd2dff1b105f9dea3c502ee5808c3
+e32c360971de834a38399f982b9d9c5993b6d5ef:
+  title: 'soc: fsl: qbman: Use raw spinlock for cgr_lock'
+  mainline: fbec4e7fed89b579f2483041fabf9650fb0dd6bc
+  upstream: 2b3fede8225133671ce837c0d284804aa3bc7a02
+6b39a518dba77c95d71e3d05bf2667602b3a206b:
+  title: 's390/zcrypt: fix reference counting on zcrypt card objects'
+  mainline: 50ed48c80fecbe17218afed4f8bed005c802976c
+  upstream: 7e500849fa558879a1cde43f80c7c048c2437058
+133f1b251a963f13a59296ffd812314b3895acd5:
+  title: 'drm/imx/ipuv3: do not return negative values from .get_modes()'
+  mainline: c2da9ada64962fcd2e6395ed9987b9874ea032d3
+  upstream: 749e6b3a2dfc9d393874e7a6cc7fed6eeda97ee0
+e08287742d6330d8946d74dbd16fa6ab32f584b9:
+  title: 'drm/vc4: hdmi: do not return negative values from .get_modes()'
+  mainline: abf493988e380f25242c1023275c68bd3579c9ce
+  upstream: 6206e70d5faa5a9e8a3250683ebee1637d3559fa
+cead81caaf4e893de661245723b033c776eba434:
+  title: 'memtest: use {READ,WRITE}_ONCE in memory scanning'
+  mainline: 82634d7e24271698e50a3ec811e5f50de790a65f
+  upstream: 6e7044f155f7756e4489d8ad928f3061eab4595b
+592973ee7e6a0af69d6689fa946f83544b0b7f32:
+  title: 'nilfs2: fix failure to detect DAT corruption in btree and direct mappings'
+  mainline: f2f26b4a84a0ef41791bd2d70861c8eac748f4ba
+  upstream: b67189690eb4b7ecc84ae16fa1e880e0123eaa35
+f54f17b7da72676032972ac38c70d5f958b93591:
+  title: 'nilfs2: use a more common logging style'
+  mainline: a1d0747a393a079631130d61faa2a61027d1c789
+  upstream: 5c8f85e9ff21ee1fc6d20fcd73a15877556c3bbe
+a3a1048f65cd381d4efdf6d4beb71eddb5d54ac5:
+  title: 'nilfs2: prevent kernel bug at submit_bh_wbc()'
+  mainline: 269cdf353b5bdd15f1a079671b0f889113865f20
+  upstream: 91e4c4595fae5e87069e44687ae879091783c183
+01877909cac69ce374567fddfb200298900be9d8:
+  title: 'ahci: asm1064: correct count of reported ports'
+  mainline: 9815e39617541ef52d0dfac4be274ad378c6dc09
+  upstream: ece903bf390e819c45fba8cf6a31c7487e24c505
+adc881c85ad12350f907e04d3a8c0d2242873b3a:
+  title: 'ahci: asm1064: asm1166: don''t limit reported ports'
+  mainline: 6cd8adc3e18960f6e59d797285ed34ef473cc896
+  upstream: d29630b79d4c48b31312fa3d735de63cbe97e6c5
+8e23affd6f90a54fc41e30143bf3fee824dd3f24:
+  title: 'comedi: comedi_test: Prevent timers rescheduling during deletion'
+  mainline: f53641a6e849034a44bf80f50245a75d7a376025
+  upstream: 4b6e87971dbea7d9231f670281723003f90429b2
+c125ac99931ed065edcf24f7ab4572e03840633e:
+  title: 'netfilter: nf_tables: disallow anonymous set with timeout flag'
+  mainline: 16603605b667b70da974bea8216c93e7db043bf1
+  upstream: e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9
+6579e677dcdff3b57c01dfd05076c5f602dddf3d:
+  title: 'netfilter: nf_tables: reject constant set with timeout'
+  mainline: 5f4fc4bd5cddb4770ab120ce44f02695c4505562
+  upstream: 9372a64fb8a9f8e9cc59a0c8fa2ab5a670384926
+92844cb2a29c9cb805badb5f0b47b1a7b064ae6e:
+  title: 'xfrm: Avoid clang fortify warning in copy_to_user_tmpl()'
+  mainline: 1a807e46aa93ebad1dfbed4f82dc3bf779423a6e
+  upstream: 79fa29ce641165aa5d934f55f2369aacfd7c35e4
+ee2aa965bc6fa84adcc53b1daef7bc40bfa0d890:
+  title: 'ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform'
+  mainline: d397b6e56151099cf3b1f7bfccb204a6a8591720
+  upstream: 341568ef8afd587d1e6edd1c4a2e6daec438ea34
+c549cae12cd0f345aff86d8b4ea4e4234476f23e:
+  title: 'USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command'
+  mainline: 014bcf41d946b36a8f0b8e9b5d9529efbb822f49
+  upstream: 9968c701cba7eda42e5f0052b040349d6222ae34
+0dcddb86a5d646529e4395f7206ae146d07be618:
+  title: 'usb: gadget: ncm: Fix handling of zero block length packets'
+  mainline: f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70
+  upstream: e2dbfea520e60d58e0c498ba41bde10452257779
+602634cfb4b83b8bb798fb91fe9fa8a0aef24c72:
+  title: 'usb: port: Don''t try to peer unused USB ports based on location'
+  mainline: 69c63350e573367f9c8594162288cffa8a26d0d1
+  upstream: 8697e9b39f57fdae216d1fa6947e196307516aac
+0b11f20185ce5eb0cba6d38542c33020592085f5:
+  title: 'tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled'
+  mainline: 74cb7e0355fae9641f825afa389d3fba3b617714
+  upstream: 206ef729592010631fd2fe721a94b4e71c61653e
+d594c0266f6a7959f1844a5b51786ddb695ed093:
+  title: 'vt: fix memory overlapping when deleting chars in the buffer'
+  mainline: 39cdb68c64d84e71a4a717000b6e5de208ee60cc
+  upstream: c8686c014b5e872ba7e334f33ca553f14446fc29
+fd783c9a2045ec6adb0d10a00d5529d0dd05d395:
+  title: 'mm/memory-failure: fix an incorrect use of tail pages'
+66bf9016921cd93d270fc6ebec98e69cb9f2e364:
+  title: 'mm/migrate: set swap entry values of THP tail pages properly.'
+85c54b93ba34a1150bffd0158f4ec43b1d17cf3f:
+  title: 'wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes'
+  mainline: 4f2bdb3c5e3189297e156b3ff84b140423d64685
+  upstream: ea9a0cfc07a7d3601cc680718d9cff0d6927a921
+2743401fbf05f96c405165f8176873a62c813768:
+  title: 'exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()'
+  mainline: 2aea94ac14d1e0a8ae9e34febebe208213ba72f7
+  upstream: 3a679f8a8c88de0b17b0bfde031238b40daf76ba
+8163976a83576149919cd26e021b99167cbe4731:
+  title: 'USB: cdc-wdm: Fix use after free in service_outstanding_interrupt().'
+  mainline: 5e5ff0b4b6bcb4d17b7a26ec8bcfc7dd4651684f
+2eb4d359ad399b7c830e00d52bcf30b776bf7bc8:
+  title: 'usb: cdc-wdm: close race between read and workqueue'
+  mainline: 339f83612f3a569b194680768b22bf113c26a29d
+  upstream: 5904411219601127ffdbd2d622bb5d67f9d8d16c
+690e1f475ec547a1809a949f1abf1ac6a24a9e35:
+  title: 'ALSA: sh: aica: Convert timers to use timer_setup()'
+5c3becdbf4d010b2460d46da9de7bbf274f82792:
+  title: 'ALSA: aica: Fix a long-time build breakage'
+  mainline: 534420c6ff87d3052540f1fd346e0adcff440819
+57ad2852b697ab931110d4443e42aa15420928cd:
+  title: 'ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs'
+  mainline: 051e0840ffa8ab25554d6b14b62c9ab9e4901457
+  upstream: eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2
+9b033ffdc4492f9882d1e3d8416f3c9a3b1c281e:
+  title: 'fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion'
+  mainline: 961ebd120565cb60cebe21cb634fbc456022db4a
+  upstream: 10ca82aff58434e122c7c757cf0497c335f993f3
+271b5f628523048373853e7d726edc4ab6b2dafa:
+  title: 'printk: Update @console_may_schedule in console_trylock_spinning()'
+  mainline: 8076972468584d4a21dab9aa50e388b3ea9ad8c7
+  upstream: 45f99d441067035dbb3f2a0d9713abe61ea721c5
+b2de2c514c647d19070e8f2fad629356367749fa:
+  title: 'btrfs: add define for oldest generation'
+8e0244b75adcff266630f97bdedb589988c1605d:
+  title: 'btrfs: allocate btrfs_ioctl_defrag_range_args on stack'
+  mainline: c853a5783ebe123847886d432354931874367292
+  upstream: 022ed023c8c0bed09a21e9617056723df948544c
+c598f19d1ee74a8b8820210cc4563253e60d7f6a:
+  title: 'Revert "loop: Check for overflow while configuring loop"'
+7d51a15acdfba9db409c1fea20682dba5e4c533d:
+  title: 'loop: Call loop_config_discard() only after new config is applied'
+  mainline: 7c5014b0987a30e4989c90633c198aced454c0ec
+  upstream: 944e9628259117a2f21d9c7ce5d7fbb305cc6ba6
+d1bcca1f152951849067da419020d041495285d3:
+  title: 'perf/core: Fix reentry problem in perf_output_read_group()'
+  mainline: 6b959ba22d34ca793ffdb15b5715457c78e38b1a
+  upstream: a2039c87d30177f0fd349ab000e6af25a0d48de8
+4cb71f760e2735758614a3798d255aa93862d577:
+  title: 'efivarfs: Request at most 512 bytes for variable names'
+  mainline: f45812cc23fb74bef62d4eb8a69fe7218f4b9f2a
+  upstream: a7bd7dbaa2ddcf8c5ed5d96df240f1442447d252
+5ef535b7348ea1372234b51a6c806617275b8968:
+  title: 'powerpc: xor_vmx: Add ''-mhard-float'' to CFLAGS'
+  mainline: 35f20786c481d5ced9283ff42de5c69b65e5ed13
+  upstream: 9b021c7ffbbf7569b074c3f6cafa377b8c29a2e3
+d249d755055ea72ae93f908e4f009672bb4a367b:
+  title: 'usb: dwc2: host: Fix hibernation flow'
+  mainline: 3c7b9856a82227db01a20171d2e24c7ce305d59b
+  upstream: 8c93d233285e234b84bc34c9de317ccf3ae00aec
+3e18f9aae5c9f4ee7c82f727c7db4bdc66055af9:
+  title: 'usb: dwc2: host: Fix ISOC flow in DDMA mode'
+  mainline: b258e42688501cadb1a6dd658d6f015df9f32d8f
+  upstream: dca1dc1e99e09e7b8eaccb55d6aecb87d9cb8ecd
+933c295f1bf97ef659d06b2fa268f948de50ffc9:
+  title: 'usb: udc: remove warning when queue disabled ep'
+  mainline: 2a587a035214fa1b5ef598aea0b81848c5b72e5e
+  upstream: 2b002c308e184feeaeb72987bca3f1b11e5f70b8
+e31a16fe832d4016c83230cc8bd7f67493e1c9a7:
+  title: 'scsi: qla2xxx: Fix command flush on cable pull'
+  mainline: a27d4d0e7de305def8a5098a614053be208d1aa1
+  upstream: b73377124f56d2fec154737c2f8d2e839c237d5a
+909ca3e7e6fb1ae6130e1a7d473acc1c8bbc9ffa:
+  title: 'x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled'
+  mainline: fd470a8beed88440b160d690344fbae05a0b9b1b
+  upstream: bb8cc9c34361714dd232700b3d5f1373055de610
+03119f856df4a8f68fbc6c3d2dfc5b42634c5287:
+  title: 'scsi: lpfc: Correct size for wqe for memset()'
+  mainline: 28d41991182c210ec1654f8af2e140ef4cc73f20
+  upstream: 5df0d994c23a43f4c0f2a7fdf6b62e106d08e53e
+f354bb2f646ba9eb13094f3a58a9fcb2495cdaf8:
+  title: 'USB: core: Fix deadlock in usb_deauthorize_interface()'
+  mainline: 80ba43e9f799cbdd83842fc27db667289b3150f5
+  upstream: 8cbdd324b41528994027128207fae8100dff094f
+746dafa5f8bd92d019409cd1e3991b6b23ed9808:
+  title: 'nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet'
+  mainline: d24b03535e5eb82e025219c2f632b485409c898f
+  upstream: 11387b2effbb55f58dc2111ef4b4b896f2756240
+f113056cc53497bafb4a5a1ae59fcb8da95409df:
+  title: 'mptcp: add sk_stop_timer_sync helper'
+  mainline: 08b81d873126b413cda511b1ea1cbb0e99938bbd
+  upstream: 9c382bc16fa8f7499b0663398437e125cf4f763b
+a15af438bc3f84cd18bd555ed93704f174afd28e:
+  title: 'tcp: properly terminate timers for kernel sockets'
+  mainline: 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada
+  upstream: 93f0133b9d589cc6e865f254ad9be3e9d8133f50
+0d619c44f46a548f37d0af8526b1e2141888415c:
+  title: 'Bluetooth: hci_event: set the conn encrypted before conn establishes'
+  mainline: c569242cd49287d53b73a94233db40097d838535
+  upstream: 96caf943a0f384f347d0d32afa8a3e94837fe012
+bddbc4e6e85deec70cfd5e4d06553687ce2031e2:
+  title: 'Bluetooth: Fix TOCTOU in HCI debugfs implementation'
+  mainline: 7835fcfd132eb88b87e8eb901f88436f63ab60f7
+  upstream: 466488b14a87dc97d8a3bf5e65a30bff032847c1
+2828c51f974e201fb04d01231d502059b21dee7d:
+  title: 'netfilter: nf_tables: disallow timeout for anonymous sets'
+  mainline: e26d3009efda338f19016df4175f354a9bd0a4ab
+  upstream: 116b0e8e4673a5faa8a739a19b467010c4d3058c
+0c4e907602df65b88f9bed57d6bc5039b7172e8c:
+  title: 'Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."'
+  mainline: c567f2948f57bdc03ed03403ae0234085f376b7d
+  upstream: b66762945d3289d472cedfca81dd98f9d8efe3b7
+ce55bbe3422d77c1733e562b2481ae5d5609e4de:
+  title: 'mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations'
+  mainline: 803de9000f334b771afacb6ff3e78622916668b0
+  upstream: c82a659cc8bb7a7f8a8348fc7f203c412ae3636f
+ca0de57e9c48d85f650f98c4a515cbfb61213a7e:
+  title: 'net: stmmac: Fix issues when number of Queues >= 4'
+  mainline: e8df7e8c233a18d2704e37ecff47583b494789d3
+77222083054d1880d96617dc92433f13f7485340:
+  title: 'net: stmmac: fix rx queue priority assignment'
+  mainline: b3da86d432b7cd65b025a11f68613e333d2483db
+  upstream: c5dd42e0c490416e45fac594694cbc0ada0ea0f9
+750226b1e9ada5f831c682b3970e6fb4c908de43:
+  title: 'net/sched: act_skbmod: prevent kernel-infoleak'
+  mainline: d313eb8b77557a6d5855f42d2234bd592c7b50dd
+  upstream: f190a4aa03cbd518bd9c62a66e1233984f5fd2ec
+b406df4814ddb671e6b276983496bfe1fbbb70d8:
+  title: 'selftests: reuseaddr_conflict: add missing new line at the end of the output'
+  mainline: 31974122cfdeaf56abc18d8ab740d580d9833e90
+  upstream: d6c0a37d412657cf2661996387340e8afeb82a63
+1c37416298197f52e10ae196eff4e11f07c11a96:
+  title: 'ipv6: Fix infinite recursion in fib6_dump_done().'
+  mainline: d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae
+  upstream: 9472d07cd095cbd3294ac54c42f304a38fbe9bfe
+4a254ec690b1730e4360c6c82a1e6a220f757bb1:
+  title: 'staging: mmal-vchiq: Avoid use of bool in structures'
+  mainline: 640e77466e69d9c28de227bc76881f5501f532ca
+  upstream: 11895fd09f5d37abbc60ac88f4897587997cfbf5
+cde080763f772971b9bab16de6a83a57bfa72941:
+  title: 'staging: mmal-vchiq: Allocate and free components as required'
+  mainline: 8c589e1794a31e9a381916b0280260ab601e4d6e
+  upstream: 48823cc0c75c3290d82b339f2135e54d6c20eaaa
+1fbb48548bf323fe8c3bb65573ac2b47a06fcc52:
+  title: 'staging: mmal-vchiq: Fix client_component for 64 bit kernel'
+  mainline: 22e64b486adc4785542f8002c3af4c895490f841
+  upstream: 60cb8c4ae9874e8b7906302306e85e3138cb19fc
+5e236ea4cd576ca487aaeb6cd4a43b825580f096:
+  title: 'staging: vc04_services: changen strncpy() to strscpy_pad()'
+  mainline: ef25725b7f8aaffd7756974d3246ec44fae0a5cf
+  upstream: 3a54069c1398266c7523f24db52391f7d54be13f
+5314097a03c077acf9974718386187c632ff87a6:
+  title: 'staging: vc04_services: fix information leak in create_component()'
+  mainline: f37e76abd614b68987abc8e5c22d986013349771
+  upstream: 4693868e40b1367d1def54e5ea750da2d288da67
+b38a90afb44d28ca6aed9ba7b0e3c83d0e2a0161:
+  title: 'init: open /initrd.image with O_LARGEFILE'
+  mainline: 4624b346cf67400ef46a31771011fb798dd2f999
+  upstream: 9f0dcca773117f0b240d1db97db27f0b8aac106a
+5d848e29b28655b7cdd56347f17871ebceaa35af:
+  title: 'ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw'
+  mainline: fc563aa900659a850e2ada4af26b9d7a3de6c591
+  upstream: a6f9bd4aee2c96d597b765af5f3a61a2b8d8e98c
+4519a94da38decdf42b41f68e360331ab9f44338:
+  title: 'ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit'
+  mainline: 52f80bb181a9a1530ade30bc18991900bbb9697f
+  upstream: 81e38e4e2c756c95267c758bf683b35ce0ca77b1
+401b18b386e1e23ebabb0d02ea19464d756a368c:
+  title: 'ata: sata_mv: Fix PCI device ID table declaration compilation warning'
+  mainline: 3137b83a90646917c90951d66489db466b4ae106
+  upstream: b9bacf4b0e12ae9963774e4de9ddc6631ba65343
+dbff4c3de9bcdaf9692cd0174ee96b8dbd60bba2:
+  title: 'ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone'
+  mainline: 1576f263ee2147dc395531476881058609ad3d38
+  upstream: 5fd82952faaabaaefd7e594fce9b19d4b4e754f9
+cdf0bc842607a3cb79b4fee6470e73df396effdb:
+  title: 'wifi: ath9k: fix LNA selection in ath_ant_try_scan()'
+  mainline: d6b27eb997ef9a2aa51633b3111bc4a04748e6d3
+  upstream: 95f1acd1e998a48197d33720e33161750e459c23
+cab49d428499a8d81c7923b4c2bd011e71ea6326:
+  title: 'VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()'
+  mainline: 19b070fefd0d024af3daa7329cbc0d00de5302ec
+  upstream: e87bb99d2df6512d8ee37a5d63d2ca9a39a8c051
+7960ca05581467d75f635a849f0e367514b19448:
+  title: 'arm64: dts: rockchip: fix rk3399 hdmi ports node'
+  mainline: f051b6ace7ffcc48d6d1017191f167c0a85799f6
+  upstream: 23c6f9f6619a699c196cfc1e5a57becdfe4a0b9a
+9febcc825310e72385e81d69e9b967b3b4e7205a:
+  title: 'tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()'
+  mainline: f85450f134f0b4ca7e042dc3dc89155656a2299d
+  upstream: c4f135f454deb2ff4b7a5ec53577aaa776e2fac9
+c75868bec680efa61415ec3897135a7d596c384f:
+  title: 'btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()'
+  mainline: 7411055db5ce64f836aaffd422396af0075fdc99
+  upstream: bebd9e0ff90034875c5dfe4bd514fd7055fc7a89
+1b9e5cdca908d0c426ba76b2c277c8c20dca49dd:
+  title: 'btrfs: export: handle invalid inode or root reference in btrfs_get_parent()'
+  mainline: 26b66d1d366a375745755ca7365f67110bbf6bd5
+  upstream: 8b11774810aadeda80d4eb54f648eaf88f369d22
+c3e4fbedaa6d065b319e72de153e2be8d8414596:
+  title: 'btrfs: send: handle path ref underflow in header iterate_inode_ref()'
+  mainline: 3c6ee34c6f9cd12802326da26631232a61743501
+  upstream: be2b6bcc936ae17f42fff6494106a5660b35d8d3
+18ac75f7eb293f56efde10cc65fa7eb6d1350bc9:
+  title: 'Bluetooth: btintel: Fix null ptr deref in btintel_read_version'
+  mainline: b79e040910101b020931ba0c9a6b77e81ab7f645
+  upstream: ec2049fb2b8be3e108fe2ef1f1040f91e72c9990
+c6d084381d756d922236737ce0569fd76b904a62:
+  title: 'Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails'
+  mainline: bc4996184d56cfaf56d3811ac2680c8a0e2af56e
+  upstream: 004402ec227732308871a6127f0b967cf2a293cd
+385733c04408bec0083e9f768a094db74dc058d2:
+  title: 'sysv: don''t call sb_bread() with pointers_lock held'
+  mainline: f123dc86388cb669c3d6322702dc441abc35c31e
+  upstream: 13b33feb2ebddc2b1aa607f553566b18a4af1d76
+cf30a0518a5944e7af7c38a04af145c8e5e975e8:
+  title: 'scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()'
+  mainline: 2ae917d4bcab80ab304b774d492e2fcd6c52c06b
+  upstream: edf82aa7e9eb864a09229392054d131b34a5c9e8
+be099afe08c0439e72c1b37f2896d7942b318bdf:
+  title: 'isofs: handle CDs with bad root inode but good Joliet root directory'
+  mainline: 4243bf80c79211a8ca2795401add9c4a3b1d37ca
+  upstream: b02e6ba55997926c961a95cdaf9de91f75b0b5c3
+95bfe2806bd05c524d8534070c038b8feaae436a:
+  title: 'media: sta2x11: fix irq handler cast'
+  mainline: 3de49ae81c3a0f83a554ecbce4c08e019f30168e
+  upstream: 347b2e635e8b2beaa076b0bc110be9c6ea50aec1
+84b6065e346863ebad34cba5284ff8eddcf4cb4a:
+  title: 'SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int'
+  mainline: 2c35f43b5a4b9cdfaa6fdd946f5a212615dac8eb
+  upstream: 56199ebbcbbcc36658c2212b854b37dff8419e52
+53510903f234a0aea0f80bd7d3bcccf520fc07c9:
+  title: 'block: prevent division by zero in blk_rq_stat_sum()'
+  mainline: 93f52fbeaf4b676b21acfe42a5152620e6770d02
+  upstream: 6a55dab4ac956deb23690eedd74e70b892a378e7
+2929cf2f94cfec0fb6afbcdd27ec2bfb6fae1a59:
+  title: 'tools: iio: replace seekdir() in iio_generic_buffer'
+  mainline: 4e6500bfa053dc133021f9c144261b77b0ba7dc8
+  upstream: 4a886ce3c846032ed8d9bf18f525f12dcb5de614
+b550cc1a3828e39bb76a2c0d8218b57dc8f71f0d:
+  title: 'usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined'
+  mainline: 12f371e2b6cb4b79c788f1f073992e115f4ca918
+  upstream: f90519f1d6a0c4d86bcd401f34bda11486fa4284
+781096a3f8ab4b70c9b75f8c0d3e5f694e16d843:
+  title: 'fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2'
+  mainline: bc87bb342f106a0402186bcb588fcbe945dced4b
+  upstream: 3affd4cceebd560aa13c280fe0ad46a38e46eb73
+ebe31b54cbaf1029c6ecd6f8e59d6bb59b59280a:
+  title: 'fbmon: prevent division by zero in fb_videomode_from_videomode()'
+  mainline: c2d953276b8b27459baed1277a4fdd5dd9bd4126
+  upstream: 1fb52bc1de55e9e0bdf71fe078efd4da0889710f
+d7d6dfa21578d006e6023f9eddc4029774e6a6d6:
+  title: 'tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc'
+  mainline: 67c37756898a5a6b2941a13ae7260c89b54e0d88
+  upstream: 7d303dee473ba3529d75b63491e9963342107bed
+6419be48607d845c7b94621da5405191a0805754:
+  title: 'virtio: reenable config if freezing device failed'
+  mainline: 310227f42882c52356b523e2f4e11690eebcd2ab
+  upstream: 5908fb34c0cf62c0f25f916d50d00582b053e077
+e917dc0ff33859792cb7328fc84068471824639b:
+  title: 'x86/mm/pat: fix VM_PAT handling in COW mappings'
+  mainline: 04c35ab3bdae7fefbd7c7a7355f29fa03a035221
+  upstream: f18681daaec9665a15c5e7e0f591aad5d0ac622b
+9be9972d568f71227eb0d8b300af769013f27b42:
+  title: 'Bluetooth: btintel: Fixe build regression'
+  mainline: 6e62ebfb49eb65bdcbfc5797db55e0ce7f79c3dd
+  upstream: 81a3ce3efd82e0790a6151c3dad6c02570d48816
+84edf3cb66dffa4c868347741aa8ac43073ffcf1:
+  title: 'VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()'
+  mainline: e606e4b71798cc1df20e987dde2468e9527bd376
+  upstream: cc065e1b11a270ebd2b18bbe61f0d6cc8efaa15d
+edb8d9b7e0dce5410776f9d4298d04b1a01c2a86:
+  title: 'Revert "ext4: fix to check return value of freeze_bdev() in ext4_shutdown()"'
+b26791b0c721cd39ea18bcf50cf570a3888af085:
+  title: 'ext4: fix to check return value of freeze_bdev() in ext4_shutdown()'
+  mainline: c4d13222afd8a64bf11bc7ec68645496ee8b54b9
+5a1a8ad6c941914dc628dd636be10c60e817b5c3:
+  title: 'netfilter: nftables: exthdr: fix 4-byte stack OOB write'
+  mainline: fd94d9dadee58e09b49075240fe83423eb1dcd36
+842f01e7df81db42b75be7d590626a9602e495ec:
+  title: 'Revert "net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()"'
+79f3640f21c02761bfdbbda2d2b271fa40da724d:
+  title: 'net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()'
+  mainline: 01a564bab4876007ce35f312e16797dfe40e4823
diff --git a/.elts/upstream/4.19.312.yaml b/.elts/upstream/4.19.312.yaml
new file mode 100644
index 0000000..919fa05
--- /dev/null
+++ b/.elts/upstream/4.19.312.yaml
@@ -0,0 +1,680 @@
+3e4f86cfda46ef6320f385b80496d3f65d5ed63d:
+  title: 'Documentation/hw-vuln: Update spectre doc'
+  mainline: 06cb31cc761823ef444ba4e1df11347342a6e745
+  backport: 30155e4316fd08d7ca77ca14772dc3fd32088ab7
+a7268b3424863578814d99a1dd603f6bb5b9f977:
+  title: 'x86/cpu: Support AMD Automatic IBRS'
+  mainline: e7862eda309ecfccc36bb5558d937ed3ace07f3f
+  backport: 169885159d59ee3cb6482d4ec9799d11ee61477d
+205bf06008b8ea128ae8f643c21fb32fe4165416:
+  title: 'x86/bugs: Use sysfs_emit()'
+  mainline: 1d30800c0c0ae1d086ffad2bdf0ba4403370f132
+  backport: a50c4e98d9d3103cd8b418fdac2aff45d6a91cf6
+72467abd24b11b7e7e63d29f64905278cebd8563:
+  title: 'timer/trace: Replace deprecated vsprintf pointer extension %pf by %ps'
+  mainline: 6849cbb0f9a8dbc1ba56e9abc6955613103e01e3
+  skipped: not needed on 4.14
+bbb5b1c060d73ca96ccc8cceaa81f5e1a96e8fa4:
+  title: 'timer/trace: Improve timer tracing'
+  mainline: f28d3d5346e97e60c81f933ac89ccf015430e5cf
+  skipped: not needed
+adeb6cdf9033071c8ff14235ee0ebc37081b77c9:
+  title: 'timers: Prepare support for PREEMPT_RT'
+  mainline: 030dcdd197d77374879bb5603d091eee7d8aba80
+  skipped: not needed
+26e9278a773c95b25376c95406fbf81d969c1e74:
+  title: 'timers: Update kernel-doc for various functions'
+  mainline: 14f043f1340bf30bc60af127bff39f55889fef26
+  skipped: not needed
+f0b422a04f823faec0aa7d5b6e9cdbffbbe1e7bd:
+  title: 'timers: Use del_timer_sync() even on UP'
+  mainline: 168f6b6ffbeec0b9333f3582e4cf637300858db5
+  skipped: not needed
+48a8a53939604aaab44c0699851f201f80db877d:
+  title: 'timers: Rename del_timer_sync() to timer_delete_sync()'
+  mainline: 9b13df3fb64ee95e2397585404e442afee2c7d4f
+  skipped: not needed
+202c503935042272e2f9e1bb549d5f69a8681169:
+  title: 'wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach'
+  mainline: 0f7352557a35ab7888bc7831411ec8a3cbe20d78
+  backport: b361dfb73f7cf65487d75cc4b7e755ddc22db3cf
+b4cbf54183220cc35e19c21d970505c4eae0faa4:
+  title: 'smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()'
+  mainline: 9c82169208dde516510aaba6bbd8b13976690c5d
+  backport: d780b7417a456b366c4ca6a8cfe0e439769e8656
+8ff12bd997f54f1075f2242a10bff2e3c1bbad02:
+  title: 'smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()'
+  mainline: ac02f007d64eb2769d0bde742aac4d7a5fc6e8a5
+  backport: 003fe24b3f4ffda82e27f3301099888060f01c97
+b8dd364515493630ea3a6ece252ba79533e00354:
+  title: 'ARM: dts: mmp2-brownstone: Don''t redeclare phandle references'
+  mainline: 5a56cf3e8738f5d31d8c024d0c62a4c2bfe76fb2
+  backport: 15e5a3ae7f084b993ef68e998a29f119de8e24ec
+d2285ff966088aa5e6ff1a85d40b23ea7b4d2cf9:
+  title: 'arm: dts: marvell: Fix maxium->maxim typo in brownstone dts'
+  mainline: 831e0cd4f9ee15a4f02ae10b67e7fdc10eb2b4fc
+  backport: 59bd54acd4b8cf21883b7e3ed1d9f7556d0e524e
+72ddb259a4d09f8e0d06cb2abc9a3eedfcb4200e:
+  title: 'media: xc4000: Fix atomicity violation in xc4000_get_frequency'
+  mainline: 36d503ad547d1c75758a6fcdbec2806f1b6aeb41
+  backport: 49486ded3cf00d844277c258f4c6170b7ba0792b
+ab2c2f5d9576112ad22cfd3798071cb74693b1f5:
+  title: 'KVM: Always flush async #PF workqueue when vCPU is being destroyed'
+  mainline: 3d75b8aa5c29058a512db29da7cbee8052724157
+  backport: 270a92c92373a65c649de646996a14f2523076c1
+452529f9b6094f32d9143ef54af5bffd374a9c27:
+  title: 'sparc64: NMI watchdog: fix return value of __setup handler'
+  mainline: 3ed7c61e49d65dacb96db798c0ab6fcd55a1f20f
+  backport: 66476cee65989ef662adc023102b54206faa056a
+f9f20f3f7a9ab575f288024035cfced67ac5145f:
+  title: 'sparc: vDSO: fix return value of __setup handler'
+  mainline: 5378f00c935bebb846b1fdb0e79cb76c137c56b5
+  skipped: fixes patch not in branch
+277035d2da928bb50ff5ba8723dc4f0284284223:
+  title: 'crypto: qat - fix double free during reset'
+  mainline: 01aed663e6c421aeafc9c330bda630976b50a764
+  backport: 2eb2a9ca28c54db784293209ef58babd54d359ed
+daba62d9eeddcc5b1081be7d348ca836c83c59d7:
+  title: 'crypto: qat - resolve race condition during AER recovery'
+  mainline: 7d42e097607c4d246d99225bf2b195b6167a210c
+  backport: 80509311946cbc5c9b71cb2730c5cb0cbc8ebd45
+9840d1897e28f8733cc1e38f97e044f987dc0a63:
+  title: 'fat: fix uninitialized field in nostale filehandles'
+  mainline: fde2497d2bc3a063d8af88b258dbadc86bd7b57c
+  backport: e5e642ae8fb37cc06046bebf193cd4957d945c73
+4aa554832b9dc9e66249df75b8f447d87853e12e:
+  title: 'ubifs: Set page uptodate in the correct place'
+  mainline: 723012cab779eee8228376754e22c6594229bf8f
+  backport: 5109254ba7cb8452f154b8c5dbb4a7e1224a9f8b
+ff818a59ecdfb13a8eb4a38a87b869090dd1745c:
+  title: 'ubi: Check for too small LEB size in VTBL code'
+  mainline: 68a24aba7c593eafa8fd00f2f76407b9b32b47a9
+  backport: c05dbbe027edbe0f2cb9514f8d8084eb96fc2256
+113d2c358fe9b9c2b307b4984ed41dfce6f78347:
+  title: 'ubi: correct the calculation of fastmap size'
+  mainline: 7f174ae4f39e8475adcc09d26c5a43394689ad6c
+  backport: 13e3ca30e708d8efed15b15f6d0cf232c071aa9c
+32248b37aa141fa9d9dccf24d67295de39d68e6f:
+  title: 'parisc: Do not hardcode registers in checksum functions'
+  mainline: 52b2d91752a82d9350981eb3b3ffc4b325c84ba9
+  backport: 0f8a1215c497c27c788e2c7399b1aaac9c205e75
+5cdd5e21c16369dd334e38b6c1aa6c2eaecaebdd:
+  title: 'parisc: Fix ip_fast_csum'
+  mainline: a2abae8f0b638c31bb9799d9dd847306e0d005bd
+  backport: f221d4640d25832bbee599d5c24cda1a040125a1
+103616f04373ce99dc8fb601100163292c9d9700:
+  title: 'parisc: Fix csum_ipv6_magic on 32-bit systems'
+  mainline: 4408ba75e4ba80c91fde7e10bccccf388f5c09be
+  backport: b8cb20b9c4c197de9d905518f4227ed7dcaa7aaa
+ee185ae2b97933193cf1e44e959a80690f835fb3:
+  title: 'parisc: Fix csum_ipv6_magic on 64-bit systems'
+  mainline: 4b75b12d70506e31fc02356bbca60f8d5ca012d0
+  backport: bff540549bd2b5c312c5dc43a094b685467a9fa6
+7d27b71af7262ec53ec49f2679fdb3509ee28098:
+  title: 'parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds'
+  mainline: 0568b6f0d863643db2edcc7be31165740c89fa82
+  backport: 6711300be2eb4c7d6f43ac023b5ec484166c79c2
+312ead3c0e23315596560e9cc1d6ebbee1282e40:
+  title: 'PM: suspend: Set mem_sleep_current during kernel command line setup'
+  mainline: 9bc4ffd32ef8943f5c5a42c9637cfd04771d021b
+  backport: 56a2eacb2e9155c55916bd4eab07d7c4204b683f
+e117c6e2d1617520f5f7d7f6f6b395f01d8b5a27:
+  title: 'clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays'
+  mainline: 1040ef5ed95d6fd2628bad387d78a61633e09429
+  skipped: fixes patch not in branch
+5533686e99b04994d7c4877dc0e4282adc9444a2:
+  title: 'clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays'
+  mainline: a903cfd38d8dee7e754fb89fd1bebed99e28003d
+  backport: 504cb476a9133b6c59bf54d9b267b1196544226e
+99740c4791dc8019b0d758c5389ca6d1c0604d95:
+  title: 'clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays'
+  mainline: e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96
+  backport: 9fcafc89b8ec3ad253f9ad9a67012141893aee44
+8f7f583ce3393580eb8a55942d05e3ab6eb161ba:
+  title: 'powerpc/fsl: Fix mfpmr build errors with newer binutils'
+  mainline: 5f491356b7149564ab22323ccce79c8d595bfd0c
+  backport: 822a0ce90098854047b7088afd2dae656b90bdcb
+fd3b0646012973dcef107f614300076c35aec30e:
+  title: 'USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB'
+  mainline: 3fb7bc4f3a98c48981318b87cf553c5f115fd5ca
+  backport: 9598535c6526853f78a891421f12783174e05482
+64d0643a8b7bed28f011bf1f942a4d6972d815ca:
+  title: 'USB: serial: add device ID for VeriFone adapter'
+  mainline: cda704809797a8a86284f9df3eef5e62ec8a3175
+  backport: 8a13c955082f3d8ce5ea1badda9e72fcdb0908d9
+dea245d8c104a2977d79e2310b83fd5d9a39861f:
+  title: 'USB: serial: cp210x: add ID for MGP Instruments PDS100'
+  mainline: a0d9d868491a362d421521499d98308c8e3a0398
+  backport: 24dc68b8236fd0ccb59be9dd9492e5bcfb89f3aa
+03c0edfa0533fbc9fd9ecd5350c5c3639e3171b1:
+  title: 'USB: serial: option: add MeiG Smart SLM320 product'
+  mainline: 46809c51565b83881aede6cdf3b0d25254966a41
+  backport: 618c54ca2dd86b503e06c8df9ced140e53a48d99
+99e7b5884bb1fa4703a03af0bb740eb797ed335c:
+  title: 'USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M'
+  mainline: b1a8da9ff1395c4879b4bd41e55733d944f3d613
+  backport: 8436412b0d625fe55cd4ea391bf0cd606b7c748a
+66ed532e73bdfdcdb4b49bf6e92db7758bd2ff21:
+  title: 'PM: sleep: wakeirq: fix wake irq warning in system suspend'
+  mainline: e7a7681c859643f3f2476b2a28a494877fd89442
+  backport: e28c7f715843eb54828e33d60ef14c0ebc8e3d47
+c421a077bb1a4b0923792ee6fc9e1b246d5fa6d6:
+  title: 'mmc: tmio: avoid concurrent runs of mmc_request_done()'
+  mainline: e8d1b41e69d72c62865bebe8f441163ec00b3d44
+  backport: 601d558db55ea0010315cbc4a4bb83e8eb7bf038
+0f8957f5077b29cda838be2f75ef6cd2668e6df4:
+  title: 'fuse: don''t unhash root'
+  mainline: b1fe686a765e6c0d71811d825b5a1585a202b777
+  backport: 0be0578f83ec594ad05ae6821a34de4b769c7db7
+064300ccb0e272adcedd96df96750d08c5a4d2f2:
+  title: 'PCI: Drop pci_device_remove() test of pci_dev->driver'
+  mainline: 097d9d414433315122f759ee6c2d8a7417a8ff0f
+  backport: 76c167a161ef90c6588ec0dda97ec68d8fd6e9a6
+9a87375bb586515c0af63d5dcdcd58ec4acf20a6:
+  title: 'PCI/PM: Drain runtime-idle callbacks before driver removal'
+  mainline: 9d5286d4e7f68beab450deddbb6a32edd5ecf4bf
+  backport: 1453f1042e621a4a7247c9069755473a0eefa1ba
+130e2ae1fdf361f3a5a9b21db10fe519c54ad470:
+  title: 'Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""'
+  mainline: 3445139e3a594be77eff48bc17eff67cf983daed
+  backport: 050bbf8ca58f05c6f76244284ccb7942dfbb00c9
+da81cab62b4f48fc3800db68ed30f8dd94e78f92:
+  title: 'dm-raid: fix lockdep waring in "pers->hot_add_disk"'
+  mainline: 95009ae904b1e9dca8db6f649f2d7c18a6e42c75
+  backport: 6ac966e0c64f616bf5ae8c9e3655827fafa2a288
+14db3446d26511191088a941069bcdec97223728:
+  title: 'mmc: core: Fix switch on gp3 partition'
+  mainline: 4af59a8df5ea930038cd3355e822f5eedf4accc1
+  backport: 1c6f43992e92359208930b339fd57f04e157da73
+f6b084787b7d9bd4009e0d6d1f0cc79349f7efcd:
+  title: 'hwmon: (amc6821) add of_match table'
+  mainline: 3f003fda98a7a8d5f399057d92e6ed56b468657c
+  backport: 805bd3875b89fe0311ca2e530836ec10cb390798
+75cc31c2e7193b69f5d25650bda5bb42ed92f8a1:
+  title: 'ext4: fix corruption during on-line resize'
+  mainline: a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc
+  backport: 4c3c05340a8d2925c998e568db8c6199a08df5c4
+4e4715eb2845ed6d03de905142c36b7e772efffc:
+  title: 'slimbus: core: Remove usage of the deprecated ida_simple_xx() API'
+  mainline: 89ffa4cccec54467446f141a79b9e36893079fb8
+  skipped: fixes patch not in branch
+37f4f4f1ac2661c1cc7766a324d34b24f65e75e8:
+  title: 'speakup: Fix 8bit characters from direct synth'
+  mainline: b6c8dafc9d86eb77e502bb018ec4105e8d2fbf78
+  backport: 4f84ef5651a0ae72ca8bc3f1529a9863a90862c7
+39460da0515e5ef2afc67a184395daf8f97f74a1:
+  title: 'kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1'
+  mainline: 75b5ab134bb5f657ef7979a59106dce0657e8d87
+  backport: 49362eca812601c014d7006bd66b8b6484277d98
+af47ec223f6d9d72d2ddd3fb31a7d1210eafd0bb:
+  title: 'vfio/platform: Disable virqfds on cleanup'
+  mainline: fcdc0d3d40bc26c105acf8467f7d9018970944ae
+  backport: fbe0715512c3fca4b0d1c8e746f18bd2f24d042f
+b56a793f267679945d1fdb9a280013bd2d0ed7f9:
+  title: 'soc: fsl: qbman: Always disable interrupts when taking cgr_lock'
+  mainline: 584c2a9184a33a40fceee838f856de3cffa19be3
+  backport: 94dcaef811b46fe6df7487a738e14e747c10e4f7
+99fe1b21b5e5bf69d351adca3c594c46c5bf155b:
+  title: 'soc: fsl: qbman: Add helper for sanity checking cgr ops'
+  mainline: d0e17a4653cebc2c8a20251c837dd1fcec5014d9
+  backport: 321e5b5b657ed28e3e12c00b1d1c7a1aed0080b6
+e2bd2df406edd2dff1b105f9dea3c502ee5808c3:
+  title: 'soc: fsl: qbman: Add CGR update function'
+  mainline: 914f8b228ede709274b8c80514b352248ec9da00
+  backport: a8363db776a883cdbf0fd646f3133b3e3f110977
+2b3fede8225133671ce837c0d284804aa3bc7a02:
+  title: 'soc: fsl: qbman: Use raw spinlock for cgr_lock'
+  mainline: fbec4e7fed89b579f2483041fabf9650fb0dd6bc
+  backport: e32c360971de834a38399f982b9d9c5993b6d5ef
+7e500849fa558879a1cde43f80c7c048c2437058:
+  title: 's390/zcrypt: fix reference counting on zcrypt card objects'
+  mainline: 50ed48c80fecbe17218afed4f8bed005c802976c
+  backport: 6b39a518dba77c95d71e3d05bf2667602b3a206b
+749e6b3a2dfc9d393874e7a6cc7fed6eeda97ee0:
+  title: 'drm/imx/ipuv3: do not return negative values from .get_modes()'
+  mainline: c2da9ada64962fcd2e6395ed9987b9874ea032d3
+  backport: 133f1b251a963f13a59296ffd812314b3895acd5
+6206e70d5faa5a9e8a3250683ebee1637d3559fa:
+  title: 'drm/vc4: hdmi: do not return negative values from .get_modes()'
+  mainline: abf493988e380f25242c1023275c68bd3579c9ce
+  backport: e08287742d6330d8946d74dbd16fa6ab32f584b9
+6e7044f155f7756e4489d8ad928f3061eab4595b:
+  title: 'memtest: use {READ,WRITE}_ONCE in memory scanning'
+  mainline: 82634d7e24271698e50a3ec811e5f50de790a65f
+  backport: cead81caaf4e893de661245723b033c776eba434
+b67189690eb4b7ecc84ae16fa1e880e0123eaa35:
+  title: 'nilfs2: fix failure to detect DAT corruption in btree and direct mappings'
+  mainline: f2f26b4a84a0ef41791bd2d70861c8eac748f4ba
+  backport: 592973ee7e6a0af69d6689fa946f83544b0b7f32
+5c8f85e9ff21ee1fc6d20fcd73a15877556c3bbe:
+  title: 'nilfs2: use a more common logging style'
+  mainline: a1d0747a393a079631130d61faa2a61027d1c789
+  backport: f54f17b7da72676032972ac38c70d5f958b93591
+91e4c4595fae5e87069e44687ae879091783c183:
+  title: 'nilfs2: prevent kernel bug at submit_bh_wbc()'
+  mainline: 269cdf353b5bdd15f1a079671b0f889113865f20
+  backport: a3a1048f65cd381d4efdf6d4beb71eddb5d54ac5
+e4d581a5afa0d94dfae46e9cc9d729db11d1a7b2:
+  title: 'x86/CPU/AMD: Update the Zenbleed microcode revisions'
+  mainline: 5c84b051bd4e777cf37aaff983277e58c99618d5
+  skipped: fixes patch not in branch
+ece903bf390e819c45fba8cf6a31c7487e24c505:
+  title: 'ahci: asm1064: correct count of reported ports'
+  mainline: 9815e39617541ef52d0dfac4be274ad378c6dc09
+  backport: 01877909cac69ce374567fddfb200298900be9d8
+d29630b79d4c48b31312fa3d735de63cbe97e6c5:
+  title: 'ahci: asm1064: asm1166: don''t limit reported ports'
+  mainline: 6cd8adc3e18960f6e59d797285ed34ef473cc896
+  backport: adc881c85ad12350f907e04d3a8c0d2242873b3a
+4b6e87971dbea7d9231f670281723003f90429b2:
+  title: 'comedi: comedi_test: Prevent timers rescheduling during deletion'
+  mainline: f53641a6e849034a44bf80f50245a75d7a376025
+  backport: 8e23affd6f90a54fc41e30143bf3fee824dd3f24
+e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9:
+  title: 'netfilter: nf_tables: disallow anonymous set with timeout flag'
+  mainline: 16603605b667b70da974bea8216c93e7db043bf1
+  backport: c125ac99931ed065edcf24f7ab4572e03840633e
+9372a64fb8a9f8e9cc59a0c8fa2ab5a670384926:
+  title: 'netfilter: nf_tables: reject constant set with timeout'
+  mainline: 5f4fc4bd5cddb4770ab120ce44f02695c4505562
+  backport: 6579e677dcdff3b57c01dfd05076c5f602dddf3d
+79fa29ce641165aa5d934f55f2369aacfd7c35e4:
+  title: 'xfrm: Avoid clang fortify warning in copy_to_user_tmpl()'
+  mainline: 1a807e46aa93ebad1dfbed4f82dc3bf779423a6e
+  backport: 92844cb2a29c9cb805badb5f0b47b1a7b064ae6e
+341568ef8afd587d1e6edd1c4a2e6daec438ea34:
+  title: 'ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform'
+  mainline: d397b6e56151099cf3b1f7bfccb204a6a8591720
+  backport: ee2aa965bc6fa84adcc53b1daef7bc40bfa0d890
+9968c701cba7eda42e5f0052b040349d6222ae34:
+  title: 'USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command'
+  mainline: 014bcf41d946b36a8f0b8e9b5d9529efbb822f49
+  backport: c549cae12cd0f345aff86d8b4ea4e4234476f23e
+e2dbfea520e60d58e0c498ba41bde10452257779:
+  title: 'usb: gadget: ncm: Fix handling of zero block length packets'
+  mainline: f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70
+  backport: 0dcddb86a5d646529e4395f7206ae146d07be618
+8697e9b39f57fdae216d1fa6947e196307516aac:
+  title: 'usb: port: Don''t try to peer unused USB ports based on location'
+  mainline: 69c63350e573367f9c8594162288cffa8a26d0d1
+  backport: 602634cfb4b83b8bb798fb91fe9fa8a0aef24c72
+206ef729592010631fd2fe721a94b4e71c61653e:
+  title: 'tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled'
+  mainline: 74cb7e0355fae9641f825afa389d3fba3b617714
+  backport: 0b11f20185ce5eb0cba6d38542c33020592085f5
+fc7dfe3d123f00e720be80b920da287810a1f37d:
+  title: 'vt: fix unicode buffer corruption when deleting characters'
+  mainline: 1581dafaf0d34bc9c428a794a22110d7046d186d
+  skipped: bug introduced in d8ae7242718738ee1bf9bfdd632d2a4b150fdd26
+c8686c014b5e872ba7e334f33ca553f14446fc29:
+  title: 'vt: fix memory overlapping when deleting chars in the buffer'
+  mainline: 39cdb68c64d84e71a4a717000b6e5de208ee60cc
+  backport: d594c0266f6a7959f1844a5b51786ddb695ed093
+27f83f1cacba82afa4c9697e3ec3abb15e92ec82:
+  title: 'mm/memory-failure: fix an incorrect use of tail pages'
+9e92cefdaa7537515dc0ff6cc73d46fa31b062fc:
+  title: 'mm/migrate: set swap entry values of THP tail pages properly.'
+ea9a0cfc07a7d3601cc680718d9cff0d6927a921:
+  title: 'wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes'
+  mainline: 4f2bdb3c5e3189297e156b3ff84b140423d64685
+  backport: 85c54b93ba34a1150bffd0158f4ec43b1d17cf3f
+3a679f8a8c88de0b17b0bfde031238b40daf76ba:
+  title: 'exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()'
+  mainline: 2aea94ac14d1e0a8ae9e34febebe208213ba72f7
+  backport: 2743401fbf05f96c405165f8176873a62c813768
+5904411219601127ffdbd2d622bb5d67f9d8d16c:
+  title: 'usb: cdc-wdm: close race between read and workqueue'
+  mainline: 339f83612f3a569b194680768b22bf113c26a29d
+  backport: 2eb4d359ad399b7c830e00d52bcf30b776bf7bc8
+eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2:
+  title: 'ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs'
+  mainline: 051e0840ffa8ab25554d6b14b62c9ab9e4901457
+  backport: 57ad2852b697ab931110d4443e42aa15420928cd
+10ca82aff58434e122c7c757cf0497c335f993f3:
+  title: 'fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion'
+  mainline: 961ebd120565cb60cebe21cb634fbc456022db4a
+  backport: 9b033ffdc4492f9882d1e3d8416f3c9a3b1c281e
+45f99d441067035dbb3f2a0d9713abe61ea721c5:
+  title: 'printk: Update @console_may_schedule in console_trylock_spinning()'
+  mainline: 8076972468584d4a21dab9aa50e388b3ea9ad8c7
+  backport: 271b5f628523048373853e7d726edc4ab6b2dafa
+022ed023c8c0bed09a21e9617056723df948544c:
+  title: 'btrfs: allocate btrfs_ioctl_defrag_range_args on stack'
+  mainline: c853a5783ebe123847886d432354931874367292
+  backport: 8e0244b75adcff266630f97bdedb589988c1605d
+6bdf4e6dfb60cbb6121ccf027d97ed2ec97c0bcb:
+  title: 'Revert "loop: Check for overflow while configuring loop"'
+944e9628259117a2f21d9c7ce5d7fbb305cc6ba6:
+  title: 'loop: Call loop_config_discard() only after new config is applied'
+  mainline: 7c5014b0987a30e4989c90633c198aced454c0ec
+  backport: 7d51a15acdfba9db409c1fea20682dba5e4c533d
+f92a3b0d003b9f7eb1f452598966a08802183f47:
+  title: 'loop: Remove sector_t truncation checks'
+  mainline: 083a6a50783ef54256eec3499e6575237e0e3d53
+  skipped: this is later reverted in 4.19
+bf6bec6f4679ccc713c69fa343b7b82879b0755b:
+  title: 'loop: Factor out setting loop device size'
+  mainline: 5795b6f5607f7e4db62ddea144727780cb351a9b
+  skipped: commit did not cherry-pick cleanly
+e6189dfedef6b39a868f4f238f3940e2848ee793:
+  title: 'loop: Refactor loop_set_status() size calculation'
+  mainline: b0bd158dd630bd47640e0e418c062cda1e0da5ad
+  skipped: commit did not cherry-pick cleanly
+a1ae8bb62f254930686a9a81641bac18582b1051:
+  title: 'loop: properly observe rotational flag of underlying device'
+  mainline: 56a85fd8376ef32458efb6ea97a820754e12f6bb
+  skipped: (unknown reason)
+a2039c87d30177f0fd349ab000e6af25a0d48de8:
+  title: 'perf/core: Fix reentry problem in perf_output_read_group()'
+  mainline: 6b959ba22d34ca793ffdb15b5715457c78e38b1a
+  backport: d1bcca1f152951849067da419020d041495285d3
+a7bd7dbaa2ddcf8c5ed5d96df240f1442447d252:
+  title: 'efivarfs: Request at most 512 bytes for variable names'
+  mainline: f45812cc23fb74bef62d4eb8a69fe7218f4b9f2a
+  backport: 4cb71f760e2735758614a3798d255aa93862d577
+9b021c7ffbbf7569b074c3f6cafa377b8c29a2e3:
+  title: 'powerpc: xor_vmx: Add ''-mhard-float'' to CFLAGS'
+  mainline: 35f20786c481d5ced9283ff42de5c69b65e5ed13
+  backport: 5ef535b7348ea1372234b51a6c806617275b8968
+6db027841deee469962c68ed8b515046be6203fd:
+  title: 'loop: Factor out configuring loop from status'
+  mainline: 0c3796c244598122a5d59d56f30d19390096817f
+  skipped: commit did not cherry-pick cleanly
+a217715338fd48f72114725aa7a40e484a781ca7:
+  title: 'loop: Check for overflow while configuring loop'
+  mainline: c490a0b5a4f36da3918181a8acdc6991d967c5f3
+  skipped: commit did not cherry-pick cleanly
+832580af82ace363205039a8e7c4ef04552ccc1a:
+  title: 'loop: loop_set_status_from_info() check before assignment'
+  mainline: 9f6ad5d533d1c71e51bdd06a5712c4fbc8768dfa
+  skipped: commit did not cherry-pick cleanly
+3b16163f6160d40c4d62614b7646992cf3ed3b28:
+  title: 'usb: dwc2: host: Fix remote wakeup from hibernation'
+  mainline: bae2bc73a59c200db53b6c15fb26bb758e2c6108
+  skipped: fixes patch not in branch
+8c93d233285e234b84bc34c9de317ccf3ae00aec:
+  title: 'usb: dwc2: host: Fix hibernation flow'
+  mainline: 3c7b9856a82227db01a20171d2e24c7ce305d59b
+  backport: d249d755055ea72ae93f908e4f009672bb4a367b
+dca1dc1e99e09e7b8eaccb55d6aecb87d9cb8ecd:
+  title: 'usb: dwc2: host: Fix ISOC flow in DDMA mode'
+  mainline: b258e42688501cadb1a6dd658d6f015df9f32d8f
+  backport: 3e18f9aae5c9f4ee7c82f727c7db4bdc66055af9
+d32e8f2ffe813e69755e40633cf0b4ec0d1489c4:
+  title: 'usb: dwc2: gadget: LPM flow fix'
+  mainline: 5d69a3b54e5a630c90d82a4c2bdce3d53dc78710
+  skipped: fixes patch not in branch
+2b002c308e184feeaeb72987bca3f1b11e5f70b8:
+  title: 'usb: udc: remove warning when queue disabled ep'
+  mainline: 2a587a035214fa1b5ef598aea0b81848c5b72e5e
+  backport: 933c295f1bf97ef659d06b2fa268f948de50ffc9
+b73377124f56d2fec154737c2f8d2e839c237d5a:
+  title: 'scsi: qla2xxx: Fix command flush on cable pull'
+  mainline: a27d4d0e7de305def8a5098a614053be208d1aa1
+  backport: e31a16fe832d4016c83230cc8bd7f67493e1c9a7
+bb8cc9c34361714dd232700b3d5f1373055de610:
+  title: 'x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled'
+  mainline: fd470a8beed88440b160d690344fbae05a0b9b1b
+  backport: 909ca3e7e6fb1ae6130e1a7d473acc1c8bbc9ffa
+5df0d994c23a43f4c0f2a7fdf6b62e106d08e53e:
+  title: 'scsi: lpfc: Correct size for wqe for memset()'
+  mainline: 28d41991182c210ec1654f8af2e140ef4cc73f20
+  backport: 03119f856df4a8f68fbc6c3d2dfc5b42634c5287
+8cbdd324b41528994027128207fae8100dff094f:
+  title: 'USB: core: Fix deadlock in usb_deauthorize_interface()'
+  mainline: 80ba43e9f799cbdd83842fc27db667289b3150f5
+  backport: f354bb2f646ba9eb13094f3a58a9fcb2495cdaf8
+11387b2effbb55f58dc2111ef4b4b896f2756240:
+  title: 'nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet'
+  mainline: d24b03535e5eb82e025219c2f632b485409c898f
+  backport: 746dafa5f8bd92d019409cd1e3991b6b23ed9808
+9c382bc16fa8f7499b0663398437e125cf4f763b:
+  title: 'mptcp: add sk_stop_timer_sync helper'
+  mainline: 08b81d873126b413cda511b1ea1cbb0e99938bbd
+  backport: f113056cc53497bafb4a5a1ae59fcb8da95409df
+93f0133b9d589cc6e865f254ad9be3e9d8133f50:
+  title: 'tcp: properly terminate timers for kernel sockets'
+  mainline: 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada
+  backport: a15af438bc3f84cd18bd555ed93704f174afd28e
+60cc92f8d4231eda8fcb89153a55a93bfbc0ddde:
+  title: 'r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d'
+  mainline: 5d872c9f46bd2ea3524af3c2420a364a13667135
+  skipped: fixes patch not in branch
+96caf943a0f384f347d0d32afa8a3e94837fe012:
+  title: 'Bluetooth: hci_event: set the conn encrypted before conn establishes'
+  mainline: c569242cd49287d53b73a94233db40097d838535
+  backport: 0d619c44f46a548f37d0af8526b1e2141888415c
+466488b14a87dc97d8a3bf5e65a30bff032847c1:
+  title: 'Bluetooth: Fix TOCTOU in HCI debugfs implementation'
+  mainline: 7835fcfd132eb88b87e8eb901f88436f63ab60f7
+  backport: bddbc4e6e85deec70cfd5e4d06553687ce2031e2
+116b0e8e4673a5faa8a739a19b467010c4d3058c:
+  title: 'netfilter: nf_tables: disallow timeout for anonymous sets'
+  mainline: e26d3009efda338f19016df4175f354a9bd0a4ab
+  backport: 2828c51f974e201fb04d01231d502059b21dee7d
+d275de8ea7be3a453629fddae41d4156762e814c:
+  title: 'net/rds: fix possible cp null dereference'
+  mainline: 62fc3357e079a07a22465b9b6ef71bb6ea75ee4b
+  skipped: fixes patch not in branch
+b66762945d3289d472cedfca81dd98f9d8efe3b7:
+  title: 'Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."'
+  mainline: c567f2948f57bdc03ed03403ae0234085f376b7d
+  backport: 0c4e907602df65b88f9bed57d6bc5039b7172e8c
+c82a659cc8bb7a7f8a8348fc7f203c412ae3636f:
+  title: 'mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations'
+  mainline: 803de9000f334b771afacb6ff3e78622916668b0
+  backport: ce55bbe3422d77c1733e562b2481ae5d5609e4de
+69d1fe14a680042ec913f22196b58e2c8ff1b007:
+  title: 'netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()'
+  mainline: 24225011d81b471acc0e1e315b7d9905459a6304
+  skipped: fixes patch not in branch
+f190a4aa03cbd518bd9c62a66e1233984f5fd2ec:
+  title: 'net/sched: act_skbmod: prevent kernel-infoleak'
+  mainline: d313eb8b77557a6d5855f42d2234bd592c7b50dd
+  backport: 750226b1e9ada5f831c682b3970e6fb4c908de43
+c5dd42e0c490416e45fac594694cbc0ada0ea0f9:
+  title: 'net: stmmac: fix rx queue priority assignment'
+  mainline: b3da86d432b7cd65b025a11f68613e333d2483db
+  backport: 77222083054d1880d96617dc92433f13f7485340
+d6c0a37d412657cf2661996387340e8afeb82a63:
+  title: 'selftests: reuseaddr_conflict: add missing new line at the end of the output'
+  mainline: 31974122cfdeaf56abc18d8ab740d580d9833e90
+  backport: b406df4814ddb671e6b276983496bfe1fbbb70d8
+9472d07cd095cbd3294ac54c42f304a38fbe9bfe:
+  title: 'ipv6: Fix infinite recursion in fib6_dump_done().'
+  mainline: d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae
+  backport: 1c37416298197f52e10ae196eff4e11f07c11a96
+cc9cd02dd9e8b7764ea9effb24f4f1dd73d1b23d:
+  title: 'i40e: fix vf may be used uninitialized in this function warning'
+  mainline: f37c4eac99c258111d414d31b740437e1925b8e8
+  skipped: fixes patch not in branch
+11895fd09f5d37abbc60ac88f4897587997cfbf5:
+  title: 'staging: mmal-vchiq: Avoid use of bool in structures'
+  mainline: 640e77466e69d9c28de227bc76881f5501f532ca
+  backport: 4a254ec690b1730e4360c6c82a1e6a220f757bb1
+48823cc0c75c3290d82b339f2135e54d6c20eaaa:
+  title: 'staging: mmal-vchiq: Allocate and free components as required'
+  mainline: 8c589e1794a31e9a381916b0280260ab601e4d6e
+  backport: cde080763f772971b9bab16de6a83a57bfa72941
+60cb8c4ae9874e8b7906302306e85e3138cb19fc:
+  title: 'staging: mmal-vchiq: Fix client_component for 64 bit kernel'
+  mainline: 22e64b486adc4785542f8002c3af4c895490f841
+  backport: 1fbb48548bf323fe8c3bb65573ac2b47a06fcc52
+3a54069c1398266c7523f24db52391f7d54be13f:
+  title: 'staging: vc04_services: changen strncpy() to strscpy_pad()'
+  mainline: ef25725b7f8aaffd7756974d3246ec44fae0a5cf
+  backport: 5e236ea4cd576ca487aaeb6cd4a43b825580f096
+4693868e40b1367d1def54e5ea750da2d288da67:
+  title: 'staging: vc04_services: fix information leak in create_component()'
+  mainline: f37e76abd614b68987abc8e5c22d986013349771
+  backport: 5314097a03c077acf9974718386187c632ff87a6
+a65f5dbf3249b9ca9c05a843d2a5bddad0b9adf6:
+  title: 'initramfs: factor out a helper to populate the initrd image'
+  mainline: 7c184ecd262fe64fe8cf4e099e0f7cefe88d88b2
+  skipped: not needed
+c2f18e9a7619e194e564cd159e830efe7ce7545f:
+  title: 'fs: add a vfs_fchown helper'
+  mainline: c04011fe8cbd80af1be6e12b53193bf3846750d7
+  skipped: not needed
+b78a72266577fa7be6d482b3a49d020c1e10e966:
+  title: 'fs: add a vfs_fchmod helper'
+  mainline: 9e96c8c0e94eea2f69a9705f5d0f51928ea26c17
+  skipped: not needed
+246d6635dc5b326af3ca10212d7339712244ac36:
+  title: 'initramfs: switch initramfs unpacking to struct file based APIs'
+  mainline: bf6419e4d5440c6d414a320506c5488857a5b001
+  skipped: not needed
+9f0dcca773117f0b240d1db97db27f0b8aac106a:
+  title: 'init: open /initrd.image with O_LARGEFILE'
+  mainline: 4624b346cf67400ef46a31771011fb798dd2f999
+  backport: b38a90afb44d28ca6aed9ba7b0e3c83d0e2a0161
+cb6f9da80526a7874bf97fd2a83b95ea415d6ac6:
+  title: 'erspan: Add type I version 0 support.'
+  mainline: f989d546a2d5a9f001f6f8be49d98c10ab9b1897
+  skipped: is a new feature
+06a939f72a24a7d8251f84cf4c042df86c6666ac:
+  title: 'erspan: make sure erspan_base_hdr is present in skb->head'
+  mainline: 17af420545a750f763025149fa7b833a4fc8b8f0
+  skipped: fixes patch not in branch
+a6f9bd4aee2c96d597b765af5f3a61a2b8d8e98c:
+  title: 'ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw'
+  mainline: fc563aa900659a850e2ada4af26b9d7a3de6c591
+  backport: 5d848e29b28655b7cdd56347f17871ebceaa35af
+81e38e4e2c756c95267c758bf683b35ce0ca77b1:
+  title: 'ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit'
+  mainline: 52f80bb181a9a1530ade30bc18991900bbb9697f
+  backport: 4519a94da38decdf42b41f68e360331ab9f44338
+b9bacf4b0e12ae9963774e4de9ddc6631ba65343:
+  title: 'ata: sata_mv: Fix PCI device ID table declaration compilation warning'
+  mainline: 3137b83a90646917c90951d66489db466b4ae106
+  backport: 401b18b386e1e23ebabb0d02ea19464d756a368c
+5fd82952faaabaaefd7e594fce9b19d4b4e754f9:
+  title: 'ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone'
+  mainline: 1576f263ee2147dc395531476881058609ad3d38
+  backport: dbff4c3de9bcdaf9692cd0174ee96b8dbd60bba2
+95f1acd1e998a48197d33720e33161750e459c23:
+  title: 'wifi: ath9k: fix LNA selection in ath_ant_try_scan()'
+  mainline: d6b27eb997ef9a2aa51633b3111bc4a04748e6d3
+  backport: cdf0bc842607a3cb79b4fee6470e73df396effdb
+e87bb99d2df6512d8ee37a5d63d2ca9a39a8c051:
+  title: 'VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()'
+  mainline: 19b070fefd0d024af3daa7329cbc0d00de5302ec
+  backport: cab49d428499a8d81c7923b4c2bd011e71ea6326
+23c6f9f6619a699c196cfc1e5a57becdfe4a0b9a:
+  title: 'arm64: dts: rockchip: fix rk3399 hdmi ports node'
+  mainline: f051b6ace7ffcc48d6d1017191f167c0a85799f6
+  backport: 7960ca05581467d75f635a849f0e367514b19448
+c4f135f454deb2ff4b7a5ec53577aaa776e2fac9:
+  title: 'tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()'
+  mainline: f85450f134f0b4ca7e042dc3dc89155656a2299d
+  backport: 9febcc825310e72385e81d69e9b967b3b4e7205a
+bebd9e0ff90034875c5dfe4bd514fd7055fc7a89:
+  title: 'btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()'
+  mainline: 7411055db5ce64f836aaffd422396af0075fdc99
+  backport: c75868bec680efa61415ec3897135a7d596c384f
+8b11774810aadeda80d4eb54f648eaf88f369d22:
+  title: 'btrfs: export: handle invalid inode or root reference in btrfs_get_parent()'
+  mainline: 26b66d1d366a375745755ca7365f67110bbf6bd5
+  backport: 1b9e5cdca908d0c426ba76b2c277c8c20dca49dd
+be2b6bcc936ae17f42fff6494106a5660b35d8d3:
+  title: 'btrfs: send: handle path ref underflow in header iterate_inode_ref()'
+  mainline: 3c6ee34c6f9cd12802326da26631232a61743501
+  backport: c3e4fbedaa6d065b319e72de153e2be8d8414596
+ec2049fb2b8be3e108fe2ef1f1040f91e72c9990:
+  title: 'Bluetooth: btintel: Fix null ptr deref in btintel_read_version'
+  mainline: b79e040910101b020931ba0c9a6b77e81ab7f645
+  backport: 18ac75f7eb293f56efde10cc65fa7eb6d1350bc9
+004402ec227732308871a6127f0b967cf2a293cd:
+  title: 'Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails'
+  mainline: bc4996184d56cfaf56d3811ac2680c8a0e2af56e
+  backport: c6d084381d756d922236737ce0569fd76b904a62
+13b33feb2ebddc2b1aa607f553566b18a4af1d76:
+  title: 'sysv: don''t call sb_bread() with pointers_lock held'
+  mainline: f123dc86388cb669c3d6322702dc441abc35c31e
+  backport: 385733c04408bec0083e9f768a094db74dc058d2
+edf82aa7e9eb864a09229392054d131b34a5c9e8:
+  title: 'scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()'
+  mainline: 2ae917d4bcab80ab304b774d492e2fcd6c52c06b
+  backport: cf30a0518a5944e7af7c38a04af145c8e5e975e8
+b02e6ba55997926c961a95cdaf9de91f75b0b5c3:
+  title: 'isofs: handle CDs with bad root inode but good Joliet root directory'
+  mainline: 4243bf80c79211a8ca2795401add9c4a3b1d37ca
+  backport: be099afe08c0439e72c1b37f2896d7942b318bdf
+347b2e635e8b2beaa076b0bc110be9c6ea50aec1:
+  title: 'media: sta2x11: fix irq handler cast'
+  mainline: 3de49ae81c3a0f83a554ecbce4c08e019f30168e
+  backport: 95bfe2806bd05c524d8534070c038b8feaae436a
+34f0cabed648481fa21d50a551524115f9326257:
+  title: 'drm/amd/display: Fix nanosec stat overflow'
+  mainline: 14d68acfd04b39f34eea7bea65dda652e6db5bf6
+  skipped: fixes non-present a3e1737ed61c8b6ea078f477eee612e26f9d2561
+56199ebbcbbcc36658c2212b854b37dff8419e52:
+  title: 'SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int'
+  mainline: 2c35f43b5a4b9cdfaa6fdd946f5a212615dac8eb
+  backport: 84b6065e346863ebad34cba5284ff8eddcf4cb4a
+6a55dab4ac956deb23690eedd74e70b892a378e7:
+  title: 'block: prevent division by zero in blk_rq_stat_sum()'
+  mainline: 93f52fbeaf4b676b21acfe42a5152620e6770d02
+  backport: 53510903f234a0aea0f80bd7d3bcccf520fc07c9
+61f291137c04238f8347b1ae184c5b92fabdb3c0:
+  title: 'Input: allocate keycode for Display refresh rate toggle'
+  mainline: cfeb98b95fff25c442f78a6f616c627bc48a26b7
+  skipped: commit did not cherry-pick cleanly
+50e05164d41db0231f2d3273f89a24e2bb62149b:
+  title: 'ktest: force $buildonly = 1 for ''make_warnings_file'' test type'
+  mainline: 07283c1873a4d0eaa0e822536881bfdaea853910
+  skipped: commit did not cherry-pick cleanly
+4a886ce3c846032ed8d9bf18f525f12dcb5de614:
+  title: 'tools: iio: replace seekdir() in iio_generic_buffer'
+  mainline: 4e6500bfa053dc133021f9c144261b77b0ba7dc8
+  backport: 2929cf2f94cfec0fb6afbcdd27ec2bfb6fae1a59
+f90519f1d6a0c4d86bcd401f34bda11486fa4284:
+  title: 'usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined'
+  mainline: 12f371e2b6cb4b79c788f1f073992e115f4ca918
+  backport: b550cc1a3828e39bb76a2c0d8218b57dc8f71f0d
+3affd4cceebd560aa13c280fe0ad46a38e46eb73:
+  title: 'fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2'
+  mainline: bc87bb342f106a0402186bcb588fcbe945dced4b
+  backport: 781096a3f8ab4b70c9b75f8c0d3e5f694e16d843
+1fb52bc1de55e9e0bdf71fe078efd4da0889710f:
+  title: 'fbmon: prevent division by zero in fb_videomode_from_videomode()'
+  mainline: c2d953276b8b27459baed1277a4fdd5dd9bd4126
+  backport: ebe31b54cbaf1029c6ecd6f8e59d6bb59b59280a
+7d303dee473ba3529d75b63491e9963342107bed:
+  title: 'tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc'
+  mainline: 67c37756898a5a6b2941a13ae7260c89b54e0d88
+  backport: d7d6dfa21578d006e6023f9eddc4029774e6a6d6
+4d0adb19dc8aba90f2298560fd65871f1afbd2ca:
+  title: 'drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()'
+5908fb34c0cf62c0f25f916d50d00582b053e077:
+  title: 'virtio: reenable config if freezing device failed'
+  mainline: 310227f42882c52356b523e2f4e11690eebcd2ab
+  backport: 6419be48607d845c7b94621da5405191a0805754
+f18681daaec9665a15c5e7e0f591aad5d0ac622b:
+  title: 'x86/mm/pat: fix VM_PAT handling in COW mappings'
+  mainline: 04c35ab3bdae7fefbd7c7a7355f29fa03a035221
+  backport: e917dc0ff33859792cb7328fc84068471824639b
+81a3ce3efd82e0790a6151c3dad6c02570d48816:
+  title: 'Bluetooth: btintel: Fixe build regression'
+  mainline: 6e62ebfb49eb65bdcbfc5797db55e0ce7f79c3dd
+  backport: 9be9972d568f71227eb0d8b300af769013f27b42
+cc065e1b11a270ebd2b18bbe61f0d6cc8efaa15d:
+  title: 'VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()'
+  mainline: e606e4b71798cc1df20e987dde2468e9527bd376
+  backport: 84edf3cb66dffa4c868347741aa8ac43073ffcf1
+584661cc24d740bc0d68b605e7089d80a99bba9d:
+  title: 'erspan: Check IFLA_GRE_ERSPAN_VER is set.'
+  mainline: 51fa960d3b5163b1af22efdebcabfccc5d615ad6
+  skipped: commit did not cherry-pick cleanly
+cb2dd30f318974cc640f1b1929f501ea9cb94bd5:
+  title: 'ip_gre: do not report erspan version on GRE interface'
+  mainline: ee496694b9eea651ae1aa4c4667d886cdf74aa3b
+  skipped: commit did not cherry-pick cleanly
+931e5381cb30355332f20854f80a0a1f18f6f1f1:
+  title: 'initramfs: fix populate_initrd_image() section mismatch'
+  mainline: 4ada1e810038e9dbc20e40b524e05ee1a9d31f98
+  skipped: commit did not cherry-pick cleanly
+e6721ea845fcb93a764a92bd40f1afc0d6c69751:
+  title: 'amdkfd: use calloc instead of kzalloc to avoid integer overflow'
+  mainline: 3b0daecfeac0103aba8b293df07a0cbaf8b43f29
+  skipped: vulnerable code is not present
diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
index 0fba375..3056003 100644
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -484,11 +484,14 @@
 
    Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at
    boot, by setting the IBRS bit, and they're automatically protected against
-   Spectre v2 variant attacks, including cross-thread branch target injections
-   on SMT systems (STIBP). In other words, eIBRS enables STIBP too.
+   Spectre v2 variant attacks.
 
-   Legacy IBRS systems clear the IBRS bit on exit to userspace and
-   therefore explicitly enable STIBP for that
+   On Intel's enhanced IBRS systems, this includes cross-thread branch target
+   injections on SMT systems (STIBP). In other words, Intel eIBRS enables
+   STIBP, too.
+
+   AMD Automatic IBRS does not protect userspace, and Legacy IBRS systems clear
+   the IBRS bit on exit to userspace, therefore both explicitly enable STIBP.
 
    The retpoline mitigation is turned on by default on vulnerable
    CPUs. It can be forced on or off by the administrator
@@ -622,9 +625,10 @@
                 retpoline,generic       Retpolines
                 retpoline,lfence        LFENCE; indirect branch
                 retpoline,amd           alias for retpoline,lfence
-                eibrs                   enhanced IBRS
-                eibrs,retpoline         enhanced IBRS + Retpolines
-                eibrs,lfence            enhanced IBRS + LFENCE
+                eibrs                   Enhanced/Auto IBRS
+                eibrs,retpoline         Enhanced/Auto IBRS + Retpolines
+                eibrs,lfence            Enhanced/Auto IBRS + LFENCE
+                ibrs                    use IBRS to protect kernel
 
 		Not specifying this option is equivalent to
 		spectre_v2=auto.
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 0b0638a..1127a06 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4248,9 +4248,9 @@
 			retpoline,generic - Retpolines
 			retpoline,lfence  - LFENCE; indirect branch
 			retpoline,amd     - alias for retpoline,lfence
-			eibrs		  - enhanced IBRS
-			eibrs,retpoline   - enhanced IBRS + Retpolines
-			eibrs,lfence      - enhanced IBRS + LFENCE
+			eibrs		  - Enhanced/Auto IBRS
+			eibrs,retpoline   - Enhanced/Auto IBRS + Retpolines
+			eibrs,lfence      - Enhanced/Auto IBRS + LFENCE
 			ibrs		  - use IBRS to protect kernel
 
 			Not specifying this option is equivalent to
diff --git a/Makefile b/Makefile
index 66f87ad..b7d206c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 14
-SUBLEVEL = 344
+SUBLEVEL = 345
 EXTRAVERSION = -openela
 NAME = Petit Gorille
 
diff --git a/arch/arm/boot/dts/mmp2-brownstone.dts b/arch/arm/boot/dts/mmp2-brownstone.dts
index 350208c..f12d5aa 100644
--- a/arch/arm/boot/dts/mmp2-brownstone.dts
+++ b/arch/arm/boot/dts/mmp2-brownstone.dts
@@ -21,176 +21,174 @@
 	memory {
 		reg = <0x00000000 0x08000000>;
 	};
+};
 
-	soc {
-		apb@d4000000 {
-			uart3: uart@d4018000 {
-				status = "okay";
-			};
-			twsi1: i2c@d4011000 {
-				status = "okay";
-				pmic: max8925@3c {
-					compatible = "maxium,max8925";
-					reg = <0x3c>;
-					interrupts = <1>;
-					interrupt-parent = <&intcmux4>;
-					interrupt-controller;
-					#interrupt-cells = <1>;
-					maxim,tsc-irq = <0>;
+&uart3 {
+	status = "okay";
+};
 
-					regulators {
-						SDV1 {
-							regulator-min-microvolt = <637500>;
-							regulator-max-microvolt = <1425000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						SDV2 {
-							regulator-min-microvolt = <650000>;
-							regulator-max-microvolt = <2225000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						SDV3 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO1 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO2 {
-							regulator-min-microvolt = <650000>;
-							regulator-max-microvolt = <2250000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO3 {
-							regulator-min-microvolt = <650000>;
-							regulator-max-microvolt = <2250000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO4 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO5 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO6 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO7 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO8 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO9 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO10 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-						};
-						LDO11 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO12 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO13 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO14 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO15 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO16 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO17 {
-							regulator-min-microvolt = <650000>;
-							regulator-max-microvolt = <2250000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO18 {
-							regulator-min-microvolt = <650000>;
-							regulator-max-microvolt = <2250000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO19 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-						LDO20 {
-							regulator-min-microvolt = <750000>;
-							regulator-max-microvolt = <3900000>;
-							regulator-boot-on;
-							regulator-always-on;
-						};
-					};
-					backlight {
-						maxim,max8925-dual-string = <0>;
-					};
-					charger {
-						batt-detect = <0>;
-						topoff-threshold = <1>;
-						fast-charge = <7>;
-						no-temp-support = <0>;
-						no-insert-detect = <0>;
-					};
-				};
+&twsi1 {
+	status = "okay";
+	pmic: max8925@3c {
+		compatible = "maxim,max8925";
+		reg = <0x3c>;
+		interrupts = <1>;
+		interrupt-parent = <&intcmux4>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		maxim,tsc-irq = <0>;
+
+		regulators {
+			SDV1 {
+				regulator-min-microvolt = <637500>;
+				regulator-max-microvolt = <1425000>;
+				regulator-boot-on;
+				regulator-always-on;
 			};
-			rtc: rtc@d4010000 {
-				status = "okay";
+			SDV2 {
+				regulator-min-microvolt = <650000>;
+				regulator-max-microvolt = <2225000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			SDV3 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO1 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO2 {
+				regulator-min-microvolt = <650000>;
+				regulator-max-microvolt = <2250000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO3 {
+				regulator-min-microvolt = <650000>;
+				regulator-max-microvolt = <2250000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO4 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO5 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO6 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO7 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO8 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO9 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO10 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+			};
+			LDO11 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO12 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO13 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO14 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO15 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO16 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO17 {
+				regulator-min-microvolt = <650000>;
+				regulator-max-microvolt = <2250000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO18 {
+				regulator-min-microvolt = <650000>;
+				regulator-max-microvolt = <2250000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO19 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
+			};
+			LDO20 {
+				regulator-min-microvolt = <750000>;
+				regulator-max-microvolt = <3900000>;
+				regulator-boot-on;
+				regulator-always-on;
 			};
 		};
+		backlight {
+			maxim,max8925-dual-string = <0>;
+		};
+		charger {
+			batt-detect = <0>;
+			topoff-threshold = <1>;
+			fast-charge = <7>;
+			no-temp-support = <0>;
+			no-insert-detect = <0>;
+		};
 	};
 };
+
+&rtc {
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index 029d457..c20e4a9 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -1603,16 +1603,20 @@
 	hdmi: hdmi@ff940000 {
 		compatible = "rockchip,rk3399-dw-hdmi";
 		reg = <0x0 0xff940000 0x0 0x20000>;
+		reg-io-width = <4>;
 		interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH 0>;
 		clocks = <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_SFR>, <&cru PLL_VPLL>, <&cru PCLK_VIO_GRF>;
 		clock-names = "iahb", "isfr", "vpll", "grf";
 		power-domains = <&power RK3399_PD_HDCP>;
-		reg-io-width = <4>;
 		rockchip,grf = <&grf>;
 		status = "disabled";
 
 		ports {
-			hdmi_in: port {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hdmi_in: port@0 {
+				reg = <0>;
 				#address-cells = <1>;
 				#size-cells = <0>;
 
@@ -1625,6 +1629,10 @@
 					remote-endpoint = <&vopl_out_hdmi>;
 				};
 			};
+
+			hdmi_out: port@1 {
+				reg = <1>;
+			};
 		};
 	};
 
diff --git a/arch/parisc/include/asm/checksum.h b/arch/parisc/include/asm/checksum.h
index 3cbf1f1..ef34e8f 100644
--- a/arch/parisc/include/asm/checksum.h
+++ b/arch/parisc/include/asm/checksum.h
@@ -42,31 +42,32 @@ extern __wsum csum_partial_copy_from_user(const void __user *src,
 static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
 {
 	unsigned int sum;
+	unsigned long t0, t1, t2;
 
 	__asm__ __volatile__ (
 "	ldws,ma		4(%1), %0\n"
 "	addib,<=	-4, %2, 2f\n"
 "\n"
-"	ldws		4(%1), %%r20\n"
-"	ldws		8(%1), %%r21\n"
-"	add		%0, %%r20, %0\n"
-"	ldws,ma		12(%1), %%r19\n"
-"	addc		%0, %%r21, %0\n"
-"	addc		%0, %%r19, %0\n"
-"1:	ldws,ma		4(%1), %%r19\n"
-"	addib,<		0, %2, 1b\n"
-"	addc		%0, %%r19, %0\n"
+"	ldws		4(%1), %4\n"
+"	ldws		8(%1), %5\n"
+"	add		%0, %4, %0\n"
+"	ldws,ma		12(%1), %3\n"
+"	addc		%0, %5, %0\n"
+"	addc		%0, %3, %0\n"
+"1:	ldws,ma		4(%1), %3\n"
+"	addib,>		-1, %2, 1b\n"
+"	addc		%0, %3, %0\n"
 "\n"
-"	extru		%0, 31, 16, %%r20\n"
-"	extru		%0, 15, 16, %%r21\n"
-"	addc		%%r20, %%r21, %0\n"
-"	extru		%0, 15, 16, %%r21\n"
-"	add		%0, %%r21, %0\n"
+"	extru		%0, 31, 16, %4\n"
+"	extru		%0, 15, 16, %5\n"
+"	addc		%4, %5, %0\n"
+"	extru		%0, 15, 16, %5\n"
+"	add		%0, %5, %0\n"
 "	subi		-1, %0, %0\n"
 "2:\n"
-	: "=r" (sum), "=r" (iph), "=r" (ihl)
+	: "=r" (sum), "=r" (iph), "=r" (ihl), "=r" (t0), "=r" (t1), "=r" (t2)
 	: "1" (iph), "2" (ihl)
-	: "r19", "r20", "r21", "memory");
+	: "memory");
 
 	return (__force __sum16)sum;
 }
@@ -126,6 +127,10 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
 					  __u32 len, __u8 proto,
 					  __wsum sum)
 {
+	unsigned long t0, t1, t2, t3;
+
+	len += proto;	/* add 16-bit proto + len */
+
 	__asm__ __volatile__ (
 
 #if BITS_PER_LONG > 32
@@ -136,20 +141,20 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
 	** Try to keep 4 registers with "live" values ahead of the ALU.
 	*/
 
-"	ldd,ma		8(%1), %%r19\n"	/* get 1st saddr word */
-"	ldd,ma		8(%2), %%r20\n"	/* get 1st daddr word */
-"	add		%8, %3, %3\n"/* add 16-bit proto + len */
-"	add		%%r19, %0, %0\n"
-"	ldd,ma		8(%1), %%r21\n"	/* 2cd saddr */
-"	ldd,ma		8(%2), %%r22\n"	/* 2cd daddr */
-"	add,dc		%%r20, %0, %0\n"
-"	add,dc		%%r21, %0, %0\n"
-"	add,dc		%%r22, %0, %0\n"
+"	depdi		0, 31, 32, %0\n"/* clear upper half of incoming checksum */
+"	ldd,ma		8(%1), %4\n"	/* get 1st saddr word */
+"	ldd,ma		8(%2), %5\n"	/* get 1st daddr word */
+"	add		%4, %0, %0\n"
+"	ldd,ma		8(%1), %6\n"	/* 2nd saddr */
+"	ldd,ma		8(%2), %7\n"	/* 2nd daddr */
+"	add,dc		%5, %0, %0\n"
+"	add,dc		%6, %0, %0\n"
+"	add,dc		%7, %0, %0\n"
 "	add,dc		%3, %0, %0\n"  /* fold in proto+len | carry bit */
-"	extrd,u		%0, 31, 32, %%r19\n"	/* copy upper half down */
-"	depdi		0, 31, 32, %0\n"	/* clear upper half */
-"	add		%%r19, %0, %0\n"	/* fold into 32-bits */
-"	addc		0, %0, %0\n"		/* add carry */
+"	extrd,u		%0, 31, 32, %4\n"/* copy upper half down */
+"	depdi		0, 31, 32, %0\n"/* clear upper half */
+"	add,dc		%4, %0, %0\n"	/* fold into 32-bits, plus carry */
+"	addc		0, %0, %0\n"	/* add final carry */
 
 #else
 
@@ -158,30 +163,30 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
 	** Insn stream is serialized on the carry bit here too.
 	** result from the previous operation (eg r0 + x)
 	*/
-
-"	ldw,ma		4(%1), %%r19\n"	/* get 1st saddr word */
-"	ldw,ma		4(%2), %%r20\n"	/* get 1st daddr word */
-"	add		%8, %3, %3\n"	/* add 16-bit proto + len */
-"	add		%%r19, %0, %0\n"
-"	ldw,ma		4(%1), %%r21\n"	/* 2cd saddr */
-"	addc		%%r20, %0, %0\n"
-"	ldw,ma		4(%2), %%r22\n"	/* 2cd daddr */
-"	addc		%%r21, %0, %0\n"
-"	ldw,ma		4(%1), %%r19\n"	/* 3rd saddr */
-"	addc		%%r22, %0, %0\n"
-"	ldw,ma		4(%2), %%r20\n"	/* 3rd daddr */
-"	addc		%%r19, %0, %0\n"
-"	ldw,ma		4(%1), %%r21\n"	/* 4th saddr */
-"	addc		%%r20, %0, %0\n"
-"	ldw,ma		4(%2), %%r22\n"	/* 4th daddr */
-"	addc		%%r21, %0, %0\n"
-"	addc		%%r22, %0, %0\n"
-"	addc		%3, %0, %0\n"	/* fold in proto+len, catch carry */
+"	ldw,ma		4(%1), %4\n"	/* get 1st saddr word */
+"	ldw,ma		4(%2), %5\n"	/* get 1st daddr word */
+"	add		%4, %0, %0\n"
+"	ldw,ma		4(%1), %6\n"	/* 2nd saddr */
+"	addc		%5, %0, %0\n"
+"	ldw,ma		4(%2), %7\n"	/* 2nd daddr */
+"	addc		%6, %0, %0\n"
+"	ldw,ma		4(%1), %4\n"	/* 3rd saddr */
+"	addc		%7, %0, %0\n"
+"	ldw,ma		4(%2), %5\n"	/* 3rd daddr */
+"	addc		%4, %0, %0\n"
+"	ldw,ma		4(%1), %6\n"	/* 4th saddr */
+"	addc		%5, %0, %0\n"
+"	ldw,ma		4(%2), %7\n"	/* 4th daddr */
+"	addc		%6, %0, %0\n"
+"	addc		%7, %0, %0\n"
+"	addc		%3, %0, %0\n"	/* fold in proto+len */
+"	addc		0, %0, %0\n"	/* add carry */
 
 #endif
-	: "=r" (sum), "=r" (saddr), "=r" (daddr), "=r" (len)
-	: "0" (sum), "1" (saddr), "2" (daddr), "3" (len), "r" (proto)
-	: "r19", "r20", "r21", "r22", "memory");
+	: "=r" (sum), "=r" (saddr), "=r" (daddr), "=r" (len),
+	  "=r" (t0), "=r" (t1), "=r" (t2), "=r" (t3)
+	: "0" (sum), "1" (saddr), "2" (daddr), "3" (len)
+	: "memory");
 	return csum_fold(sum);
 }
 
diff --git a/arch/powerpc/include/asm/reg_fsl_emb.h b/arch/powerpc/include/asm/reg_fsl_emb.h
index d7ccf93..3ee5744 100644
--- a/arch/powerpc/include/asm/reg_fsl_emb.h
+++ b/arch/powerpc/include/asm/reg_fsl_emb.h
@@ -10,9 +10,16 @@
 #ifndef __ASSEMBLY__
 /* Performance Monitor Registers */
 #define mfpmr(rn)	({unsigned int rval; \
-			asm volatile("mfpmr %0," __stringify(rn) \
+			asm volatile(".machine push; " \
+				     ".machine e300; " \
+				     "mfpmr %0," __stringify(rn) ";" \
+				     ".machine pop; " \
 				     : "=r" (rval)); rval;})
-#define mtpmr(rn, v)	asm volatile("mtpmr " __stringify(rn) ",%0" : : "r" (v))
+#define mtpmr(rn, v)	asm volatile(".machine push; " \
+				     ".machine e300; " \
+				     "mtpmr " __stringify(rn) ",%0; " \
+				     ".machine pop; " \
+				     : : "r" (v))
 #endif /* __ASSEMBLY__ */
 
 /* Freescale Book E Performance Monitor APU Registers */
diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index 41491eb..df61b9b 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile
@@ -43,6 +43,6 @@
 obj-$(CONFIG_FTR_FIXUP_SELFTEST) += feature-fixups-test.o
 
 obj-$(CONFIG_ALTIVEC)	+= xor_vmx.o xor_vmx_glue.o
-CFLAGS_xor_vmx.o += -maltivec $(call cc-option,-mabi=altivec)
+CFLAGS_xor_vmx.o += -mhard-float -maltivec $(call cc-option,-mabi=altivec)
 
 obj-$(CONFIG_PPC64) += $(obj64-y)
diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
index 048ad78..c28d933 100644
--- a/arch/sparc/kernel/nmi.c
+++ b/arch/sparc/kernel/nmi.c
@@ -272,7 +272,7 @@ static int __init setup_nmi_watchdog(char *str)
 	if (!strncmp(str, "panic", 5))
 		panic_on_timeout = 1;
 
-	return 0;
+	return 1;
 }
 __setup("nmi_watchdog=", setup_nmi_watchdog);
 
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index c4308e1..8c299a0 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -368,6 +368,8 @@
 #define X86_FEATURE_ARCH_CAPABILITIES	(18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
 #define X86_FEATURE_SPEC_CTRL_SSBD	(18*32+31) /* "" Speculative Store Bypass Disable */
 
+#define X86_FEATURE_AUTOIBRS		(20*32+ 8) /* "" Automatic IBRS */
+
 /*
  * BUG word(s)
  */
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 7f1bb45..e9c2749 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -30,6 +30,7 @@
 #define _EFER_SVME		12 /* Enable virtualization */
 #define _EFER_LMSLE		13 /* Long Mode Segment Limit Enable */
 #define _EFER_FFXSR		14 /* Enable Fast FXSAVE/FXRSTOR */
+#define _EFER_AUTOIBRS		21 /* Enable Automatic IBRS */
 
 #define EFER_SCE		(1<<_EFER_SCE)
 #define EFER_LME		(1<<_EFER_LME)
@@ -38,6 +39,7 @@
 #define EFER_SVME		(1<<_EFER_SVME)
 #define EFER_LMSLE		(1<<_EFER_LMSLE)
 #define EFER_FFXSR		(1<<_EFER_FFXSR)
+#define EFER_AUTOIBRS		(1<<_EFER_AUTOIBRS)
 
 /* Intel MSRs. Some also available on other CPUs */
 
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index fc92812..af5dbce 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1151,19 +1151,21 @@ spectre_v2_user_select_mitigation(void)
 	}
 
 	/*
-	 * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP
+	 * If no STIBP, Intel enhanced IBRS is enabled, or SMT impossible, STIBP
 	 * is not required.
 	 *
-	 * Enhanced IBRS also protects against cross-thread branch target
+	 * Intel's Enhanced IBRS also protects against cross-thread branch target
 	 * injection in user-mode as the IBRS bit remains always set which
 	 * implicitly enables cross-thread protections.  However, in legacy IBRS
 	 * mode, the IBRS bit is set only on kernel entry and cleared on return
-	 * to userspace. This disables the implicit cross-thread protection,
-	 * so allow for STIBP to be selected in that case.
+	 * to userspace.  AMD Automatic IBRS also does not protect userspace.
+	 * These modes therefore disable the implicit cross-thread protection,
+	 * so allow for STIBP to be selected in those cases.
 	 */
 	if (!boot_cpu_has(X86_FEATURE_STIBP) ||
 	    !smt_possible ||
-	    spectre_v2_in_eibrs_mode(spectre_v2_enabled))
+	    (spectre_v2_in_eibrs_mode(spectre_v2_enabled) &&
+	     !boot_cpu_has(X86_FEATURE_AUTOIBRS)))
 		return;
 
 	/*
@@ -1185,9 +1187,9 @@ static const char * const spectre_v2_strings[] = {
 	[SPECTRE_V2_NONE]			= "Vulnerable",
 	[SPECTRE_V2_RETPOLINE]			= "Mitigation: Retpolines",
 	[SPECTRE_V2_LFENCE]			= "Mitigation: LFENCE",
-	[SPECTRE_V2_EIBRS]			= "Mitigation: Enhanced IBRS",
-	[SPECTRE_V2_EIBRS_LFENCE]		= "Mitigation: Enhanced IBRS + LFENCE",
-	[SPECTRE_V2_EIBRS_RETPOLINE]		= "Mitigation: Enhanced IBRS + Retpolines",
+	[SPECTRE_V2_EIBRS]			= "Mitigation: Enhanced / Automatic IBRS",
+	[SPECTRE_V2_EIBRS_LFENCE]		= "Mitigation: Enhanced / Automatic IBRS + LFENCE",
+	[SPECTRE_V2_EIBRS_RETPOLINE]		= "Mitigation: Enhanced / Automatic IBRS + Retpolines",
 	[SPECTRE_V2_IBRS]			= "Mitigation: IBRS",
 };
 
@@ -1256,7 +1258,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 	     cmd == SPECTRE_V2_CMD_EIBRS_LFENCE ||
 	     cmd == SPECTRE_V2_CMD_EIBRS_RETPOLINE) &&
 	    !boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
-		pr_err("%s selected but CPU doesn't have eIBRS. Switching to AUTO select\n",
+		pr_err("%s selected but CPU doesn't have Enhanced or Automatic IBRS. Switching to AUTO select\n",
 		       mitigation_options[i].option);
 		return SPECTRE_V2_CMD_AUTO;
 	}
@@ -1435,8 +1437,12 @@ static void __init spectre_v2_select_mitigation(void)
 		pr_err(SPECTRE_V2_EIBRS_EBPF_MSG);
 
 	if (spectre_v2_in_ibrs_mode(mode)) {
-		x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
-		update_spec_ctrl(x86_spec_ctrl_base);
+		if (boot_cpu_has(X86_FEATURE_AUTOIBRS)) {
+			msr_set_bit(MSR_EFER, _EFER_AUTOIBRS);
+		} else {
+			x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
+			update_spec_ctrl(x86_spec_ctrl_base);
+		}
 	}
 
 	switch (mode) {
@@ -1520,8 +1526,8 @@ static void __init spectre_v2_select_mitigation(void)
 	/*
 	 * Retpoline protects the kernel, but doesn't protect firmware.  IBRS
 	 * and Enhanced IBRS protect firmware too, so enable IBRS around
-	 * firmware calls only when IBRS / Enhanced IBRS aren't otherwise
-	 * enabled.
+	 * firmware calls only when IBRS / Enhanced / Automatic IBRS aren't
+	 * otherwise enabled.
 	 *
 	 * Use "mode" to check Enhanced IBRS instead of boot_cpu_has(), because
 	 * the user might select retpoline on the kernel command line and if
@@ -2131,69 +2137,69 @@ static const char * const l1tf_vmx_states[] = {
 static ssize_t l1tf_show_state(char *buf)
 {
 	if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO)
-		return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
+		return sysfs_emit(buf, "%s\n", L1TF_DEFAULT_MSG);
 
 	if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_EPT_DISABLED ||
 	    (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER &&
 	     sched_smt_active())) {
-		return sprintf(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
-			       l1tf_vmx_states[l1tf_vmx_mitigation]);
+		return sysfs_emit(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
+				  l1tf_vmx_states[l1tf_vmx_mitigation]);
 	}
 
-	return sprintf(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
-		       l1tf_vmx_states[l1tf_vmx_mitigation],
-		       sched_smt_active() ? "vulnerable" : "disabled");
+	return sysfs_emit(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
+			  l1tf_vmx_states[l1tf_vmx_mitigation],
+			  sched_smt_active() ? "vulnerable" : "disabled");
 }
 
 static ssize_t itlb_multihit_show_state(char *buf)
 {
 	if (itlb_multihit_kvm_mitigation)
-		return sprintf(buf, "KVM: Mitigation: Split huge pages\n");
+		return sysfs_emit(buf, "KVM: Mitigation: Split huge pages\n");
 	else
-		return sprintf(buf, "KVM: Vulnerable\n");
+		return sysfs_emit(buf, "KVM: Vulnerable\n");
 }
 #else
 static ssize_t l1tf_show_state(char *buf)
 {
-	return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
+	return sysfs_emit(buf, "%s\n", L1TF_DEFAULT_MSG);
 }
 
 static ssize_t itlb_multihit_show_state(char *buf)
 {
-	return sprintf(buf, "Processor vulnerable\n");
+	return sysfs_emit(buf, "Processor vulnerable\n");
 }
 #endif
 
 static ssize_t mds_show_state(char *buf)
 {
 	if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
-		return sprintf(buf, "%s; SMT Host state unknown\n",
-			       mds_strings[mds_mitigation]);
+		return sysfs_emit(buf, "%s; SMT Host state unknown\n",
+				  mds_strings[mds_mitigation]);
 	}
 
 	if (boot_cpu_has(X86_BUG_MSBDS_ONLY)) {
-		return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
-			       (mds_mitigation == MDS_MITIGATION_OFF ? "vulnerable" :
-			        sched_smt_active() ? "mitigated" : "disabled"));
+		return sysfs_emit(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
+				  (mds_mitigation == MDS_MITIGATION_OFF ? "vulnerable" :
+				   sched_smt_active() ? "mitigated" : "disabled"));
 	}
 
-	return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
-		       sched_smt_active() ? "vulnerable" : "disabled");
+	return sysfs_emit(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
+			  sched_smt_active() ? "vulnerable" : "disabled");
 }
 
 static ssize_t tsx_async_abort_show_state(char *buf)
 {
 	if ((taa_mitigation == TAA_MITIGATION_TSX_DISABLED) ||
 	    (taa_mitigation == TAA_MITIGATION_OFF))
-		return sprintf(buf, "%s\n", taa_strings[taa_mitigation]);
+		return sysfs_emit(buf, "%s\n", taa_strings[taa_mitigation]);
 
 	if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
-		return sprintf(buf, "%s; SMT Host state unknown\n",
-			       taa_strings[taa_mitigation]);
+		return sysfs_emit(buf, "%s; SMT Host state unknown\n",
+				  taa_strings[taa_mitigation]);
 	}
 
-	return sprintf(buf, "%s; SMT %s\n", taa_strings[taa_mitigation],
-		       sched_smt_active() ? "vulnerable" : "disabled");
+	return sysfs_emit(buf, "%s; SMT %s\n", taa_strings[taa_mitigation],
+			  sched_smt_active() ? "vulnerable" : "disabled");
 }
 
 static ssize_t mmio_stale_data_show_state(char *buf)
@@ -2215,7 +2221,8 @@ static ssize_t mmio_stale_data_show_state(char *buf)
 
 static char *stibp_state(void)
 {
-	if (spectre_v2_in_eibrs_mode(spectre_v2_enabled))
+	if (spectre_v2_in_eibrs_mode(spectre_v2_enabled) &&
+	    !boot_cpu_has(X86_FEATURE_AUTOIBRS))
 		return "";
 
 	switch (spectre_v2_user_stibp) {
@@ -2261,33 +2268,33 @@ static char *pbrsb_eibrs_state(void)
 static ssize_t spectre_v2_show_state(char *buf)
 {
 	if (spectre_v2_enabled == SPECTRE_V2_LFENCE)
-		return sprintf(buf, "Vulnerable: LFENCE\n");
+		return sysfs_emit(buf, "Vulnerable: LFENCE\n");
 
 	if (spectre_v2_enabled == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
-		return sprintf(buf, "Vulnerable: eIBRS with unprivileged eBPF\n");
+		return sysfs_emit(buf, "Vulnerable: eIBRS with unprivileged eBPF\n");
 
 	if (sched_smt_active() && unprivileged_ebpf_enabled() &&
 	    spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)
-		return sprintf(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n");
+		return sysfs_emit(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n");
 
-	return sprintf(buf, "%s%s%s%s%s%s%s\n",
-		       spectre_v2_strings[spectre_v2_enabled],
-		       ibpb_state(),
-		       boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
-		       stibp_state(),
-		       boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
-		       pbrsb_eibrs_state(),
-		       spectre_v2_module_string());
+	return sysfs_emit(buf, "%s%s%s%s%s%s%s\n",
+			  spectre_v2_strings[spectre_v2_enabled],
+			  ibpb_state(),
+			  boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
+			  stibp_state(),
+			  boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
+			  pbrsb_eibrs_state(),
+			  spectre_v2_module_string());
 }
 
 static ssize_t srbds_show_state(char *buf)
 {
-	return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]);
+	return sysfs_emit(buf, "%s\n", srbds_strings[srbds_mitigation]);
 }
 
 static ssize_t retbleed_show_state(char *buf)
 {
-	return sprintf(buf, "%s\n", retbleed_strings[retbleed_mitigation]);
+	return sysfs_emit(buf, "%s\n", retbleed_strings[retbleed_mitigation]);
 }
 
 static ssize_t gds_show_state(char *buf)
@@ -2299,23 +2306,26 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
 			       char *buf, unsigned int bug)
 {
 	if (!boot_cpu_has_bug(bug))
-		return sprintf(buf, "Not affected\n");
+		return sysfs_emit(buf, "Not affected\n");
 
 	switch (bug) {
 	case X86_BUG_CPU_MELTDOWN:
 		if (boot_cpu_has(X86_FEATURE_PTI))
-			return sprintf(buf, "Mitigation: PTI\n");
+			return sysfs_emit(buf, "Mitigation: PTI\n");
+
+		if (hypervisor_is_type(X86_HYPER_XEN_PV))
+			return sysfs_emit(buf, "Unknown (XEN PV detected, hypervisor mitigation required)\n");
 
 		break;
 
 	case X86_BUG_SPECTRE_V1:
-		return sprintf(buf, "%s\n", spectre_v1_strings[spectre_v1_mitigation]);
+		return sysfs_emit(buf, "%s\n", spectre_v1_strings[spectre_v1_mitigation]);
 
 	case X86_BUG_SPECTRE_V2:
 		return spectre_v2_show_state(buf);
 
 	case X86_BUG_SPEC_STORE_BYPASS:
-		return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
+		return sysfs_emit(buf, "%s\n", ssb_strings[ssb_mode]);
 
 	case X86_BUG_L1TF:
 		if (boot_cpu_has(X86_FEATURE_L1TF_PTEINV))
@@ -2348,7 +2358,7 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
 		break;
 	}
 
-	return sprintf(buf, "Vulnerable\n");
+	return sysfs_emit(buf, "Vulnerable\n");
 }
 
 ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 002233b..dfc53fe 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -976,7 +976,7 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
 	VULNWL_AMD(0x12,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
 
 	/* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */
-	VULNWL_AMD(X86_FAMILY_ANY,	NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
+	VULNWL_AMD(X86_FAMILY_ANY,	NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_EIBRS_PBRSB),
 	{}
 };
 
@@ -1084,8 +1084,16 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 	   !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
 		setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
 
-	if (ia32_cap & ARCH_CAP_IBRS_ALL)
+	/*
+	 * AMD's AutoIBRS is equivalent to Intel's eIBRS - use the Intel feature
+	 * flag and protect from vendor-specific bugs via the whitelist.
+	 */
+	if ((ia32_cap & ARCH_CAP_IBRS_ALL) || cpu_has(c, X86_FEATURE_AUTOIBRS)) {
 		setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
+		if (!cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) &&
+		    !(ia32_cap & ARCH_CAP_PBRSB_NO))
+			setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB);
+	}
 
 	if (!cpu_matches(cpu_vuln_whitelist, NO_MDS) &&
 	    !(ia32_cap & ARCH_CAP_MDS_NO)) {
@@ -1147,11 +1155,6 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 			setup_force_cpu_bug(X86_BUG_RETBLEED);
 	}
 
-	if (cpu_has(c, X86_FEATURE_IBRS_ENHANCED) &&
-	    !cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) &&
-	    !(ia32_cap & ARCH_CAP_PBRSB_NO))
-		setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB);
-
 	/*
 	 * Check if CPU is vulnerable to GDS. If running in a virtual machine on
 	 * an affected processor, the VMM may have disabled the use of GATHER by
diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
index 50c537a..407fa1d 100644
--- a/arch/x86/mm/ident_map.c
+++ b/arch/x86/mm/ident_map.c
@@ -26,31 +26,18 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page,
 	for (; addr < end; addr = next) {
 		pud_t *pud = pud_page + pud_index(addr);
 		pmd_t *pmd;
-		bool use_gbpage;
 
 		next = (addr & PUD_MASK) + PUD_SIZE;
 		if (next > end)
 			next = end;
 
-		/* if this is already a gbpage, this portion is already mapped */
-		if (pud_large(*pud))
-			continue;
-
-		/* Is using a gbpage allowed? */
-		use_gbpage = info->direct_gbpages;
-
-		/* Don't use gbpage if it maps more than the requested region. */
-		/* at the begining: */
-		use_gbpage &= ((addr & ~PUD_MASK) == 0);
-		/* ... or at the end: */
-		use_gbpage &= ((next & ~PUD_MASK) == 0);
-
-		/* Never overwrite existing mappings */
-		use_gbpage &= !pud_present(*pud);
-
-		if (use_gbpage) {
+		if (info->direct_gbpages) {
 			pud_t pudval;
 
+			if (pud_present(*pud))
+				continue;
+
+			addr &= PUD_MASK;
 			pudval = __pud((addr - info->offset) | info->page_flag);
 			set_pud(pud, pudval);
 			continue;
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 49aeb4e..2984ec1 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -33,6 +33,7 @@
 
 #include "pat_internal.h"
 #include "mm_internal.h"
+#include "../../mm/internal.h"	/* is_cow_mapping() */
 
 #undef pr_fmt
 #define pr_fmt(fmt) "" fmt
@@ -910,6 +911,38 @@ static void free_pfn_range(u64 paddr, unsigned long size)
 		free_memtype(paddr, paddr + size);
 }
 
+static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr,
+		pgprot_t *pgprot)
+{
+	unsigned long prot;
+
+	VM_WARN_ON_ONCE(!(vma->vm_flags & VM_PAT));
+
+	/*
+	 * We need the starting PFN and cachemode used for track_pfn_remap()
+	 * that covered the whole VMA. For most mappings, we can obtain that
+	 * information from the page tables. For COW mappings, we might now
+	 * suddenly have anon folios mapped and follow_phys() will fail.
+	 *
+	 * Fallback to using vma->vm_pgoff, see remap_pfn_range_notrack(), to
+	 * detect the PFN. If we need the cachemode as well, we're out of luck
+	 * for now and have to fail fork().
+	 */
+	if (!follow_phys(vma, vma->vm_start, 0, &prot, paddr)) {
+		if (pgprot)
+			*pgprot = __pgprot(prot);
+		return 0;
+	}
+	if (is_cow_mapping(vma->vm_flags)) {
+		if (pgprot)
+			return -EINVAL;
+		*paddr = (resource_size_t)vma->vm_pgoff << PAGE_SHIFT;
+		return 0;
+	}
+	WARN_ON_ONCE(1);
+	return -EINVAL;
+}
+
 /*
  * track_pfn_copy is called when vma that is covering the pfnmap gets
  * copied through copy_page_range().
@@ -920,20 +953,13 @@ static void free_pfn_range(u64 paddr, unsigned long size)
 int track_pfn_copy(struct vm_area_struct *vma)
 {
 	resource_size_t paddr;
-	unsigned long prot;
 	unsigned long vma_size = vma->vm_end - vma->vm_start;
 	pgprot_t pgprot;
 
 	if (vma->vm_flags & VM_PAT) {
-		/*
-		 * reserve the whole chunk covered by vma. We need the
-		 * starting address and protection from pte.
-		 */
-		if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
-			WARN_ON_ONCE(1);
+		if (get_pat_info(vma, &paddr, &pgprot))
 			return -EINVAL;
-		}
-		pgprot = __pgprot(prot);
+		/* reserve the whole chunk covered by vma. */
 		return reserve_pfn_range(paddr, vma_size, &pgprot, 1);
 	}
 
@@ -1008,7 +1034,6 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
 		 unsigned long size)
 {
 	resource_size_t paddr;
-	unsigned long prot;
 
 	if (vma && !(vma->vm_flags & VM_PAT))
 		return;
@@ -1016,11 +1041,8 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
 	/* free the chunk starting from pfn or the whole chunk */
 	paddr = (resource_size_t)pfn << PAGE_SHIFT;
 	if (!paddr && !size) {
-		if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
-			WARN_ON_ONCE(1);
+		if (get_pat_info(vma, &paddr, NULL))
 			return;
-		}
-
 		size = vma->vm_end - vma->vm_start;
 	}
 	free_pfn_range(paddr, size);
diff --git a/block/blk-stat.c b/block/blk-stat.c
index c52356d..6106ade 100644
--- a/block/blk-stat.c
+++ b/block/blk-stat.c
@@ -49,7 +49,7 @@ static void blk_stat_sum(struct blk_rq_stat *dst, struct blk_rq_stat *src)
 {
 	blk_stat_flush_batch(src);
 
-	if (!src->nr_samples)
+	if (dst->nr_samples + src->nr_samples <= dst->nr_samples)
 		return;
 
 	dst->min = min(dst->min, src->min);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index c2e5ef7..5b810a29 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -605,11 +605,6 @@ MODULE_PARM_DESC(marvell_enable, "Marvell SATA via AHCI (1 = enabled)");
 static void ahci_pci_save_initial_config(struct pci_dev *pdev,
 					 struct ahci_host_priv *hpriv)
 {
-	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && pdev->device == 0x1166) {
-		dev_info(&pdev->dev, "ASM1166 has only six ports\n");
-		hpriv->saved_port_map = 0x3f;
-	}
-
 	if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) {
 		dev_info(&pdev->dev, "JMB361 has only one port\n");
 		hpriv->force_port_map = 1;
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index c2dc8e5..99e59af 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -796,37 +796,6 @@ static const struct ata_port_info mv_port_info[] = {
 	},
 };
 
-static const struct pci_device_id mv_pci_tbl[] = {
-	{ PCI_VDEVICE(MARVELL, 0x5040), chip_504x },
-	{ PCI_VDEVICE(MARVELL, 0x5041), chip_504x },
-	{ PCI_VDEVICE(MARVELL, 0x5080), chip_5080 },
-	{ PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
-	/* RocketRAID 1720/174x have different identifiers */
-	{ PCI_VDEVICE(TTI, 0x1720), chip_6042 },
-	{ PCI_VDEVICE(TTI, 0x1740), chip_6042 },
-	{ PCI_VDEVICE(TTI, 0x1742), chip_6042 },
-
-	{ PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
-	{ PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
-	{ PCI_VDEVICE(MARVELL, 0x6042), chip_6042 },
-	{ PCI_VDEVICE(MARVELL, 0x6080), chip_608x },
-	{ PCI_VDEVICE(MARVELL, 0x6081), chip_608x },
-
-	{ PCI_VDEVICE(ADAPTEC2, 0x0241), chip_604x },
-
-	/* Adaptec 1430SA */
-	{ PCI_VDEVICE(ADAPTEC2, 0x0243), chip_7042 },
-
-	/* Marvell 7042 support */
-	{ PCI_VDEVICE(MARVELL, 0x7042), chip_7042 },
-
-	/* Highpoint RocketRAID PCIe series */
-	{ PCI_VDEVICE(TTI, 0x2300), chip_7042 },
-	{ PCI_VDEVICE(TTI, 0x2310), chip_7042 },
-
-	{ }			/* terminate list */
-};
-
 static const struct mv_hw_ops mv5xxx_ops = {
 	.phy_errata		= mv5_phy_errata,
 	.enable_leds		= mv5_enable_leds,
@@ -4322,6 +4291,36 @@ static int mv_pci_init_one(struct pci_dev *pdev,
 static int mv_pci_device_resume(struct pci_dev *pdev);
 #endif
 
+static const struct pci_device_id mv_pci_tbl[] = {
+	{ PCI_VDEVICE(MARVELL, 0x5040), chip_504x },
+	{ PCI_VDEVICE(MARVELL, 0x5041), chip_504x },
+	{ PCI_VDEVICE(MARVELL, 0x5080), chip_5080 },
+	{ PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
+	/* RocketRAID 1720/174x have different identifiers */
+	{ PCI_VDEVICE(TTI, 0x1720), chip_6042 },
+	{ PCI_VDEVICE(TTI, 0x1740), chip_6042 },
+	{ PCI_VDEVICE(TTI, 0x1742), chip_6042 },
+
+	{ PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
+	{ PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
+	{ PCI_VDEVICE(MARVELL, 0x6042), chip_6042 },
+	{ PCI_VDEVICE(MARVELL, 0x6080), chip_608x },
+	{ PCI_VDEVICE(MARVELL, 0x6081), chip_608x },
+
+	{ PCI_VDEVICE(ADAPTEC2, 0x0241), chip_604x },
+
+	/* Adaptec 1430SA */
+	{ PCI_VDEVICE(ADAPTEC2, 0x0243), chip_7042 },
+
+	/* Marvell 7042 support */
+	{ PCI_VDEVICE(MARVELL, 0x7042), chip_7042 },
+
+	/* Highpoint RocketRAID PCIe series */
+	{ PCI_VDEVICE(TTI, 0x2300), chip_7042 },
+	{ PCI_VDEVICE(TTI, 0x2310), chip_7042 },
+
+	{ }			/* terminate list */
+};
 
 static struct pci_driver mv_pci_driver = {
 	.name			= DRV_NAME,
@@ -4334,6 +4333,7 @@ static struct pci_driver mv_pci_driver = {
 #endif
 
 };
+MODULE_DEVICE_TABLE(pci, mv_pci_tbl);
 
 /* move to PCI layer or libata core? */
 static int pci_go_64(struct pci_dev *pdev)
@@ -4536,7 +4536,6 @@ static void __exit mv_exit(void)
 MODULE_AUTHOR("Brett Russ");
 MODULE_DESCRIPTION("SCSI low-level driver for Marvell SATA controllers");
 MODULE_LICENSE("GPL v2");
-MODULE_DEVICE_TABLE(pci, mv_pci_tbl);
 MODULE_VERSION(DRV_VERSION);
 MODULE_ALIAS("platform:" DRV_NAME);
 
diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
index 0d74245..f217ac8 100644
--- a/drivers/ata/sata_sx4.c
+++ b/drivers/ata/sata_sx4.c
@@ -1020,8 +1020,7 @@ static void pdc20621_get_from_dimm(struct ata_host *host, void *psource,
 
 	offset -= (idx * window_size);
 	idx++;
-	dist = ((long) (window_size - (offset + size))) >= 0 ? size :
-		(long) (window_size - offset);
+	dist = min(size, window_size - offset);
 	memcpy_fromio(psource, dimm_mmio + offset / 4, dist);
 
 	psource += dist;
@@ -1069,8 +1068,7 @@ static void pdc20621_put_to_dimm(struct ata_host *host, void *psource,
 	readl(mmio + PDC_DIMM_WINDOW_CTLR);
 	offset -= (idx * window_size);
 	idx++;
-	dist = ((long)(s32)(window_size - (offset + size))) >= 0 ? size :
-		(long) (window_size - offset);
+	dist = min(size, window_size - offset);
 	memcpy_toio(dimm_mmio + offset / 4, psource, dist);
 	writel(0x01, mmio + PDC_GENERAL_CTLR);
 	readl(mmio + PDC_GENERAL_CTLR);
diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
index 5d6cff9..ddcbf15 100644
--- a/drivers/base/power/wakeirq.c
+++ b/drivers/base/power/wakeirq.c
@@ -369,8 +369,10 @@ void dev_pm_enable_wake_irq_complete(struct device *dev)
 		return;
 
 	if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED &&
-	    wirq->status & WAKE_IRQ_DEDICATED_REVERSE)
+	    wirq->status & WAKE_IRQ_DEDICATED_REVERSE) {
 		enable_irq(wirq->irq);
+		wirq->status |= WAKE_IRQ_DEDICATED_ENABLED;
+	}
 }
 
 /**
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 091a72c..aaf5b44 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1276,11 +1276,6 @@ loop_get_status(struct loop_device *lo, struct loop_info64 *info)
 	info->lo_number = lo->lo_number;
 	info->lo_offset = lo->lo_offset;
 	info->lo_sizelimit = lo->lo_sizelimit;
-
-	/* loff_t vars have been assigned __u64 */
-	if (lo->lo_offset < 0 || lo->lo_sizelimit < 0)
-		return -EOVERFLOW;
-
 	info->lo_flags = lo->lo_flags;
 	memcpy(info->lo_file_name, lo->lo_file_name, LO_NAME_SIZE);
 	memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);
diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index d32e109..77923bb 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -360,7 +360,7 @@ int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
 		return PTR_ERR(skb);
 	}
 
-	if (skb->len != sizeof(*ver)) {
+	if (!skb || skb->len != sizeof(*ver)) {
 		bt_dev_err(hdev, "Intel version event size mismatch");
 		kfree_skb(skb);
 		return -EILSEQ;
diff --git a/drivers/clk/qcom/mmcc-apq8084.c b/drivers/clk/qcom/mmcc-apq8084.c
index 30777f9..159c8cb 100644
--- a/drivers/clk/qcom/mmcc-apq8084.c
+++ b/drivers/clk/qcom/mmcc-apq8084.c
@@ -343,6 +343,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = {
 	F(333430000, P_MMPLL1, 3.5, 0, 0),
 	F(400000000, P_MMPLL0, 2, 0, 0),
 	F(466800000, P_MMPLL1, 2.5, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 mmss_axi_clk_src = {
@@ -367,6 +368,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = {
 	F(150000000, P_GPLL0, 4, 0, 0),
 	F(228570000, P_MMPLL0, 3.5, 0, 0),
 	F(320000000, P_MMPLL0, 2.5, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 ocmemnoc_clk_src = {
diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
index 715e7cd..34e8bc5 100644
--- a/drivers/clk/qcom/mmcc-msm8974.c
+++ b/drivers/clk/qcom/mmcc-msm8974.c
@@ -293,6 +293,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = {
 	F(291750000, P_MMPLL1, 4, 0, 0),
 	F(400000000, P_MMPLL0, 2, 0, 0),
 	F(466800000, P_MMPLL1, 2.5, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 mmss_axi_clk_src = {
@@ -317,6 +318,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = {
 	F(150000000, P_GPLL0, 4, 0, 0),
 	F(291750000, P_MMPLL1, 4, 0, 0),
 	F(400000000, P_MMPLL0, 2, 0, 0),
+	{ }
 };
 
 static struct clk_rcg2 ocmemnoc_clk_src = {
diff --git a/drivers/crypto/qat/qat_common/adf_aer.c b/drivers/crypto/qat/qat_common/adf_aer.c
index da8a2d3..b41c29a 100644
--- a/drivers/crypto/qat/qat_common/adf_aer.c
+++ b/drivers/crypto/qat/qat_common/adf_aer.c
@@ -139,18 +139,28 @@ static void adf_device_reset_worker(struct work_struct *work)
 	if (adf_dev_init(accel_dev) || adf_dev_start(accel_dev)) {
 		/* The device hanged and we can't restart it so stop here */
 		dev_err(&GET_DEV(accel_dev), "Restart device failed\n");
-		kfree(reset_data);
+		if (reset_data->mode == ADF_DEV_RESET_ASYNC ||
+		    completion_done(&reset_data->compl))
+			kfree(reset_data);
 		WARN(1, "QAT: device restart failed. Device is unusable\n");
 		return;
 	}
 	adf_dev_restarted_notify(accel_dev);
 	clear_bit(ADF_STATUS_RESTARTING, &accel_dev->status);
 
-	/* The dev is back alive. Notify the caller if in sync mode */
-	if (reset_data->mode == ADF_DEV_RESET_SYNC)
-		complete(&reset_data->compl);
-	else
+	/*
+	 * The dev is back alive. Notify the caller if in sync mode
+	 *
+	 * If device restart will take a more time than expected,
+	 * the schedule_reset() function can timeout and exit. This can be
+	 * detected by calling the completion_done() function. In this case
+	 * the reset_data structure needs to be freed here.
+	 */
+	if (reset_data->mode == ADF_DEV_RESET_ASYNC ||
+	    completion_done(&reset_data->compl))
 		kfree(reset_data);
+	else
+		complete(&reset_data->compl);
 }
 
 static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev,
@@ -183,8 +193,9 @@ static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev,
 			dev_err(&GET_DEV(accel_dev),
 				"Reset device timeout expired\n");
 			ret = -EFAULT;
+		} else {
+			kfree(reset_data);
 		}
-		kfree(reset_data);
 		return ret;
 	}
 	return 0;
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index e619ced..88c3f89 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -440,7 +440,7 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 		void *data, bool duplicates, struct list_head *head)
 {
 	const struct efivar_operations *ops;
-	unsigned long variable_name_size = 1024;
+	unsigned long variable_name_size = 512;
 	efi_char16_t *variable_name;
 	efi_status_t status;
 	efi_guid_t vendor_guid;
@@ -463,12 +463,13 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 	}
 
 	/*
-	 * Per EFI spec, the maximum storage allocated for both
-	 * the variable name and variable data is 1024 bytes.
+	 * A small set of old UEFI implementations reject sizes
+	 * above a certain threshold, the lowest seen in the wild
+	 * is 512.
 	 */
 
 	do {
-		variable_name_size = 1024;
+		variable_name_size = 512;
 
 		status = ops->get_next_variable(&variable_name_size,
 						variable_name,
@@ -512,9 +513,13 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 			break;
 		case EFI_NOT_FOUND:
 			break;
+		case EFI_BUFFER_TOO_SMALL:
+			pr_warn("efivars: Variable name size exceeds maximum (%lu > 512)\n",
+				variable_name_size);
+			status = EFI_NOT_FOUND;
+			break;
 		default:
-			printk(KERN_WARNING "efivars: get_next_variable: status=%lx\n",
-				status);
+			pr_warn("efivars: get_next_variable: status=%lx\n", status);
 			status = EFI_NOT_FOUND;
 			break;
 		}
diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
index 6420dec..8597532 100644
--- a/drivers/gpu/drm/imx/parallel-display.c
+++ b/drivers/gpu/drm/imx/parallel-display.c
@@ -72,14 +72,14 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector)
 		int ret;
 
 		if (!mode)
-			return -EINVAL;
+			return 0;
 
 		ret = of_get_drm_display_mode(np, &imxpd->mode,
 					      &imxpd->bus_flags,
 					      OF_USE_NATIVE_MODE);
 		if (ret) {
 			drm_mode_destroy(connector->dev, mode);
-			return ret;
+			return 0;
 		}
 
 		drm_mode_copy(mode, &imxpd->mode);
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 3020ae7..44cfb7a 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -276,7 +276,7 @@ static int vc4_hdmi_connector_get_modes(struct drm_connector *connector)
 	edid = drm_get_edid(connector, vc4->hdmi->ddc);
 	cec_s_phys_addr_from_edid(vc4->hdmi->cec_adap, edid);
 	if (!edid)
-		return -ENODEV;
+		return 0;
 
 	vc4_encoder->hdmi_monitor = drm_detect_hdmi_monitor(edid);
 
diff --git a/drivers/hwmon/amc6821.c b/drivers/hwmon/amc6821.c
index 46b4e35..b562337 100644
--- a/drivers/hwmon/amc6821.c
+++ b/drivers/hwmon/amc6821.c
@@ -1003,10 +1003,21 @@ static const struct i2c_device_id amc6821_id[] = {
 
 MODULE_DEVICE_TABLE(i2c, amc6821_id);
 
+static const struct of_device_id __maybe_unused amc6821_of_match[] = {
+	{
+		.compatible = "ti,amc6821",
+		.data = (void *)amc6821,
+	},
+	{ }
+};
+
+MODULE_DEVICE_TABLE(of, amc6821_of_match);
+
 static struct i2c_driver amc6821_driver = {
 	.class = I2C_CLASS_HWMON,
 	.driver = {
 		.name	= "amc6821",
+		.of_match_table = of_match_ptr(amc6821_of_match),
 	},
 	.probe = amc6821_probe,
 	.id_table = amc6821_id,
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 30a8d81..82eda2e 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -1206,7 +1206,11 @@ static int rmi_driver_probe(struct device *dev)
 		}
 		rmi_driver_set_input_params(rmi_dev, data->input);
 		data->input->phys = devm_kasprintf(dev, GFP_KERNEL,
-						"%s/input0", dev_name(dev));
+						   "%s/input0", dev_name(dev));
+		if (!data->input->phys) {
+			retval = -ENOMEM;
+			goto err;
+		}
 	}
 
 	retval = rmi_init_functions(data);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 54b99fc..3bb14f1 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3893,7 +3893,9 @@ static void raid_resume(struct dm_target *ti)
 		 * Take this opportunity to check whether any failed
 		 * devices are reachable again.
 		 */
+		mddev_lock_nointr(mddev);
 		attempt_restore_of_faulty_devices(rs);
+		mddev_unlock(mddev);
 	}
 
 	mddev->ro = 0;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 6fca2df..d2ac3d1 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -44,6 +44,7 @@
  */
 
 #include <linux/blkdev.h>
+#include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/raid/pq.h>
 #include <linux/async_tx.h>
@@ -6308,7 +6309,18 @@ static void raid5d(struct md_thread *thread)
 			spin_unlock_irq(&conf->device_lock);
 			md_check_recovery(mddev);
 			spin_lock_irq(&conf->device_lock);
+
+			/*
+			 * Waiting on MD_SB_CHANGE_PENDING below may deadlock
+			 * seeing md_check_recovery() is needed to clear
+			 * the flag when using mdmon.
+			 */
+			continue;
 		}
+
+		wait_event_lock_irq(mddev->sb_wait,
+			!test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags),
+			conf->device_lock);
 	}
 	pr_debug("%d stripes handled\n", handled);
 
diff --git a/drivers/media/pci/sta2x11/sta2x11_vip.c b/drivers/media/pci/sta2x11/sta2x11_vip.c
index eb5a9ea..10154cd 100644
--- a/drivers/media/pci/sta2x11/sta2x11_vip.c
+++ b/drivers/media/pci/sta2x11/sta2x11_vip.c
@@ -765,7 +765,7 @@ static const struct video_device video_dev_template = {
 /**
  * vip_irq - interrupt routine
  * @irq: Number of interrupt ( not used, correct number is assumed )
- * @vip: local data structure containing all information
+ * @data: local data structure containing all information
  *
  * check for both frame interrupts set ( top and bottom ).
  * check FIFO overflow, but limit number of log messages after open.
@@ -775,8 +775,9 @@ static const struct video_device video_dev_template = {
  *
  * IRQ_HANDLED, interrupt done.
  */
-static irqreturn_t vip_irq(int irq, struct sta2x11_vip *vip)
+static irqreturn_t vip_irq(int irq, void *data)
 {
+	struct sta2x11_vip *vip = data;
 	unsigned int status;
 
 	status = reg_read(vip, DVP_ITS);
@@ -1057,9 +1058,7 @@ static int sta2x11_vip_init_one(struct pci_dev *pdev,
 
 	spin_lock_init(&vip->slock);
 
-	ret = request_irq(pdev->irq,
-			  (irq_handler_t) vip_irq,
-			  IRQF_SHARED, KBUILD_MODNAME, vip);
+	ret = request_irq(pdev->irq, vip_irq, IRQF_SHARED, KBUILD_MODNAME, vip);
 	if (ret) {
 		dev_err(&pdev->dev, "request_irq failed\n");
 		ret = -ENODEV;
diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
index 7130b9e..de69c9c 100644
--- a/drivers/media/tuners/xc4000.c
+++ b/drivers/media/tuners/xc4000.c
@@ -1524,10 +1524,10 @@ static int xc4000_get_frequency(struct dvb_frontend *fe, u32 *freq)
 {
 	struct xc4000_priv *priv = fe->tuner_priv;
 
+	mutex_lock(&priv->lock);
 	*freq = priv->freq_hz + priv->freq_offset;
 
 	if (debug) {
-		mutex_lock(&priv->lock);
 		if ((priv->cur_fw.type
 		     & (BASE | FM | DTV6 | DTV7 | DTV78 | DTV8)) == BASE) {
 			u16	snr = 0;
@@ -1538,8 +1538,8 @@ static int xc4000_get_frequency(struct dvb_frontend *fe, u32 *freq)
 				return 0;
 			}
 		}
-		mutex_unlock(&priv->lock);
 	}
+	mutex_unlock(&priv->lock);
 
 	dprintk(1, "%s()\n", __func__);
 
diff --git a/drivers/misc/vmw_vmci/vmci_datagram.c b/drivers/misc/vmw_vmci/vmci_datagram.c
index 8a4b6bb..129dd08 100644
--- a/drivers/misc/vmw_vmci/vmci_datagram.c
+++ b/drivers/misc/vmw_vmci/vmci_datagram.c
@@ -242,7 +242,8 @@ static int dg_dispatch_as_host(u32 context_id, struct vmci_datagram *dg)
 
 			dg_info->in_dg_host_queue = true;
 			dg_info->entry = dst_entry;
-			memcpy(&dg_info->msg, dg, dg_size);
+			dg_info->msg = *dg;
+			memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size);
 
 			INIT_WORK(&dg_info->work, dg_delayed_dispatch);
 			schedule_work(&dg_info->work);
@@ -385,7 +386,8 @@ int vmci_datagram_invoke_guest_handler(struct vmci_datagram *dg)
 
 		dg_info->in_dg_host_queue = false;
 		dg_info->entry = dst_entry;
-		memcpy(&dg_info->msg, dg, VMCI_DG_SIZE(dg));
+		dg_info->msg = *dg;
+		memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size);
 
 		INIT_WORK(&dg_info->work, dg_delayed_dispatch);
 		schedule_work(&dg_info->work);
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 5229940..3e5b901 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -841,10 +841,11 @@ static const struct block_device_operations mmc_bdops = {
 static int mmc_blk_part_switch_pre(struct mmc_card *card,
 				   unsigned int part_type)
 {
-	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB;
+	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_MASK;
+	const unsigned int rpmb = EXT_CSD_PART_CONFIG_ACC_RPMB;
 	int ret = 0;
 
-	if ((part_type & mask) == mask) {
+	if ((part_type & mask) == rpmb) {
 		if (card->ext_csd.cmdq_en) {
 			ret = mmc_cmdq_disable(card);
 			if (ret)
@@ -859,10 +860,11 @@ static int mmc_blk_part_switch_pre(struct mmc_card *card,
 static int mmc_blk_part_switch_post(struct mmc_card *card,
 				    unsigned int part_type)
 {
-	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB;
+	const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_MASK;
+	const unsigned int rpmb = EXT_CSD_PART_CONFIG_ACC_RPMB;
 	int ret = 0;
 
-	if ((part_type & mask) == mask) {
+	if ((part_type & mask) == rpmb) {
 		mmc_retune_unpause(card->host);
 		if (card->reenable_cmdq && !card->ext_csd.cmdq_en)
 			ret = mmc_cmdq_enable(card);
diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
index a09aad9..62a1c45 100644
--- a/drivers/mmc/host/tmio_mmc_core.c
+++ b/drivers/mmc/host/tmio_mmc_core.c
@@ -277,6 +277,8 @@ static void tmio_mmc_reset_work(struct work_struct *work)
 	else
 		mrq->cmd->error = -ETIMEDOUT;
 
+	/* No new calls yet, but disallow concurrent tmio_mmc_done_work() */
+	host->mrq = ERR_PTR(-EBUSY);
 	host->cmd = NULL;
 	host->data = NULL;
 	host->force_pio = false;
diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
index 2882a57..124fd10 100644
--- a/drivers/mtd/ubi/fastmap.c
+++ b/drivers/mtd/ubi/fastmap.c
@@ -95,9 +95,10 @@ size_t ubi_calc_fm_size(struct ubi_device *ubi)
 		sizeof(struct ubi_fm_scan_pool) +
 		sizeof(struct ubi_fm_scan_pool) +
 		(ubi->peb_count * sizeof(struct ubi_fm_ec)) +
-		(sizeof(struct ubi_fm_eba) +
-		(ubi->peb_count * sizeof(__be32))) +
-		sizeof(struct ubi_fm_volhdr) * UBI_MAX_VOLUMES;
+		((sizeof(struct ubi_fm_eba) +
+		  sizeof(struct ubi_fm_volhdr)) *
+		 (UBI_MAX_VOLUMES + UBI_INT_VOL_COUNT)) +
+		(ubi->peb_count * sizeof(__be32));
 	return roundup(size, ubi->leb_size);
 }
 
diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index 7504f43..a1d1cd7 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -801,6 +801,12 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai)
 	 * The number of supported volumes is limited by the eraseblock size
 	 * and by the UBI_MAX_VOLUMES constant.
 	 */
+
+	if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) {
+		ubi_err(ubi, "LEB size too small for a volume record");
+		return -EINVAL;
+	}
+
 	ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE;
 	if (ubi->vtbl_slots > UBI_MAX_VOLUMES)
 		ubi->vtbl_slots = UBI_MAX_VOLUMES;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index 9b12bb3..0580c7e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -83,17 +83,41 @@ static void dwmac4_rx_queue_priority(struct mac_device_info *hw,
 				     u32 prio, u32 queue)
 {
 	void __iomem *ioaddr = hw->pcsr;
-	u32 base_register;
-	u32 value;
+	u32 clear_mask = 0;
+	u32 ctrl2, ctrl3;
+	int i;
 
-	base_register = (queue < 4) ? GMAC_RXQ_CTRL2 : GMAC_RXQ_CTRL3;
+	ctrl2 = readl(ioaddr + GMAC_RXQ_CTRL2);
+	ctrl3 = readl(ioaddr + GMAC_RXQ_CTRL3);
 
-	value = readl(ioaddr + base_register);
+	/* The software must ensure that the same priority
+	 * is not mapped to multiple Rx queues
+	 */
+	for (i = 0; i < 4; i++)
+		clear_mask |= ((prio << GMAC_RXQCTRL_PSRQX_SHIFT(i)) &
+						GMAC_RXQCTRL_PSRQX_MASK(i));
 
-	value &= ~GMAC_RXQCTRL_PSRQX_MASK(queue);
-	value |= (prio << GMAC_RXQCTRL_PSRQX_SHIFT(queue)) &
+	ctrl2 &= ~clear_mask;
+	ctrl3 &= ~clear_mask;
+
+	/* First assign new priorities to a queue, then
+	 * clear them from others queues
+	 */
+	if (queue < 4) {
+		ctrl2 |= (prio << GMAC_RXQCTRL_PSRQX_SHIFT(queue)) &
 						GMAC_RXQCTRL_PSRQX_MASK(queue);
-	writel(value, ioaddr + base_register);
+
+		writel(ctrl2, ioaddr + GMAC_RXQ_CTRL2);
+		writel(ctrl3, ioaddr + GMAC_RXQ_CTRL3);
+	} else {
+		queue -= 4;
+
+		ctrl3 |= (prio << GMAC_RXQCTRL_PSRQX_SHIFT(queue)) &
+						GMAC_RXQCTRL_PSRQX_MASK(queue);
+
+		writel(ctrl3, ioaddr + GMAC_RXQ_CTRL3);
+		writel(ctrl2, ioaddr + GMAC_RXQ_CTRL2);
+	}
 }
 
 static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
@@ -104,6 +128,8 @@ static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
 	u32 value;
 
 	base_register = (queue < 4) ? GMAC_TXQ_PRTY_MAP0 : GMAC_TXQ_PRTY_MAP1;
+	if (queue >= 4)
+		queue -= 4;
 
 	value = readl(ioaddr + base_register);
 
diff --git a/drivers/net/wireless/ath/ath9k/antenna.c b/drivers/net/wireless/ath/ath9k/antenna.c
index a366843..deac618 100644
--- a/drivers/net/wireless/ath/ath9k/antenna.c
+++ b/drivers/net/wireless/ath/ath9k/antenna.c
@@ -643,7 +643,7 @@ static void ath_ant_try_scan(struct ath_ant_comb *antcomb,
 				conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
 				conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
 			} else if (antcomb->rssi_sub >
-				   antcomb->rssi_lna1) {
+				   antcomb->rssi_lna2) {
 				/* set to A-B */
 				conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
 				conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 119fcb2..dde8c31 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -731,8 +731,7 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 	scan_request = cfg->scan_request;
 	cfg->scan_request = NULL;
 
-	if (timer_pending(&cfg->escan_timeout))
-		del_timer_sync(&cfg->escan_timeout);
+	del_timer_sync(&cfg->escan_timeout);
 
 	if (fw_abort) {
 		/* Do a scan abort to stop the driver's scan engine */
@@ -7184,5 +7183,6 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
 	wiphy_unregister(cfg->wiphy);
 	kfree(cfg->ops);
 	wl_deinit_priv(cfg);
+	cancel_work_sync(&cfg->escan_timeout_work);
 	brcmf_free_wiphy(cfg->wiphy);
 }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 522e592..28aa052 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -440,15 +440,20 @@ static int pci_device_remove(struct device *dev)
 	struct pci_dev *pci_dev = to_pci_dev(dev);
 	struct pci_driver *drv = pci_dev->driver;
 
-	if (drv) {
-		if (drv->remove) {
-			pm_runtime_get_sync(dev);
-			drv->remove(pci_dev);
-			pm_runtime_put_noidle(dev);
-		}
-		pcibios_free_irq(pci_dev);
-		pci_dev->driver = NULL;
+	if (drv->remove) {
+		pm_runtime_get_sync(dev);
+		/*
+		 * If the driver provides a .runtime_idle() callback and it has
+		 * started to run already, it may continue to run in parallel
+		 * with the code below, so wait until all of the runtime PM
+		 * activity has completed.
+		 */
+		pm_runtime_barrier(dev);
+		drv->remove(pci_dev);
+		pm_runtime_put_noidle(dev);
 	}
+	pcibios_free_irq(pci_dev);
+	pci_dev->driver = NULL;
 
 	/* Undo the runtime PM settings in local_pci_probe() */
 	pm_runtime_put_sync(dev);
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 3743828..bcd9d6c 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -173,6 +173,7 @@ static inline struct zcrypt_queue *zcrypt_pick_queue(struct zcrypt_card *zc,
 {
 	if (!zq || !try_module_get(zq->queue->ap_dev.drv->driver.owner))
 		return NULL;
+	zcrypt_card_get(zc);
 	zcrypt_queue_get(zq);
 	get_device(&zq->queue->ap_dev.device);
 	atomic_add(weight, &zc->load);
@@ -192,6 +193,7 @@ static inline void zcrypt_drop_queue(struct zcrypt_card *zc,
 	atomic_sub(weight, &zq->load);
 	put_device(&zq->queue->ap_dev.device);
 	zcrypt_queue_put(zq);
+	zcrypt_card_put(zc);
 	module_put(mod);
 }
 
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 70733d7..d402000 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -601,8 +601,10 @@ lpfc_rcv_padisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 				/* Save the ELS cmd */
 				elsiocb->drvrTimeout = cmd;
 
-				lpfc_sli4_resume_rpi(ndlp,
-					lpfc_mbx_cmpl_resume_rpi, elsiocb);
+				if (lpfc_sli4_resume_rpi(ndlp,
+						lpfc_mbx_cmpl_resume_rpi,
+						elsiocb))
+					kfree(elsiocb);
 				goto out;
 			}
 		}
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index fa0d0d1..cd4e3cf 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1039,7 +1039,7 @@ lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
 		nvmewqe = ctx_buf->iocbq;
 		wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
 		/* Initialize WQE */
-		memset(wqe, 0, sizeof(union lpfc_wqe));
+		memset(wqe, 0, sizeof(*wqe));
 		/* Word 7 */
 		bf_set(wqe_ct, &wqe->generic.wqe_com, SLI4_CT_RPI);
 		bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3);
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 4b431ca..2795ab0 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1015,6 +1015,16 @@ static void qlt_free_session_done(struct work_struct *work)
 		    "%s: sess %p logout completed\n",__func__, sess);
 	}
 
+	/* check for any straggling io left behind */
+	if (!(sess->flags & FCF_FCP2_DEVICE) &&
+	    qla2x00_eh_wait_for_pending_commands(sess->vha, sess->d_id.b24, 0, WAIT_TARGET)) {
+		ql_log(ql_log_warn, vha, 0x3027,
+		    "IO not return. Resetting.\n");
+		set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+		qla2xxx_wake_dpc(vha);
+		qla2x00_wait_for_chip_reset(vha);
+	}
+
 	if (sess->logo_ack_needed) {
 		sess->logo_ack_needed = 0;
 		qla24xx_async_notify_ack(vha, sess,
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index 06b6d7a..7783ed0 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -944,7 +944,7 @@ struct qman_portal {
 	/* linked-list of CSCN handlers. */
 	struct list_head cgr_cbs;
 	/* list lock */
-	spinlock_t cgr_lock;
+	raw_spinlock_t cgr_lock;
 	struct work_struct congestion_work;
 	struct work_struct mr_work;
 	char irqname[MAX_IRQNAME];
@@ -1164,7 +1164,7 @@ static int qman_create_portal(struct qman_portal *portal,
 		/* if the given mask is NULL, assume all CGRs can be seen */
 		qman_cgrs_fill(&portal->cgrs[0]);
 	INIT_LIST_HEAD(&portal->cgr_cbs);
-	spin_lock_init(&portal->cgr_lock);
+	raw_spin_lock_init(&portal->cgr_lock);
 	INIT_WORK(&portal->congestion_work, qm_congestion_task);
 	INIT_WORK(&portal->mr_work, qm_mr_process_task);
 	portal->bits = 0;
@@ -1339,11 +1339,14 @@ static void qm_congestion_task(struct work_struct *work)
 	union qm_mc_result *mcr;
 	struct qman_cgr *cgr;
 
-	spin_lock(&p->cgr_lock);
+	/*
+	 * FIXME: QM_MCR_TIMEOUT is 10ms, which is too long for a raw spinlock!
+	 */
+	raw_spin_lock_irq(&p->cgr_lock);
 	qm_mc_start(&p->p);
 	qm_mc_commit(&p->p, QM_MCC_VERB_QUERYCONGESTION);
 	if (!qm_mc_result_timeout(&p->p, &mcr)) {
-		spin_unlock(&p->cgr_lock);
+		raw_spin_unlock_irq(&p->cgr_lock);
 		dev_crit(p->config->dev, "QUERYCONGESTION timeout\n");
 		qman_p_irqsource_add(p, QM_PIRQ_CSCI);
 		return;
@@ -1359,7 +1362,7 @@ static void qm_congestion_task(struct work_struct *work)
 	list_for_each_entry(cgr, &p->cgr_cbs, node)
 		if (cgr->cb && qman_cgrs_get(&c, cgr->cgrid))
 			cgr->cb(p, cgr, qman_cgrs_get(&rr, cgr->cgrid));
-	spin_unlock(&p->cgr_lock);
+	raw_spin_unlock_irq(&p->cgr_lock);
 	qman_p_irqsource_add(p, QM_PIRQ_CSCI);
 }
 
@@ -2316,7 +2319,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags,
 	preempt_enable();
 
 	cgr->chan = p->config->channel;
-	spin_lock(&p->cgr_lock);
+	raw_spin_lock_irq(&p->cgr_lock);
 
 	if (opts) {
 		struct qm_mcc_initcgr local_opts = *opts;
@@ -2353,12 +2356,28 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags,
 	    qman_cgrs_get(&p->cgrs[1], cgr->cgrid))
 		cgr->cb(p, cgr, 1);
 out:
-	spin_unlock(&p->cgr_lock);
+	raw_spin_unlock_irq(&p->cgr_lock);
 	put_affine_portal();
 	return ret;
 }
 EXPORT_SYMBOL(qman_create_cgr);
 
+static struct qman_portal *qman_cgr_get_affine_portal(struct qman_cgr *cgr)
+{
+	struct qman_portal *p = get_affine_portal();
+
+	if (cgr->chan != p->config->channel) {
+		/* attempt to delete from other portal than creator */
+		dev_err(p->config->dev, "CGR not owned by current portal");
+		dev_dbg(p->config->dev, " create 0x%x, delete 0x%x\n",
+			cgr->chan, p->config->channel);
+		put_affine_portal();
+		return NULL;
+	}
+
+	return p;
+}
+
 int qman_delete_cgr(struct qman_cgr *cgr)
 {
 	unsigned long irqflags;
@@ -2366,19 +2385,13 @@ int qman_delete_cgr(struct qman_cgr *cgr)
 	struct qm_mcc_initcgr local_opts;
 	int ret = 0;
 	struct qman_cgr *i;
-	struct qman_portal *p = get_affine_portal();
+	struct qman_portal *p = qman_cgr_get_affine_portal(cgr);
 
-	if (cgr->chan != p->config->channel) {
-		/* attempt to delete from other portal than creator */
-		dev_err(p->config->dev, "CGR not owned by current portal");
-		dev_dbg(p->config->dev, " create 0x%x, delete 0x%x\n",
-			cgr->chan, p->config->channel);
+	if (!p)
+		return -EINVAL;
 
-		ret = -EINVAL;
-		goto put_portal;
-	}
 	memset(&local_opts, 0, sizeof(struct qm_mcc_initcgr));
-	spin_lock_irqsave(&p->cgr_lock, irqflags);
+	raw_spin_lock_irqsave(&p->cgr_lock, irqflags);
 	list_del(&cgr->node);
 	/*
 	 * If there are no other CGR objects for this CGRID in the list,
@@ -2403,8 +2416,7 @@ int qman_delete_cgr(struct qman_cgr *cgr)
 		/* add back to the list */
 		list_add(&cgr->node, &p->cgr_cbs);
 release_lock:
-	spin_unlock_irqrestore(&p->cgr_lock, irqflags);
-put_portal:
+	raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags);
 	put_affine_portal();
 	return ret;
 }
@@ -2435,6 +2447,54 @@ void qman_delete_cgr_safe(struct qman_cgr *cgr)
 }
 EXPORT_SYMBOL(qman_delete_cgr_safe);
 
+static int qman_update_cgr(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts)
+{
+	int ret;
+	unsigned long irqflags;
+	struct qman_portal *p = qman_cgr_get_affine_portal(cgr);
+
+	if (!p)
+		return -EINVAL;
+
+	raw_spin_lock_irqsave(&p->cgr_lock, irqflags);
+	ret = qm_modify_cgr(cgr, 0, opts);
+	raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags);
+	put_affine_portal();
+	return ret;
+}
+
+struct update_cgr_params {
+	struct qman_cgr *cgr;
+	struct qm_mcc_initcgr *opts;
+	int ret;
+};
+
+static void qman_update_cgr_smp_call(void *p)
+{
+	struct update_cgr_params *params = p;
+
+	params->ret = qman_update_cgr(params->cgr, params->opts);
+}
+
+int qman_update_cgr_safe(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts)
+{
+	struct update_cgr_params params = {
+		.cgr = cgr,
+		.opts = opts,
+	};
+
+	preempt_disable();
+	if (qman_cgr_cpus[cgr->cgrid] != smp_processor_id())
+		smp_call_function_single(qman_cgr_cpus[cgr->cgrid],
+					 qman_update_cgr_smp_call, &params,
+					 true);
+	else
+		params.ret = qman_update_cgr(cgr, opts);
+	preempt_enable();
+	return params.ret;
+}
+EXPORT_SYMBOL(qman_update_cgr_safe);
+
 /* Cleanup FQs */
 
 static int _qm_mr_consume_and_match_verb(struct qm_portal *p, int v)
diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
index ccfd642..5ea9a8a 100644
--- a/drivers/staging/comedi/drivers/comedi_test.c
+++ b/drivers/staging/comedi/drivers/comedi_test.c
@@ -95,6 +95,8 @@ struct waveform_private {
 	struct timer_list ao_timer;	/* timer for AO commands */
 	u64 ao_last_scan_time;		/* time of previous AO scan in usec */
 	unsigned int ao_scan_period;	/* AO scan period in usec */
+	bool ai_timer_enable:1;		/* should AI timer be running? */
+	bool ao_timer_enable:1;		/* should AO timer be running? */
 	unsigned short ao_loopbacks[N_CHANS];
 };
 
@@ -244,8 +246,12 @@ static void waveform_ai_timer(unsigned long arg)
 			time_increment = devpriv->ai_convert_time - now;
 		else
 			time_increment = 1;
-		mod_timer(&devpriv->ai_timer,
-			  jiffies + usecs_to_jiffies(time_increment));
+		spin_lock(&dev->spinlock);
+		if (devpriv->ai_timer_enable) {
+			mod_timer(&devpriv->ai_timer,
+				  jiffies + usecs_to_jiffies(time_increment));
+		}
+		spin_unlock(&dev->spinlock);
 	}
 
 overrun:
@@ -401,9 +407,12 @@ static int waveform_ai_cmd(struct comedi_device *dev,
 	 * Seem to need an extra jiffy here, otherwise timer expires slightly
 	 * early!
 	 */
+	spin_lock_bh(&dev->spinlock);
+	devpriv->ai_timer_enable = true;
 	devpriv->ai_timer.expires =
 		jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1;
 	add_timer(&devpriv->ai_timer);
+	spin_unlock_bh(&dev->spinlock);
 	return 0;
 }
 
@@ -412,6 +421,9 @@ static int waveform_ai_cancel(struct comedi_device *dev,
 {
 	struct waveform_private *devpriv = dev->private;
 
+	spin_lock_bh(&dev->spinlock);
+	devpriv->ai_timer_enable = false;
+	spin_unlock_bh(&dev->spinlock);
 	if (in_softirq()) {
 		/* Assume we were called from the timer routine itself. */
 		del_timer(&devpriv->ai_timer);
@@ -503,8 +515,12 @@ static void waveform_ao_timer(unsigned long arg)
 		unsigned int time_inc = devpriv->ao_last_scan_time +
 					devpriv->ao_scan_period - now;
 
-		mod_timer(&devpriv->ao_timer,
-			  jiffies + usecs_to_jiffies(time_inc));
+		spin_lock(&dev->spinlock);
+		if (devpriv->ao_timer_enable) {
+			mod_timer(&devpriv->ao_timer,
+				  jiffies + usecs_to_jiffies(time_inc));
+		}
+		spin_unlock(&dev->spinlock);
 	}
 
 underrun:
@@ -525,9 +541,12 @@ static int waveform_ao_inttrig_start(struct comedi_device *dev,
 	async->inttrig = NULL;
 
 	devpriv->ao_last_scan_time = ktime_to_us(ktime_get());
+	spin_lock_bh(&dev->spinlock);
+	devpriv->ao_timer_enable = true;
 	devpriv->ao_timer.expires =
 		jiffies + usecs_to_jiffies(devpriv->ao_scan_period);
 	add_timer(&devpriv->ao_timer);
+	spin_unlock_bh(&dev->spinlock);
 
 	return 1;
 }
@@ -612,6 +631,9 @@ static int waveform_ao_cancel(struct comedi_device *dev,
 	struct waveform_private *devpriv = dev->private;
 
 	s->async->inttrig = NULL;
+	spin_lock_bh(&dev->spinlock);
+	devpriv->ao_timer_enable = false;
+	spin_unlock_bh(&dev->spinlock);
 	if (in_softirq()) {
 		/* Assume we were called from the timer routine itself. */
 		del_timer(&devpriv->ao_timer);
diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c
index a1ca68c..4baab65 100644
--- a/drivers/staging/speakup/synth.c
+++ b/drivers/staging/speakup/synth.c
@@ -191,8 +191,10 @@ void spk_do_flush(void)
 	wake_up_process(speakup_task);
 }
 
-void synth_write(const char *buf, size_t count)
+void synth_write(const char *_buf, size_t count)
 {
+	const unsigned char *buf = (const unsigned char *) _buf;
+
 	while (count--)
 		synth_buffer_add(*buf++);
 	synth_start();
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index b3176f4..72177b4 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -35,8 +35,11 @@
 #define USE_VCHIQ_ARM
 #include "interface/vchi/vchi.h"
 
-/* maximum number of components supported */
-#define VCHIQ_MMAL_MAX_COMPONENTS 4
+/*
+ * maximum number of components supported.
+ * This matches the maximum permitted by default on the VPU
+ */
+#define VCHIQ_MMAL_MAX_COMPONENTS 64
 
 /*#define FULL_MSG_DUMP 1*/
 
@@ -174,8 +177,6 @@ struct vchiq_mmal_instance {
 	/* mapping table between context handles and mmal_msg_contexts */
 	struct vchiq_mmal_context_map context_map;
 
-	/* component to use next */
-	int component_idx;
 	struct vchiq_mmal_component component[VCHIQ_MMAL_MAX_COMPONENTS];
 };
 
@@ -1043,9 +1044,9 @@ static int port_info_get(struct vchiq_mmal_instance *instance,
 		goto release_msg;
 
 	if (rmsg->u.port_info_get_reply.port.is_enabled == 0)
-		port->enabled = false;
+		port->enabled = 0;
 	else
-		port->enabled = true;
+		port->enabled = 1;
 
 	/* copy the values out of the message */
 	port->handle = rmsg->u.port_info_get_reply.port_handle;
@@ -1117,9 +1118,10 @@ static int create_component(struct vchiq_mmal_instance *instance,
 
 	/* build component create message */
 	m.h.type = MMAL_MSG_TYPE_COMPONENT_CREATE;
-	m.u.component_create.client_component = (u32)(unsigned long)component;
-	strncpy(m.u.component_create.name, name,
-		sizeof(m.u.component_create.name));
+	m.u.component_create.client_component = component->client_component;
+	strscpy_pad(m.u.component_create.name, name,
+		    sizeof(m.u.component_create.name));
+	m.u.component_create.pid = 0;
 
 	ret = send_synchronous_mmal_msg(instance, &m,
 					sizeof(m.u.component_create),
@@ -1482,7 +1484,7 @@ static int port_disable(struct vchiq_mmal_instance *instance,
 	if (!port->enabled)
 		return 0;
 
-	port->enabled = false;
+	port->enabled = 0;
 
 	ret = port_action_port(instance, port,
 			       MMAL_MSG_PORT_ACTION_TYPE_DISABLE);
@@ -1537,7 +1539,7 @@ static int port_enable(struct vchiq_mmal_instance *instance,
 	if (ret)
 		goto done;
 
-	port->enabled = true;
+	port->enabled = 1;
 
 	if (port->buffer_cb) {
 		/* send buffer headers to videocore */
@@ -1703,7 +1705,7 @@ int vchiq_mmal_port_connect_tunnel(struct vchiq_mmal_instance *instance,
 			pr_err("failed disconnecting src port\n");
 			goto release_unlock;
 		}
-		src->connected->enabled = false;
+		src->connected->enabled = 0;
 		src->connected = NULL;
 	}
 
@@ -1789,17 +1791,29 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 {
 	int ret;
 	int idx;		/* port index */
-	struct vchiq_mmal_component *component;
+	struct vchiq_mmal_component *component = NULL;
 
 	if (mutex_lock_interruptible(&instance->vchiq_mutex))
 		return -EINTR;
 
-	if (instance->component_idx == VCHIQ_MMAL_MAX_COMPONENTS) {
+	for (idx = 0; idx < VCHIQ_MMAL_MAX_COMPONENTS; idx++) {
+		if (!instance->component[idx].in_use) {
+			component = &instance->component[idx];
+			component->in_use = 1;
+			break;
+		}
+	}
+
+	if (!component) {
 		ret = -EINVAL;	/* todo is this correct error? */
 		goto unlock;
 	}
 
-	component = &instance->component[instance->component_idx];
+	/* We need a handle to reference back to our component structure.
+	 * Use the array index in instance->component rather than rolling
+	 * another IDR.
+	 */
+	component->client_component = idx;
 
 	ret = create_component(instance, component, name);
 	if (ret < 0)
@@ -1848,8 +1862,6 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 			goto release_component;
 	}
 
-	instance->component_idx++;
-
 	*component_out = component;
 
 	mutex_unlock(&instance->vchiq_mutex);
@@ -1859,6 +1871,8 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 release_component:
 	destroy_component(instance, component);
 unlock:
+	if (component)
+		component->in_use = 0;
 	mutex_unlock(&instance->vchiq_mutex);
 
 	return ret;
@@ -1880,6 +1894,8 @@ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
 
 	ret = destroy_component(instance, component);
 
+	component->in_use = 0;
+
 	mutex_unlock(&instance->vchiq_mutex);
 
 	return ret;
@@ -1928,7 +1944,7 @@ int vchiq_mmal_component_disable(struct vchiq_mmal_instance *instance,
 
 	ret = disable_component(instance, component);
 	if (ret == 0)
-		component->enabled = false;
+		component->enabled = 0;
 
 	mutex_unlock(&instance->vchiq_mutex);
 
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
index 63db053..083f6d4 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
@@ -58,7 +58,7 @@ typedef void (*vchiq_mmal_buffer_cb)(
 		unsigned long length, u32 mmal_flags, s64 dts, s64 pts);
 
 struct vchiq_mmal_port {
-	bool enabled;
+	u32 enabled:1;
 	u32 handle;
 	u32 type; /* port type, cached to use on port info set */
 	u32 index; /* port index, cached to use on port info set */
@@ -93,7 +93,8 @@ struct vchiq_mmal_port {
 };
 
 struct vchiq_mmal_component {
-	bool enabled;
+	u32 in_use:1;
+	u32 enabled:1;
 	u32 handle;  /* VideoCore handle for component */
 	u32 inputs;  /* Number of input ports */
 	u32 outputs; /* Number of output ports */
@@ -102,6 +103,7 @@ struct vchiq_mmal_component {
 	struct vchiq_mmal_port input[MAX_PORT_COUNT]; /* input ports */
 	struct vchiq_mmal_port output[MAX_PORT_COUNT]; /* output ports */
 	struct vchiq_mmal_port clock[MAX_PORT_COUNT]; /* clock ports */
+	u32 client_component;	/* Used to ref back to client struct */
 };
 
 int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance);
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 97f6860..a60d4b5 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2449,6 +2449,9 @@ static int gsmld_open(struct tty_struct *tty)
 	struct gsm_mux *gsm;
 	int ret;
 
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
 	if (tty->ops->write == NULL)
 		return -EINVAL;
 
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index a24a1ef..be3a013 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1759,9 +1759,12 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
 		       UARTCTRL);
 
 	lpuart32_serial_setbrg(sport, baud);
-	lpuart32_write(&sport->port, modem, UARTMODIR);
-	lpuart32_write(&sport->port, ctrl, UARTCTRL);
+	/* disable CTS before enabling UARTCTRL_TE to avoid pending idle preamble */
+	lpuart32_write(&sport->port, modem & ~UARTMODIR_TXCTSE, UARTMODIR);
 	/* restore control register */
+	lpuart32_write(&sport->port, ctrl, UARTCTRL);
+	/* re-enable the CTS if needed */
+	lpuart32_write(&sport->port, modem, UARTMODIR);
 
 	spin_unlock_irqrestore(&sport->port.lock, flags);
 }
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 2b84ec2..aab98a4 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -543,7 +543,7 @@ static void delete_char(struct vc_data *vc, unsigned int nr)
 {
 	unsigned short *p = (unsigned short *) vc->vc_pos;
 
-	scr_memcpyw(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2);
+	scr_memmovew(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2);
 	scr_memsetw(p + vc->vc_cols - vc->vc_x - nr, vc->vc_video_erase_char,
 			nr * 2);
 	vc->vc_need_wrap = 0;
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index d807186..6900f76 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -457,18 +457,32 @@ static ssize_t wdm_write
 static int service_outstanding_interrupt(struct wdm_device *desc)
 {
 	int rv = 0;
+	int used;
 
 	/* submit read urb only if the device is waiting for it */
 	if (!desc->resp_count || !--desc->resp_count)
 		goto out;
 
-	set_bit(WDM_RESPONDING, &desc->flags);
+	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+		rv = -ENODEV;
+		goto out;
+	}
+	if (test_bit(WDM_RESETTING, &desc->flags)) {
+		rv = -EIO;
+		goto out;
+	}
+
+	used = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+	if (used)
+		goto out;
+
 	spin_unlock_irq(&desc->iuspin);
 	rv = usb_submit_urb(desc->response, GFP_KERNEL);
 	spin_lock_irq(&desc->iuspin);
 	if (rv) {
-		dev_err(&desc->intf->dev,
-			"usb_submit_urb failed with result %d\n", rv);
+		if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+			dev_err(&desc->intf->dev,
+				"usb_submit_urb failed with result %d\n", rv);
 
 		/* make sure the next notification trigger a submit */
 		clear_bit(WDM_RESPONDING, &desc->flags);
@@ -1008,8 +1022,8 @@ static void wdm_disconnect(struct usb_interface *intf)
 	wake_up_all(&desc->wait);
 	mutex_lock(&desc->rlock);
 	mutex_lock(&desc->wlock);
-	kill_urbs(desc);
 	cancel_work_sync(&desc->rxwork);
+	kill_urbs(desc);
 	mutex_unlock(&desc->wlock);
 	mutex_unlock(&desc->rlock);
 
diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
index 53c1f6e..2fc10939 100644
--- a/drivers/usb/core/port.c
+++ b/drivers/usb/core/port.c
@@ -407,7 +407,7 @@ static int match_location(struct usb_device *peer_hdev, void *p)
 	struct usb_hub *peer_hub = usb_hub_to_struct_hub(peer_hdev);
 	struct usb_device *hdev = to_usb_device(port_dev->dev.parent->parent);
 
-	if (!peer_hub)
+	if (!peer_hub || port_dev->connect_type == USB_PORT_NOT_USED)
 		return 0;
 
 	hcd = bus_to_hcd(hdev->bus);
@@ -418,7 +418,8 @@ static int match_location(struct usb_device *peer_hdev, void *p)
 
 	for (port1 = 1; port1 <= peer_hdev->maxchild; port1++) {
 		peer = peer_hub->ports[port1 - 1];
-		if (peer && peer->location == port_dev->location) {
+		if (peer && peer->connect_type != USB_PORT_NOT_USED &&
+		    peer->location == port_dev->location) {
 			link_peers_report(port_dev, peer);
 			return 1; /* done */
 		}
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index 15c1986..d3eac2d 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -1046,14 +1046,24 @@ static ssize_t interface_authorized_store(struct device *dev,
 {
 	struct usb_interface *intf = to_usb_interface(dev);
 	bool val;
+	struct kernfs_node *kn;
 
 	if (strtobool(buf, &val) != 0)
 		return -EINVAL;
 
-	if (val)
+	if (val) {
 		usb_authorize_interface(intf);
-	else
-		usb_deauthorize_interface(intf);
+	} else {
+		/*
+		 * Prevent deadlock if another process is concurrently
+		 * trying to unregister intf.
+		 */
+		kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
+		if (kn) {
+			usb_deauthorize_interface(intf);
+			sysfs_unbreak_active_protection(kn);
+		}
+	}
 
 	return count;
 }
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 09fd97a..2f1fb3a 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -659,15 +659,27 @@ struct dwc2_dregs_backup {
  * struct dwc2_hregs_backup - Holds host registers state before
  * entering partial power down
  * @hcfg:		Backup of HCFG register
+ * @hflbaddr:		Backup of HFLBADDR register
  * @haintmsk:		Backup of HAINTMSK register
+ * @hcchar:		Backup of HCCHAR register
+ * @hcsplt:		Backup of HCSPLT register
  * @hcintmsk:		Backup of HCINTMSK register
- * @hptr0:		Backup of HPTR0 register
+ * @hctsiz:		Backup of HCTSIZ register
+ * @hdma:		Backup of HCDMA register
+ * @hcdmab:		Backup of HCDMAB register
+ * @hprt0:		Backup of HPTR0 register
  * @hfir:		Backup of HFIR register
  */
 struct dwc2_hregs_backup {
 	u32 hcfg;
+	u32 hflbaddr;
 	u32 haintmsk;
+	u32 hcchar[MAX_EPS_CHANNELS];
+	u32 hcsplt[MAX_EPS_CHANNELS];
 	u32 hcintmsk[MAX_EPS_CHANNELS];
+	u32 hctsiz[MAX_EPS_CHANNELS];
+	u32 hcidma[MAX_EPS_CHANNELS];
+	u32 hcidmab[MAX_EPS_CHANNELS];
 	u32 hprt0;
 	u32 hfir;
 	bool valid;
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 6d20603..f3ca2d1 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -2903,8 +2903,11 @@ enum dwc2_transaction_type dwc2_hcd_select_transactions(
 			hsotg->available_host_channels--;
 		}
 		qh = list_entry(qh_ptr, struct dwc2_qh, qh_list_entry);
-		if (dwc2_assign_and_init_hc(hsotg, qh))
+		if (dwc2_assign_and_init_hc(hsotg, qh)) {
+			if (hsotg->params.uframe_sched)
+				hsotg->available_host_channels++;
 			break;
+		}
 
 		/*
 		 * Move the QH from the periodic ready schedule to the
@@ -2937,8 +2940,11 @@ enum dwc2_transaction_type dwc2_hcd_select_transactions(
 			hsotg->available_host_channels--;
 		}
 
-		if (dwc2_assign_and_init_hc(hsotg, qh))
+		if (dwc2_assign_and_init_hc(hsotg, qh)) {
+			if (hsotg->params.uframe_sched)
+				hsotg->available_host_channels++;
 			break;
+		}
 
 		/*
 		 * Move the QH from the non-periodic inactive schedule to the
@@ -4342,6 +4348,8 @@ void dwc2_host_complete(struct dwc2_hsotg *hsotg, struct dwc2_qtd *qtd,
 			 urb->actual_length);
 
 	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		if (!hsotg->params.dma_desc_enable)
+			urb->start_frame = qtd->qh->start_active_frame;
 		urb->error_count = dwc2_hcd_urb_get_error_count(qtd->urb);
 		for (i = 0; i < urb->number_of_packets; ++i) {
 			urb->iso_frame_desc[i].actual_length =
@@ -5475,9 +5483,16 @@ int dwc2_backup_host_registers(struct dwc2_hsotg *hsotg)
 	/* Backup Host regs */
 	hr = &hsotg->hr_backup;
 	hr->hcfg = dwc2_readl(hsotg->regs + HCFG);
+	hr->hflbaddr = dwc2_readl(hsotg->regs + HFLBADDR);
 	hr->haintmsk = dwc2_readl(hsotg->regs + HAINTMSK);
-	for (i = 0; i < hsotg->params.host_channels; ++i)
+	for (i = 0; i < hsotg->params.host_channels; ++i) {
+		hr->hcchar[i] = dwc2_readl(hsotg->regs + HCCHAR(i));
+		hr->hcsplt[i] = dwc2_readl(hsotg->regs + HCSPLT(i));
 		hr->hcintmsk[i] = dwc2_readl(hsotg->regs + HCINTMSK(i));
+		hr->hctsiz[i] = dwc2_readl(hsotg->regs + HCTSIZ(i));
+		hr->hcidma[i] = dwc2_readl(hsotg->regs + HCDMA(i));
+		hr->hcidmab[i] = dwc2_readl(hsotg->regs + HCDMAB(i));
+	}
 
 	hr->hprt0 = dwc2_read_hprt0(hsotg);
 	hr->hfir = dwc2_readl(hsotg->regs + HFIR);
@@ -5510,10 +5525,17 @@ int dwc2_restore_host_registers(struct dwc2_hsotg *hsotg)
 	hr->valid = false;
 
 	dwc2_writel(hr->hcfg, hsotg->regs + HCFG);
+	dwc2_writel(hr->hflbaddr, hsotg->regs + HFLBADDR);
 	dwc2_writel(hr->haintmsk, hsotg->regs + HAINTMSK);
 
-	for (i = 0; i < hsotg->params.host_channels; ++i)
+	for (i = 0; i < hsotg->params.host_channels; ++i) {
+		dwc2_writel(hr->hcchar[i], hsotg->regs + HCCHAR(i));
+		dwc2_writel(hr->hcsplt[i], hsotg->regs + HCSPLT(i));
 		dwc2_writel(hr->hcintmsk[i], hsotg->regs + HCINTMSK(i));
+		dwc2_writel(hr->hctsiz[i], hsotg->regs + HCTSIZ(i));
+		dwc2_writel(hr->hcidma[i], hsotg->regs + HCDMA(i));
+		dwc2_writel(hr->hcidmab[i], hsotg->regs + HCDMAB(i));
+	}
 
 	dwc2_writel(hr->hprt0, hsotg->regs + HPRT0);
 	dwc2_writel(hr->hfir, hsotg->regs + HFIR);
diff --git a/drivers/usb/dwc2/hcd_ddma.c b/drivers/usb/dwc2/hcd_ddma.c
index b8bdf54..4a4b6a5 100644
--- a/drivers/usb/dwc2/hcd_ddma.c
+++ b/drivers/usb/dwc2/hcd_ddma.c
@@ -587,7 +587,7 @@ static void dwc2_init_isoc_dma_desc(struct dwc2_hsotg *hsotg,
 	idx = qh->td_last;
 	inc = qh->host_interval;
 	hsotg->frame_number = dwc2_hcd_get_frame_number(hsotg);
-	cur_idx = dwc2_frame_list_idx(hsotg->frame_number);
+	cur_idx = idx;
 	next_idx = dwc2_desclist_idx_inc(qh->td_last, inc, qh->dev_speed);
 
 	/*
@@ -894,6 +894,8 @@ static int dwc2_cmpl_host_isoc_dma_desc(struct dwc2_hsotg *hsotg,
 {
 	struct dwc2_dma_desc *dma_desc;
 	struct dwc2_hcd_iso_packet_desc *frame_desc;
+	u16 frame_desc_idx;
+	struct urb *usb_urb = qtd->urb->priv;
 	u16 remain = 0;
 	int rc = 0;
 
@@ -906,8 +908,11 @@ static int dwc2_cmpl_host_isoc_dma_desc(struct dwc2_hsotg *hsotg,
 				DMA_FROM_DEVICE);
 
 	dma_desc = &qh->desc_list[idx];
+	frame_desc_idx = (idx - qtd->isoc_td_first) & (usb_urb->number_of_packets - 1);
 
-	frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index_last];
+	frame_desc = &qtd->urb->iso_descs[frame_desc_idx];
+	if (idx == qtd->isoc_td_first)
+		usb_urb->start_frame = dwc2_hcd_get_frame_number(hsotg);
 	dma_desc->buf = (u32)(qtd->urb->dma + frame_desc->offset);
 	if (chan->ep_is_in)
 		remain = (dma_desc->status & HOST_DMA_ISOC_NBYTES_MASK) >>
@@ -928,7 +933,7 @@ static int dwc2_cmpl_host_isoc_dma_desc(struct dwc2_hsotg *hsotg,
 		frame_desc->status = 0;
 	}
 
-	if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
+	if (++qtd->isoc_frame_index == usb_urb->number_of_packets) {
 		/*
 		 * urb->status is not used for isoc transfers here. The
 		 * individual frame_desc status are used instead.
@@ -1033,11 +1038,11 @@ static void dwc2_complete_isoc_xfer_ddma(struct dwc2_hsotg *hsotg,
 				return;
 			idx = dwc2_desclist_idx_inc(idx, qh->host_interval,
 						    chan->speed);
-			if (!rc)
+			if (rc == 0)
 				continue;
 
-			if (rc == DWC2_CMPL_DONE)
-				break;
+			if (rc == DWC2_CMPL_DONE || rc == DWC2_CMPL_STOP)
+				goto stop_scan;
 
 			/* rc == DWC2_CMPL_STOP */
 
diff --git a/drivers/usb/dwc2/hw.h b/drivers/usb/dwc2/hw.h
index 4592012..ae3ea49 100644
--- a/drivers/usb/dwc2/hw.h
+++ b/drivers/usb/dwc2/hw.h
@@ -690,7 +690,7 @@
 #define TXSTS_QTOP_TOKEN_MASK		(0x3 << 25)
 #define TXSTS_QTOP_TOKEN_SHIFT		25
 #define TXSTS_QTOP_TERMINATE		BIT(24)
-#define TXSTS_QSPCAVAIL_MASK		(0xff << 16)
+#define TXSTS_QSPCAVAIL_MASK		(0x7f << 16)
 #define TXSTS_QSPCAVAIL_SHIFT		16
 #define TXSTS_FSPCAVAIL_MASK		(0xffff << 0)
 #define TXSTS_FSPCAVAIL_SHIFT		0
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 7a9b388..d8c8231 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1346,7 +1346,7 @@ static int ncm_unwrap_ntb(struct gether *port,
 	if (to_process == 1 &&
 	    (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) {
 		to_process--;
-	} else if (to_process > 0) {
+	} else if ((to_process > 0) && (block_len != 0)) {
 		ntb_ptr = (unsigned char *)(ntb_ptr + block_len);
 		goto parse_ntb;
 	}
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index b60c452..f36788f 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -272,7 +272,9 @@ int usb_ep_queue(struct usb_ep *ep,
 {
 	int ret = 0;
 
-	if (WARN_ON_ONCE(!ep->enabled && ep->address)) {
+	if (!ep->enabled && ep->address) {
+		pr_debug("USB gadget: queue request to disabled ep 0x%x (%s)\n",
+				 ep->address, ep->name);
 		ret = -ESHUTDOWN;
 		goto out;
 	}
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index df8ae89..5f898d6 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -584,6 +584,7 @@ done(struct sl811 *sl811, struct sl811h_ep *ep, u8 bank)
 		finish_request(sl811, ep, urb, urbstat);
 }
 
+#ifdef QUIRK2
 static inline u8 checkdone(struct sl811 *sl811)
 {
 	u8	ctl;
@@ -615,6 +616,7 @@ static inline u8 checkdone(struct sl811 *sl811)
 #endif
 	return irqstat;
 }
+#endif
 
 static irqreturn_t sl811h_irq(struct usb_hcd *hcd)
 {
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 4158432..15bfeb0 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -60,6 +60,8 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
 	{ USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
 	{ USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
+	{ USB_DEVICE(0x04BF, 0x1301) }, /* TDK Corporation NC0110013M - Network Controller */
+	{ USB_DEVICE(0x04BF, 0x1303) }, /* TDK Corporation MM0110113M - i3 Micro Module */
 	{ USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */
 	{ USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
 	{ USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
@@ -148,6 +150,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
 	{ USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */
 	{ USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+	{ USB_DEVICE(0x10C4, 0x863C) }, /* MGP Instruments PDS100 */
 	{ USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
 	{ USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
 	{ USB_DEVICE(0x10C4, 0x87ED) }, /* IMST USB-Stick for Smart Meter */
@@ -181,6 +184,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */
 	{ USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */
 	{ USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */
+	{ USB_DEVICE(0x11CA, 0x0212) }, /* Verifone USB to Printer (UART, CP2102) */
 	{ USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */
 	{ USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */
 	{ USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 59271e4..8bdf8fc 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1050,6 +1050,8 @@ static const struct usb_device_id id_table_combined[] = {
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	/* GMC devices */
+	{ USB_DEVICE(GMC_VID, GMC_Z216C_PID) },
 	{ }					/* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 9a0f9fc..b2aec11 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1599,3 +1599,9 @@
 #define UBLOX_VID			0x1546
 #define UBLOX_C099F9P_ZED_PID		0x0502
 #define UBLOX_C099F9P_ODIN_PID		0x0503
+
+/*
+ * GMC devices
+ */
+#define GMC_VID				0x1cd7
+#define GMC_Z216C_PID			0x0217 /* GMC Z216C Adapter IR-USB */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 8744d91..b5c38ab 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -616,6 +616,11 @@ static void option_instat_callback(struct urb *urb);
 /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */
 #define LUAT_PRODUCT_AIR720U			0x4e00
 
+/* MeiG Smart Technology products */
+#define MEIGSMART_VENDOR_ID			0x2dee
+/* MeiG Smart SLM320 based on UNISOC UIS8910 */
+#define MEIGSMART_PRODUCT_SLM320		0x4d41
+
 /* Device flags */
 
 /* Highest interface number which can be used with NCTRL() and RSVD() */
@@ -2284,6 +2289,7 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) },
 	{ } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/storage/isd200.c b/drivers/usb/storage/isd200.c
index 6a7720e..671104b 100644
--- a/drivers/usb/storage/isd200.c
+++ b/drivers/usb/storage/isd200.c
@@ -1117,7 +1117,7 @@ static void isd200_dump_driveid(struct us_data *us, u16 *id)
 static int isd200_get_inquiry_data( struct us_data *us )
 {
 	struct isd200_info *info = (struct isd200_info *)us->extra;
-	int retStatus = ISD200_GOOD;
+	int retStatus;
 	u16 *id = info->id;
 
 	usb_stor_dbg(us, "Entering isd200_get_inquiry_data\n");
@@ -1149,6 +1149,13 @@ static int isd200_get_inquiry_data( struct us_data *us )
 				isd200_fix_driveid(id);
 				isd200_dump_driveid(us, id);
 
+				/* Prevent division by 0 in isd200_scsi_to_ata() */
+				if (id[ATA_ID_HEADS] == 0 || id[ATA_ID_SECTORS] == 0) {
+					usb_stor_dbg(us, "   Invalid ATA Identify data\n");
+					retStatus = ISD200_ERROR;
+					goto Done;
+				}
+
 				memset(&info->InquiryData, 0, sizeof(info->InquiryData));
 
 				/* Standard IDE interface only supports disks */
@@ -1214,6 +1221,7 @@ static int isd200_get_inquiry_data( struct us_data *us )
 		}
 	}
 
+ Done:
 	usb_stor_dbg(us, "Leaving isd200_get_inquiry_data %08X\n", retStatus);
 
 	return(retStatus);
@@ -1493,22 +1501,27 @@ static int isd200_init_info(struct us_data *us)
 
 static int isd200_Initialization(struct us_data *us)
 {
+	int rc = 0;
+
 	usb_stor_dbg(us, "ISD200 Initialization...\n");
 
 	/* Initialize ISD200 info struct */
 
-	if (isd200_init_info(us) == ISD200_ERROR) {
+	if (isd200_init_info(us) < 0) {
 		usb_stor_dbg(us, "ERROR Initializing ISD200 Info struct\n");
+		rc = -ENOMEM;
 	} else {
 		/* Get device specific data */
 
-		if (isd200_get_inquiry_data(us) != ISD200_GOOD)
+		if (isd200_get_inquiry_data(us) != ISD200_GOOD) {
 			usb_stor_dbg(us, "ISD200 Initialization Failure\n");
-		else
+			rc = -EINVAL;
+		} else {
 			usb_stor_dbg(us, "ISD200 Initialization complete\n");
+		}
 	}
 
-	return 0;
+	return rc;
 }
 
 
diff --git a/drivers/vfio/platform/vfio_platform_irq.c b/drivers/vfio/platform/vfio_platform_irq.c
index 46d4750..c53a9b4 100644
--- a/drivers/vfio/platform/vfio_platform_irq.c
+++ b/drivers/vfio/platform/vfio_platform_irq.c
@@ -329,8 +329,11 @@ void vfio_platform_irq_cleanup(struct vfio_platform_device *vdev)
 {
 	int i;
 
-	for (i = 0; i < vdev->num_irqs; i++)
+	for (i = 0; i < vdev->num_irqs; i++) {
+		vfio_virqfd_disable(&vdev->irqs[i].mask);
+		vfio_virqfd_disable(&vdev->irqs[i].unmask);
 		vfio_set_trigger(vdev, i, -1, NULL);
+	}
 
 	vdev->num_irqs = 0;
 	kfree(vdev->irqs);
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index ed202f1..3450c17 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -1309,7 +1309,7 @@ int fb_get_mode(int flags, u32 val, struct fb_var_screeninfo *var, struct fb_inf
 int fb_videomode_from_videomode(const struct videomode *vm,
 				struct fb_videomode *fbmode)
 {
-	unsigned int htotal, vtotal;
+	unsigned int htotal, vtotal, total;
 
 	fbmode->xres = vm->hactive;
 	fbmode->left_margin = vm->hback_porch;
@@ -1342,8 +1342,9 @@ int fb_videomode_from_videomode(const struct videomode *vm,
 	vtotal = vm->vactive + vm->vfront_porch + vm->vback_porch +
 		 vm->vsync_len;
 	/* prevent division by zero */
-	if (htotal && vtotal) {
-		fbmode->refresh = vm->pixelclock / (htotal * vtotal);
+	total = htotal * vtotal;
+	if (total) {
+		fbmode->refresh = vm->pixelclock / total;
 	/* a mode must have htotal and vtotal != 0 or it is invalid */
 	} else {
 		fbmode->refresh = 0;
diff --git a/drivers/video/fbdev/via/accel.c b/drivers/video/fbdev/via/accel.c
index eb3615c..f542b01 100644
--- a/drivers/video/fbdev/via/accel.c
+++ b/drivers/video/fbdev/via/accel.c
@@ -129,7 +129,7 @@ static int hw_bitblt_1(void __iomem *engine, u8 op, u32 width, u32 height,
 
 	if (op != VIA_BITBLT_FILL) {
 		tmp = src_mem ? 0 : src_addr;
-		if (dst_addr & 0xE0000007) {
+		if (tmp & 0xE0000007) {
 			printk(KERN_WARNING "hw_bitblt_1: Unsupported source "
 				"address %X\n", tmp);
 			return -EINVAL;
@@ -274,7 +274,7 @@ static int hw_bitblt_2(void __iomem *engine, u8 op, u32 width, u32 height,
 		writel(tmp, engine + 0x18);
 
 		tmp = src_mem ? 0 : src_addr;
-		if (dst_addr & 0xE0000007) {
+		if (tmp & 0xE0000007) {
 			printk(KERN_WARNING "hw_bitblt_2: Unsupported source "
 				"address %X\n", tmp);
 			return -EINVAL;
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 679c6ad..ee6541d 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -364,13 +364,19 @@ EXPORT_SYMBOL_GPL(unregister_virtio_device);
 int virtio_device_freeze(struct virtio_device *dev)
 {
 	struct virtio_driver *drv = drv_to_virtio(dev->dev.driver);
+	int ret;
 
 	virtio_config_disable(dev);
 
 	dev->failed = dev->config->get_status(dev) & VIRTIO_CONFIG_S_FAILED;
 
-	if (drv && drv->freeze)
-		return drv->freeze(dev);
+	if (drv && drv->freeze) {
+		ret = drv->freeze(dev);
+		if (ret) {
+			virtio_config_enable(dev);
+			return ret;
+		}
+	}
 
 	return 0;
 }
diff --git a/fs/aio.c b/fs/aio.c
index 816f144..2f17281 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -558,8 +558,8 @@ static int aio_setup_ring(struct kioctx *ctx, unsigned int nr_events)
 
 void kiocb_set_cancel_fn(struct kiocb *iocb, kiocb_cancel_fn *cancel)
 {
-	struct aio_kiocb *req = container_of(iocb, struct aio_kiocb, common);
-	struct kioctx *ctx = req->ki_ctx;
+	struct aio_kiocb *req;
+	struct kioctx *ctx;
 	unsigned long flags;
 
 	/*
@@ -569,6 +569,9 @@ void kiocb_set_cancel_fn(struct kiocb *iocb, kiocb_cancel_fn *cancel)
 	if (!(iocb->ki_flags & IOCB_AIO_RW))
 		return;
 
+	req = container_of(iocb, struct aio_kiocb, common);
+	ctx = req->ki_ctx;
+
 	spin_lock_irqsave(&ctx->ctx_lock, flags);
 
 	if (!req->ki_list.next)
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 19a668e..dce566e 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -65,6 +65,8 @@ struct btrfs_ordered_sum;
 
 #define BTRFS_MAX_LEVEL 8
 
+#define BTRFS_OLDEST_GENERATION	0ULL
+
 #define BTRFS_COMPAT_EXTENT_TREE_V0
 
 /*
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 5909d75..74ce617 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -181,8 +181,15 @@ struct dentry *btrfs_get_parent(struct dentry *child)
 	ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
 	if (ret < 0)
 		goto fail;
+	if (ret == 0) {
+		/*
+		 * Key with offset of -1 found, there would have to exist an
+		 * inode with such number or a root with such id.
+		 */
+		ret = -EUCLEAN;
+		goto fail;
+	}
 
-	BUG_ON(ret == 0); /* Key with offset of -1 found */
 	if (path->slots[0] == 0) {
 		ret = -ENOENT;
 		goto fail;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 61ab4bc..79fd651 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2638,7 +2638,7 @@ static int btrfs_ioctl_defrag(struct file *file, void __user *argp)
 {
 	struct inode *inode = file_inode(file);
 	struct btrfs_root *root = BTRFS_I(inode)->root;
-	struct btrfs_ioctl_defrag_range_args *range;
+	struct btrfs_ioctl_defrag_range_args range = {0};
 	int ret;
 
 	ret = mnt_want_write_file(file);
@@ -2664,37 +2664,28 @@ static int btrfs_ioctl_defrag(struct file *file, void __user *argp)
 			goto out;
 		}
 
-		range = kzalloc(sizeof(*range), GFP_KERNEL);
-		if (!range) {
-			ret = -ENOMEM;
-			goto out;
-		}
-
 		if (argp) {
-			if (copy_from_user(range, argp,
-					   sizeof(*range))) {
+			if (copy_from_user(&range, argp, sizeof(range))) {
 				ret = -EFAULT;
-				kfree(range);
 				goto out;
 			}
-			if (range->flags & ~BTRFS_DEFRAG_RANGE_FLAGS_SUPP) {
+			if (range.flags & ~BTRFS_DEFRAG_RANGE_FLAGS_SUPP) {
 				ret = -EOPNOTSUPP;
 				goto out;
 			}
 			/* compression requires us to start the IO */
-			if ((range->flags & BTRFS_DEFRAG_RANGE_COMPRESS)) {
-				range->flags |= BTRFS_DEFRAG_RANGE_START_IO;
-				range->extent_thresh = (u32)-1;
+			if ((range.flags & BTRFS_DEFRAG_RANGE_COMPRESS)) {
+				range.flags |= BTRFS_DEFRAG_RANGE_START_IO;
+				range.extent_thresh = (u32)-1;
 			}
 		} else {
 			/* the rest are all set to zero by kzalloc */
-			range->len = (u64)-1;
+			range.len = (u64)-1;
 		}
 		ret = btrfs_defrag_file(file_inode(file), file,
-					range, 0, 0);
+					&range, BTRFS_OLDEST_GENERATION, 0);
 		if (ret > 0)
 			ret = 0;
-		kfree(range);
 		break;
 	default:
 		ret = -EINVAL;
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index fa9797f..b8a697f0 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -965,7 +965,15 @@ static int iterate_inode_ref(struct btrfs_root *root, struct btrfs_path *path,
 					ret = PTR_ERR(start);
 					goto out;
 				}
-				BUG_ON(start < p->buf);
+				if (unlikely(start < p->buf)) {
+					btrfs_err(root->fs_info,
+			"send: path ref buffer underflow for key (%llu %u %llu)",
+						  found_key->objectid,
+						  found_key->type,
+						  found_key->offset);
+					ret = -EINVAL;
+					goto out;
+				}
 			}
 			p->start = start;
 		} else {
diff --git a/fs/btrfs/tree-defrag.c b/fs/btrfs/tree-defrag.c
index cb65089..c09dbe4 100644
--- a/fs/btrfs/tree-defrag.c
+++ b/fs/btrfs/tree-defrag.c
@@ -39,7 +39,6 @@ int btrfs_defrag_leaves(struct btrfs_trans_handle *trans,
 	int level;
 	int next_key_ret = 0;
 	u64 last_ret = 0;
-	u64 min_trans = 0;
 
 	if (root->fs_info->extent_root == root) {
 		/*
@@ -81,7 +80,7 @@ int btrfs_defrag_leaves(struct btrfs_trans_handle *trans,
 
 	path->keep_locks = 1;
 
-	ret = btrfs_search_forward(root, &key, path, min_trans);
+	ret = btrfs_search_forward(root, &key, path, BTRFS_OLDEST_GENERATION);
 	if (ret < 0)
 		goto out;
 	if (ret > 0) {
@@ -130,7 +129,7 @@ int btrfs_defrag_leaves(struct btrfs_trans_handle *trans,
 	 */
 	path->slots[1] = btrfs_header_nritems(path->nodes[1]);
 	next_key_ret = btrfs_find_next_key(root, path, &key, 1,
-					   min_trans);
+					   BTRFS_OLDEST_GENERATION);
 	if (next_key_ret == 0) {
 		memcpy(&root->defrag_progress, &key, sizeof(key));
 		ret = -EAGAIN;
diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c
index 331f3a1..c5c56f7 100644
--- a/fs/btrfs/uuid-tree.c
+++ b/fs/btrfs/uuid-tree.c
@@ -282,7 +282,7 @@ int btrfs_uuid_tree_iterate(struct btrfs_fs_info *fs_info,
 	key.offset = 0;
 
 again_search_slot:
-	ret = btrfs_search_forward(root, &key, path, 0);
+	ret = btrfs_search_forward(root, &key, path, BTRFS_OLDEST_GENERATION);
 	if (ret) {
 		if (ret > 0)
 			ret = 0;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index e34a523..320acfa 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3001,7 +3001,17 @@ static int btrfs_relocate_sys_chunks(struct btrfs_fs_info *fs_info)
 			mutex_unlock(&fs_info->delete_unused_bgs_mutex);
 			goto error;
 		}
-		BUG_ON(ret == 0); /* Corruption */
+		if (ret == 0) {
+			/*
+			 * On the first search we would find chunk tree with
+			 * offset -1, which is not possible. On subsequent
+			 * loops this would find an existing item on an invalid
+			 * offset (one less than the previous one, wrong
+			 * alignment and size).
+			 */
+			ret = -EUCLEAN;
+			goto error;
+		}
 
 		ret = btrfs_previous_item(chunk_root, path, key.objectid,
 					  key.type);
@@ -4135,7 +4145,8 @@ static int btrfs_uuid_scan_kthread(void *data)
 	key.offset = 0;
 
 	while (1) {
-		ret = btrfs_search_forward(root, &key, path, 0);
+		ret = btrfs_search_forward(root, &key, path,
+				BTRFS_OLDEST_GENERATION);
 		if (ret) {
 			if (ret > 0)
 				ret = 0;
diff --git a/fs/exec.c b/fs/exec.c
index e279498..1fc3d19 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -831,6 +831,7 @@ int transfer_args_to_stack(struct linux_binprm *bprm,
 			goto out;
 	}
 
+	bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;
 	*sp_location = sp;
 
 out:
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 47ecf08..a887dc7 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1532,7 +1532,8 @@ static int ext4_flex_group_add(struct super_block *sb,
 		int gdb_num = group / EXT4_DESC_PER_BLOCK(sb);
 		int gdb_num_end = ((group + flex_gd->count - 1) /
 				   EXT4_DESC_PER_BLOCK(sb));
-		int meta_bg = ext4_has_feature_meta_bg(sb);
+		int meta_bg = ext4_has_feature_meta_bg(sb) &&
+			      gdb_num >= le32_to_cpu(es->s_first_meta_bg);
 		sector_t padding_blocks = meta_bg ? 0 : sbi->s_sbh->b_blocknr -
 					 ext4_group_first_block_no(sb, 0);
 		sector_t old_gdb = 0;
diff --git a/fs/fat/nfs.c b/fs/fat/nfs.c
index eb19265..f442a8d 100644
--- a/fs/fat/nfs.c
+++ b/fs/fat/nfs.c
@@ -139,6 +139,12 @@ fat_encode_fh_nostale(struct inode *inode, __u32 *fh, int *lenp,
 		fid->parent_i_gen = parent->i_generation;
 		type = FILEID_FAT_WITH_PARENT;
 		*lenp = FAT_FID_SIZE_WITH_PARENT;
+	} else {
+		/*
+		 * We need to initialize this field because the fh is actually
+		 * 12 bytes long
+		 */
+		fid->parent_i_pos_hi = 0;
 	}
 
 	return type;
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 40f54d8..07adae8 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -720,7 +720,6 @@ static inline u64 get_node_id(struct inode *inode)
 
 static inline void fuse_make_bad(struct inode *inode)
 {
-	remove_inode_hash(inode);
 	set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state);
 }
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 0323b4e..da99351 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -324,8 +324,11 @@ struct inode *fuse_iget(struct super_block *sb, u64 nodeid,
 	} else if ((inode->i_mode ^ attr->mode) & S_IFMT) {
 		/* Inode has changed type, any I/O on the old should fail */
 		fuse_make_bad(inode);
-		iput(inode);
-		goto retry;
+		if (inode != d_inode(sb->s_root)) {
+			remove_inode_hash(inode);
+			iput(inode);
+			goto retry;
+		}
 	}
 
 	fi = get_fuse_inode(inode);
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index ee3c923..0ab1789 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -910,8 +910,22 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent)
 	 * we then decide whether to use the Joliet descriptor.
 	 */
 	inode = isofs_iget(s, sbi->s_firstdatazone, 0);
-	if (IS_ERR(inode))
-		goto out_no_root;
+
+	/*
+	 * Fix for broken CDs with a corrupt root inode but a correct Joliet
+	 * root directory.
+	 */
+	if (IS_ERR(inode)) {
+		if (joliet_level && sbi->s_firstdatazone != first_data_zone) {
+			printk(KERN_NOTICE
+			       "ISOFS: root inode is unusable. "
+			       "Disabling Rock Ridge and switching to Joliet.");
+			sbi->s_rock = 0;
+			inode = NULL;
+		} else {
+			goto out_no_root;
+		}
+	}
 
 	/*
 	 * Fix for broken CDs with Rock Ridge and empty ISO root directory but
diff --git a/fs/nilfs2/alloc.c b/fs/nilfs2/alloc.c
index 095cf8b..459575a 100644
--- a/fs/nilfs2/alloc.c
+++ b/fs/nilfs2/alloc.c
@@ -623,10 +623,10 @@ void nilfs_palloc_commit_free_entry(struct inode *inode,
 	lock = nilfs_mdt_bgl_lock(inode, group);
 
 	if (!nilfs_clear_bit_atomic(lock, group_offset, bitmap))
-		nilfs_msg(inode->i_sb, KERN_WARNING,
-			  "%s (ino=%lu): entry number %llu already freed",
-			  __func__, inode->i_ino,
-			  (unsigned long long)req->pr_entry_nr);
+		nilfs_warn(inode->i_sb,
+			   "%s (ino=%lu): entry number %llu already freed",
+			   __func__, inode->i_ino,
+			   (unsigned long long)req->pr_entry_nr);
 	else
 		nilfs_palloc_group_desc_add_entries(desc, lock, 1);
 
@@ -664,10 +664,10 @@ void nilfs_palloc_abort_alloc_entry(struct inode *inode,
 	lock = nilfs_mdt_bgl_lock(inode, group);
 
 	if (!nilfs_clear_bit_atomic(lock, group_offset, bitmap))
-		nilfs_msg(inode->i_sb, KERN_WARNING,
-			  "%s (ino=%lu): entry number %llu already freed",
-			  __func__, inode->i_ino,
-			  (unsigned long long)req->pr_entry_nr);
+		nilfs_warn(inode->i_sb,
+			   "%s (ino=%lu): entry number %llu already freed",
+			   __func__, inode->i_ino,
+			   (unsigned long long)req->pr_entry_nr);
 	else
 		nilfs_palloc_group_desc_add_entries(desc, lock, 1);
 
@@ -773,10 +773,10 @@ int nilfs_palloc_freev(struct inode *inode, __u64 *entry_nrs, size_t nitems)
 		do {
 			if (!nilfs_clear_bit_atomic(lock, group_offset,
 						    bitmap)) {
-				nilfs_msg(inode->i_sb, KERN_WARNING,
-					  "%s (ino=%lu): entry number %llu already freed",
-					  __func__, inode->i_ino,
-					  (unsigned long long)entry_nrs[j]);
+				nilfs_warn(inode->i_sb,
+					   "%s (ino=%lu): entry number %llu already freed",
+					   __func__, inode->i_ino,
+					   (unsigned long long)entry_nrs[j]);
 			} else {
 				n++;
 			}
@@ -818,10 +818,10 @@ int nilfs_palloc_freev(struct inode *inode, __u64 *entry_nrs, size_t nitems)
 			ret = nilfs_palloc_delete_entry_block(inode,
 							      last_nrs[k]);
 			if (ret && ret != -ENOENT)
-				nilfs_msg(inode->i_sb, KERN_WARNING,
-					  "error %d deleting block that object (entry=%llu, ino=%lu) belongs to",
-					  ret, (unsigned long long)last_nrs[k],
-					  inode->i_ino);
+				nilfs_warn(inode->i_sb,
+					   "error %d deleting block that object (entry=%llu, ino=%lu) belongs to",
+					   ret, (unsigned long long)last_nrs[k],
+					   inode->i_ino);
 		}
 
 		desc_kaddr = kmap_atomic(desc_bh->b_page);
@@ -836,9 +836,9 @@ int nilfs_palloc_freev(struct inode *inode, __u64 *entry_nrs, size_t nitems)
 		if (nfree == nilfs_palloc_entries_per_group(inode)) {
 			ret = nilfs_palloc_delete_bitmap_block(inode, group);
 			if (ret && ret != -ENOENT)
-				nilfs_msg(inode->i_sb, KERN_WARNING,
-					  "error %d deleting bitmap block of group=%lu, ino=%lu",
-					  ret, group, inode->i_ino);
+				nilfs_warn(inode->i_sb,
+					   "error %d deleting bitmap block of group=%lu, ino=%lu",
+					   ret, group, inode->i_ino);
 		}
 	}
 	return 0;
diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index 3da6201..920d202 100644
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -361,10 +361,10 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node,
 		     (flags & NILFS_BTREE_NODE_ROOT) ||
 		     nchildren < 0 ||
 		     nchildren > NILFS_BTREE_NODE_NCHILDREN_MAX(size))) {
-		nilfs_msg(inode->i_sb, KERN_CRIT,
-			  "bad btree node (ino=%lu, blocknr=%llu): level = %d, flags = 0x%x, nchildren = %d",
-			  inode->i_ino, (unsigned long long)blocknr, level,
-			  flags, nchildren);
+		nilfs_crit(inode->i_sb,
+			   "bad btree node (ino=%lu, blocknr=%llu): level = %d, flags = 0x%x, nchildren = %d",
+			   inode->i_ino, (unsigned long long)blocknr, level,
+			   flags, nchildren);
 		ret = 1;
 	}
 	return ret;
@@ -391,9 +391,9 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
 		     level >= NILFS_BTREE_LEVEL_MAX ||
 		     nchildren < 0 ||
 		     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
-		nilfs_msg(inode->i_sb, KERN_CRIT,
-			  "bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d",
-			  inode->i_ino, level, flags, nchildren);
+		nilfs_crit(inode->i_sb,
+			   "bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d",
+			   inode->i_ino, level, flags, nchildren);
 		ret = 1;
 	}
 	return ret;
@@ -460,10 +460,10 @@ static int nilfs_btree_bad_node(const struct nilfs_bmap *btree,
 {
 	if (unlikely(nilfs_btree_node_get_level(node) != level)) {
 		dump_stack();
-		nilfs_msg(btree->b_inode->i_sb, KERN_CRIT,
-			  "btree level mismatch (ino=%lu): %d != %d",
-			  btree->b_inode->i_ino,
-			  nilfs_btree_node_get_level(node), level);
+		nilfs_crit(btree->b_inode->i_sb,
+			   "btree level mismatch (ino=%lu): %d != %d",
+			   btree->b_inode->i_ino,
+			   nilfs_btree_node_get_level(node), level);
 		return 1;
 	}
 	return 0;
@@ -528,7 +528,7 @@ static int __nilfs_btree_get_block(const struct nilfs_bmap *btree, __u64 ptr,
 
  out_no_wait:
 	if (!buffer_uptodate(bh)) {
-		nilfs_msg(btree->b_inode->i_sb, KERN_ERR,
+		nilfs_err(btree->b_inode->i_sb,
 			  "I/O error reading b-tree node block (ino=%lu, blocknr=%llu)",
 			  btree->b_inode->i_ino, (unsigned long long)ptr);
 		brelse(bh);
@@ -733,7 +733,7 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree,
 		dat = nilfs_bmap_get_dat(btree);
 		ret = nilfs_dat_translate(dat, ptr, &blocknr);
 		if (ret < 0)
-			goto out;
+			goto dat_error;
 		ptr = blocknr;
 	}
 	cnt = 1;
@@ -752,7 +752,7 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree,
 			if (dat) {
 				ret = nilfs_dat_translate(dat, ptr2, &blocknr);
 				if (ret < 0)
-					goto out;
+					goto dat_error;
 				ptr2 = blocknr;
 			}
 			if (ptr2 != ptr + cnt || ++cnt == maxblocks)
@@ -791,6 +791,11 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree,
  out:
 	nilfs_btree_free_path(path);
 	return ret;
+
+ dat_error:
+	if (ret == -ENOENT)
+		ret = -EINVAL;  /* Notify bmap layer of metadata corruption */
+	goto out;
 }
 
 static void nilfs_btree_promote_key(struct nilfs_bmap *btree,
@@ -2098,10 +2103,10 @@ static int nilfs_btree_propagate(struct nilfs_bmap *btree,
 	ret = nilfs_btree_do_lookup(btree, path, key, NULL, level + 1, 0);
 	if (ret < 0) {
 		if (unlikely(ret == -ENOENT))
-			nilfs_msg(btree->b_inode->i_sb, KERN_CRIT,
-				  "writing node/leaf block does not appear in b-tree (ino=%lu) at key=%llu, level=%d",
-				  btree->b_inode->i_ino,
-				  (unsigned long long)key, level);
+			nilfs_crit(btree->b_inode->i_sb,
+				   "writing node/leaf block does not appear in b-tree (ino=%lu) at key=%llu, level=%d",
+				   btree->b_inode->i_ino,
+				   (unsigned long long)key, level);
 		goto out;
 	}
 
@@ -2138,11 +2143,11 @@ static void nilfs_btree_add_dirty_buffer(struct nilfs_bmap *btree,
 	if (level < NILFS_BTREE_LEVEL_NODE_MIN ||
 	    level >= NILFS_BTREE_LEVEL_MAX) {
 		dump_stack();
-		nilfs_msg(btree->b_inode->i_sb, KERN_WARNING,
-			  "invalid btree level: %d (key=%llu, ino=%lu, blocknr=%llu)",
-			  level, (unsigned long long)key,
-			  btree->b_inode->i_ino,
-			  (unsigned long long)bh->b_blocknr);
+		nilfs_warn(btree->b_inode->i_sb,
+			   "invalid btree level: %d (key=%llu, ino=%lu, blocknr=%llu)",
+			   level, (unsigned long long)key,
+			   btree->b_inode->i_ino,
+			   (unsigned long long)bh->b_blocknr);
 		return;
 	}
 
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index a15a160..0087336 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -331,7 +331,7 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
 	int ret, ncps, nicps, nss, count, i;
 
 	if (unlikely(start == 0 || start > end)) {
-		nilfs_msg(cpfile->i_sb, KERN_ERR,
+		nilfs_err(cpfile->i_sb,
 			  "cannot delete checkpoints: invalid range [%llu, %llu)",
 			  (unsigned long long)start, (unsigned long long)end);
 		return -EINVAL;
@@ -385,7 +385,7 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
 								   cpfile, cno);
 					if (ret == 0)
 						continue;
-					nilfs_msg(cpfile->i_sb, KERN_ERR,
+					nilfs_err(cpfile->i_sb,
 						  "error %d deleting checkpoint block",
 						  ret);
 					break;
@@ -990,12 +990,10 @@ int nilfs_cpfile_read(struct super_block *sb, size_t cpsize,
 	int err;
 
 	if (cpsize > sb->s_blocksize) {
-		nilfs_msg(sb, KERN_ERR,
-			  "too large checkpoint size: %zu bytes", cpsize);
+		nilfs_err(sb, "too large checkpoint size: %zu bytes", cpsize);
 		return -EINVAL;
 	} else if (cpsize < NILFS_MIN_CHECKPOINT_SIZE) {
-		nilfs_msg(sb, KERN_ERR,
-			  "too small checkpoint size: %zu bytes", cpsize);
+		nilfs_err(sb, "too small checkpoint size: %zu bytes", cpsize);
 		return -EINVAL;
 	}
 
diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
index 63bd200..d2d1927 100644
--- a/fs/nilfs2/dat.c
+++ b/fs/nilfs2/dat.c
@@ -363,11 +363,11 @@ int nilfs_dat_move(struct inode *dat, __u64 vblocknr, sector_t blocknr)
 	kaddr = kmap_atomic(entry_bh->b_page);
 	entry = nilfs_palloc_block_get_entry(dat, vblocknr, entry_bh, kaddr);
 	if (unlikely(entry->de_blocknr == cpu_to_le64(0))) {
-		nilfs_msg(dat->i_sb, KERN_CRIT,
-			  "%s: invalid vblocknr = %llu, [%llu, %llu)",
-			  __func__, (unsigned long long)vblocknr,
-			  (unsigned long long)le64_to_cpu(entry->de_start),
-			  (unsigned long long)le64_to_cpu(entry->de_end));
+		nilfs_crit(dat->i_sb,
+			   "%s: invalid vblocknr = %llu, [%llu, %llu)",
+			   __func__, (unsigned long long)vblocknr,
+			   (unsigned long long)le64_to_cpu(entry->de_start),
+			   (unsigned long long)le64_to_cpu(entry->de_end));
 		kunmap_atomic(kaddr);
 		brelse(entry_bh);
 		return -EINVAL;
@@ -494,11 +494,11 @@ int nilfs_dat_read(struct super_block *sb, size_t entry_size,
 	int err;
 
 	if (entry_size > sb->s_blocksize) {
-		nilfs_msg(sb, KERN_ERR, "too large DAT entry size: %zu bytes",
+		nilfs_err(sb, "too large DAT entry size: %zu bytes",
 			  entry_size);
 		return -EINVAL;
 	} else if (entry_size < NILFS_MIN_DAT_ENTRY_SIZE) {
-		nilfs_msg(sb, KERN_ERR, "too small DAT entry size: %zu bytes",
+		nilfs_err(sb, "too small DAT entry size: %zu bytes",
 			  entry_size);
 		return -EINVAL;
 	}
diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
index 96e3ed0..93aa648 100644
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -75,7 +75,7 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct,
 		dat = nilfs_bmap_get_dat(direct);
 		ret = nilfs_dat_translate(dat, ptr, &blocknr);
 		if (ret < 0)
-			return ret;
+			goto dat_error;
 		ptr = blocknr;
 	}
 
@@ -88,7 +88,7 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct,
 		if (dat) {
 			ret = nilfs_dat_translate(dat, ptr2, &blocknr);
 			if (ret < 0)
-				return ret;
+				goto dat_error;
 			ptr2 = blocknr;
 		}
 		if (ptr2 != ptr + cnt)
@@ -96,6 +96,11 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct,
 	}
 	*ptrp = ptr;
 	return cnt;
+
+ dat_error:
+	if (ret == -ENOENT)
+		ret = -EINVAL;  /* Notify bmap layer of metadata corruption */
+	return ret;
 }
 
 static __u64
@@ -337,16 +342,18 @@ static int nilfs_direct_assign(struct nilfs_bmap *bmap,
 
 	key = nilfs_bmap_data_get_key(bmap, *bh);
 	if (unlikely(key > NILFS_DIRECT_KEY_MAX)) {
-		nilfs_msg(bmap->b_inode->i_sb, KERN_CRIT,
-			  "%s (ino=%lu): invalid key: %llu", __func__,
-			  bmap->b_inode->i_ino, (unsigned long long)key);
+		nilfs_crit(bmap->b_inode->i_sb,
+			   "%s (ino=%lu): invalid key: %llu",
+			   __func__,
+			   bmap->b_inode->i_ino, (unsigned long long)key);
 		return -EINVAL;
 	}
 	ptr = nilfs_direct_get_ptr(bmap, key);
 	if (unlikely(ptr == NILFS_BMAP_INVALID_PTR)) {
-		nilfs_msg(bmap->b_inode->i_sb, KERN_CRIT,
-			  "%s (ino=%lu): invalid pointer: %llu", __func__,
-			  bmap->b_inode->i_ino, (unsigned long long)ptr);
+		nilfs_crit(bmap->b_inode->i_sb,
+			   "%s (ino=%lu): invalid pointer: %llu",
+			   __func__,
+			   bmap->b_inode->i_ino, (unsigned long long)ptr);
 		return -EINVAL;
 	}
 
diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c
index d8c0a9d..3ba2cc4 100644
--- a/fs/nilfs2/gcinode.c
+++ b/fs/nilfs2/gcinode.c
@@ -152,7 +152,7 @@ int nilfs_gccache_wait_and_mark_dirty(struct buffer_head *bh)
 	if (!buffer_uptodate(bh)) {
 		struct inode *inode = bh->b_page->mapping->host;
 
-		nilfs_msg(inode->i_sb, KERN_ERR,
+		nilfs_err(inode->i_sb,
 			  "I/O error reading %s block for GC (ino=%lu, vblocknr=%llu)",
 			  buffer_nilfs_node(bh) ? "node" : "data",
 			  inode->i_ino, (unsigned long long)bh->b_blocknr);
diff --git a/fs/nilfs2/ifile.c b/fs/nilfs2/ifile.c
index b8fa45c..7efaac7 100644
--- a/fs/nilfs2/ifile.c
+++ b/fs/nilfs2/ifile.c
@@ -151,8 +151,8 @@ int nilfs_ifile_get_inode_block(struct inode *ifile, ino_t ino,
 
 	err = nilfs_palloc_get_entry_block(ifile, ino, 0, out_bh);
 	if (unlikely(err))
-		nilfs_msg(sb, KERN_WARNING, "error %d reading inode: ino=%lu",
-			  err, (unsigned long)ino);
+		nilfs_warn(sb, "error %d reading inode: ino=%lu",
+			   err, (unsigned long)ino);
 	return err;
 }
 
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 7fe5b55..2789d83 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -116,11 +116,11 @@ int nilfs_get_block(struct inode *inode, sector_t blkoff,
 				 * However, the page having this block must
 				 * be locked in this case.
 				 */
-				nilfs_msg(inode->i_sb, KERN_WARNING,
-					  "%s (ino=%lu): a race condition while inserting a data block at offset=%llu",
-					  __func__, inode->i_ino,
-					  (unsigned long long)blkoff);
-				err = 0;
+				nilfs_warn(inode->i_sb,
+					   "%s (ino=%lu): a race condition while inserting a data block at offset=%llu",
+					   __func__, inode->i_ino,
+					   (unsigned long long)blkoff);
+				err = -EAGAIN;
 			}
 			nilfs_transaction_abort(inode->i_sb);
 			goto out;
@@ -871,9 +871,8 @@ static void nilfs_truncate_bmap(struct nilfs_inode_info *ii,
 		goto repeat;
 
 failed:
-	nilfs_msg(ii->vfs_inode.i_sb, KERN_WARNING,
-		  "error %d truncating bmap (ino=%lu)", ret,
-		  ii->vfs_inode.i_ino);
+	nilfs_warn(ii->vfs_inode.i_sb, "error %d truncating bmap (ino=%lu)",
+		   ret, ii->vfs_inode.i_ino);
 }
 
 void nilfs_truncate(struct inode *inode)
@@ -1106,9 +1105,9 @@ int nilfs_set_file_dirty(struct inode *inode, unsigned int nr_dirty)
 			 * This will happen when somebody is freeing
 			 * this inode.
 			 */
-			nilfs_msg(inode->i_sb, KERN_WARNING,
-				  "cannot set file dirty (ino=%lu): the file is being freed",
-				  inode->i_ino);
+			nilfs_warn(inode->i_sb,
+				   "cannot set file dirty (ino=%lu): the file is being freed",
+				   inode->i_ino);
 			spin_unlock(&nilfs->ns_inode_lock);
 			return -EINVAL; /*
 					 * NILFS_I_DIRTY may remain for
@@ -1137,9 +1136,9 @@ int __nilfs_mark_inode_dirty(struct inode *inode, int flags)
 
 	err = nilfs_load_inode_block(inode, &ibh);
 	if (unlikely(err)) {
-		nilfs_msg(inode->i_sb, KERN_WARNING,
-			  "cannot mark inode dirty (ino=%lu): error %d loading inode block",
-			  inode->i_ino, err);
+		nilfs_warn(inode->i_sb,
+			   "cannot mark inode dirty (ino=%lu): error %d loading inode block",
+			   inode->i_ino, err);
 		return err;
 	}
 	nilfs_update_inode(inode, ibh, flags);
@@ -1165,8 +1164,8 @@ void nilfs_dirty_inode(struct inode *inode, int flags)
 	struct nilfs_mdt_info *mdi = NILFS_MDT(inode);
 
 	if (is_bad_inode(inode)) {
-		nilfs_msg(inode->i_sb, KERN_WARNING,
-			  "tried to mark bad_inode dirty. ignored.");
+		nilfs_warn(inode->i_sb,
+			   "tried to mark bad_inode dirty. ignored.");
 		dump_stack();
 		return;
 	}
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index fe420bc..1d63a29 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -583,25 +583,25 @@ static int nilfs_ioctl_move_inode_block(struct inode *inode,
 
 	if (unlikely(ret < 0)) {
 		if (ret == -ENOENT)
-			nilfs_msg(inode->i_sb, KERN_CRIT,
-				  "%s: invalid virtual block address (%s): ino=%llu, cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu",
-				  __func__, vdesc->vd_flags ? "node" : "data",
-				  (unsigned long long)vdesc->vd_ino,
-				  (unsigned long long)vdesc->vd_cno,
-				  (unsigned long long)vdesc->vd_offset,
-				  (unsigned long long)vdesc->vd_blocknr,
-				  (unsigned long long)vdesc->vd_vblocknr);
+			nilfs_crit(inode->i_sb,
+				   "%s: invalid virtual block address (%s): ino=%llu, cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu",
+				   __func__, vdesc->vd_flags ? "node" : "data",
+				   (unsigned long long)vdesc->vd_ino,
+				   (unsigned long long)vdesc->vd_cno,
+				   (unsigned long long)vdesc->vd_offset,
+				   (unsigned long long)vdesc->vd_blocknr,
+				   (unsigned long long)vdesc->vd_vblocknr);
 		return ret;
 	}
 	if (unlikely(!list_empty(&bh->b_assoc_buffers))) {
-		nilfs_msg(inode->i_sb, KERN_CRIT,
-			  "%s: conflicting %s buffer: ino=%llu, cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu",
-			  __func__, vdesc->vd_flags ? "node" : "data",
-			  (unsigned long long)vdesc->vd_ino,
-			  (unsigned long long)vdesc->vd_cno,
-			  (unsigned long long)vdesc->vd_offset,
-			  (unsigned long long)vdesc->vd_blocknr,
-			  (unsigned long long)vdesc->vd_vblocknr);
+		nilfs_crit(inode->i_sb,
+			   "%s: conflicting %s buffer: ino=%llu, cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu",
+			   __func__, vdesc->vd_flags ? "node" : "data",
+			   (unsigned long long)vdesc->vd_ino,
+			   (unsigned long long)vdesc->vd_cno,
+			   (unsigned long long)vdesc->vd_offset,
+			   (unsigned long long)vdesc->vd_blocknr,
+			   (unsigned long long)vdesc->vd_vblocknr);
 		brelse(bh);
 		return -EEXIST;
 	}
@@ -851,8 +851,7 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
 	return 0;
 
  failed:
-	nilfs_msg(nilfs->ns_sb, KERN_ERR, "error %d preparing GC: %s", ret,
-		  msg);
+	nilfs_err(nilfs->ns_sb, "error %d preparing GC: %s", ret, msg);
 	return ret;
 }
 
@@ -961,7 +960,7 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
 
 	ret = nilfs_ioctl_move_blocks(inode->i_sb, &argv[0], kbufs[0]);
 	if (ret < 0) {
-		nilfs_msg(inode->i_sb, KERN_ERR,
+		nilfs_err(inode->i_sb,
 			  "error %d preparing GC: cannot read source blocks",
 			  ret);
 	} else {
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index 52763f8..5071279 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -208,7 +208,7 @@ static int nilfs_mdt_read_block(struct inode *inode, unsigned long block,
  out_no_wait:
 	err = -EIO;
 	if (!buffer_uptodate(first_bh)) {
-		nilfs_msg(inode->i_sb, KERN_ERR,
+		nilfs_err(inode->i_sb,
 			  "I/O error reading meta-data file (ino=%lu, block-offset=%lu)",
 			  inode->i_ino, block);
 		goto failed_bh;
diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c
index 1ba4719..a2a44bc 100644
--- a/fs/nilfs2/namei.c
+++ b/fs/nilfs2/namei.c
@@ -281,9 +281,9 @@ static int nilfs_do_unlink(struct inode *dir, struct dentry *dentry)
 		goto out;
 
 	if (!inode->i_nlink) {
-		nilfs_msg(inode->i_sb, KERN_WARNING,
-			  "deleting nonexistent file (ino=%lu), %d",
-			  inode->i_ino, inode->i_nlink);
+		nilfs_warn(inode->i_sb,
+			   "deleting nonexistent file (ino=%lu), %d",
+			   inode->i_ino, inode->i_nlink);
 		set_nlink(inode, 1);
 	}
 	err = nilfs_delete_entry(de, page);
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index f9798f1..c68eb8d 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -330,6 +330,15 @@ void __nilfs_error(struct super_block *sb, const char *function,
 
 #endif /* CONFIG_PRINTK */
 
+#define nilfs_crit(sb, fmt, ...)					\
+	nilfs_msg(sb, KERN_CRIT, fmt, ##__VA_ARGS__)
+#define nilfs_err(sb, fmt, ...)						\
+	nilfs_msg(sb, KERN_ERR, fmt, ##__VA_ARGS__)
+#define nilfs_warn(sb, fmt, ...)					\
+	nilfs_msg(sb, KERN_WARNING, fmt, ##__VA_ARGS__)
+#define nilfs_info(sb, fmt, ...)					\
+	nilfs_msg(sb, KERN_INFO, fmt, ##__VA_ARGS__)
+
 extern struct nilfs_super_block *
 nilfs_read_super_block(struct super_block *, u64, int, struct buffer_head **);
 extern int nilfs_store_magic_and_option(struct super_block *,
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 6abaa56..cd3a859 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -410,9 +410,8 @@ void nilfs_clear_dirty_page(struct page *page, bool silent)
 	BUG_ON(!PageLocked(page));
 
 	if (!silent)
-		nilfs_msg(sb, KERN_WARNING,
-			  "discard dirty page: offset=%lld, ino=%lu",
-			  page_offset(page), inode->i_ino);
+		nilfs_warn(sb, "discard dirty page: offset=%lld, ino=%lu",
+			   page_offset(page), inode->i_ino);
 
 	ClearPageUptodate(page);
 	ClearPageMappedToDisk(page);
@@ -428,9 +427,9 @@ void nilfs_clear_dirty_page(struct page *page, bool silent)
 		do {
 			lock_buffer(bh);
 			if (!silent)
-				nilfs_msg(sb, KERN_WARNING,
-					  "discard dirty block: blocknr=%llu, size=%zu",
-					  (u64)bh->b_blocknr, bh->b_size);
+				nilfs_warn(sb,
+					   "discard dirty block: blocknr=%llu, size=%zu",
+					   (u64)bh->b_blocknr, bh->b_size);
 
 			set_mask_bits(&bh->b_state, clear_bits, 0);
 			unlock_buffer(bh);
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index cff5973..38de7da 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -60,7 +60,7 @@ static int nilfs_warn_segment_error(struct super_block *sb, int err)
 
 	switch (err) {
 	case NILFS_SEG_FAIL_IO:
-		nilfs_msg(sb, KERN_ERR, "I/O error reading segment");
+		nilfs_err(sb, "I/O error reading segment");
 		return -EIO;
 	case NILFS_SEG_FAIL_MAGIC:
 		msg = "Magic number mismatch";
@@ -81,10 +81,10 @@ static int nilfs_warn_segment_error(struct super_block *sb, int err)
 		msg = "No super root in the last segment";
 		break;
 	default:
-		nilfs_msg(sb, KERN_ERR, "unrecognized segment error %d", err);
+		nilfs_err(sb, "unrecognized segment error %d", err);
 		return -EINVAL;
 	}
-	nilfs_msg(sb, KERN_WARNING, "invalid segment: %s", msg);
+	nilfs_warn(sb, "invalid segment: %s", msg);
 	return -EINVAL;
 }
 
@@ -553,10 +553,10 @@ static int nilfs_recover_dsync_blocks(struct the_nilfs *nilfs,
 		put_page(page);
 
  failed_inode:
-		nilfs_msg(sb, KERN_WARNING,
-			  "error %d recovering data block (ino=%lu, block-offset=%llu)",
-			  err, (unsigned long)rb->ino,
-			  (unsigned long long)rb->blkoff);
+		nilfs_warn(sb,
+			   "error %d recovering data block (ino=%lu, block-offset=%llu)",
+			   err, (unsigned long)rb->ino,
+			   (unsigned long long)rb->blkoff);
 		if (!err2)
 			err2 = err;
  next:
@@ -679,8 +679,7 @@ static int nilfs_do_roll_forward(struct the_nilfs *nilfs,
 	}
 
 	if (nsalvaged_blocks) {
-		nilfs_msg(sb, KERN_INFO, "salvaged %lu blocks",
-			  nsalvaged_blocks);
+		nilfs_info(sb, "salvaged %lu blocks", nsalvaged_blocks);
 		ri->ri_need_recovery = NILFS_RECOVERY_ROLLFORWARD_DONE;
 	}
  out:
@@ -691,7 +690,7 @@ static int nilfs_do_roll_forward(struct the_nilfs *nilfs,
  confused:
 	err = -EINVAL;
  failed:
-	nilfs_msg(sb, KERN_ERR,
+	nilfs_err(sb,
 		  "error %d roll-forwarding partial segment at blocknr = %llu",
 		  err, (unsigned long long)pseg_start);
 	goto out;
@@ -713,8 +712,8 @@ static void nilfs_finish_roll_forward(struct the_nilfs *nilfs,
 	set_buffer_dirty(bh);
 	err = sync_dirty_buffer(bh);
 	if (unlikely(err))
-		nilfs_msg(nilfs->ns_sb, KERN_WARNING,
-			  "buffer sync write failed during post-cleaning of recovery.");
+		nilfs_warn(nilfs->ns_sb,
+			   "buffer sync write failed during post-cleaning of recovery.");
 	brelse(bh);
 }
 
@@ -749,8 +748,7 @@ int nilfs_salvage_orphan_logs(struct the_nilfs *nilfs,
 
 	err = nilfs_attach_checkpoint(sb, ri->ri_cno, true, &root);
 	if (unlikely(err)) {
-		nilfs_msg(sb, KERN_ERR,
-			  "error %d loading the latest checkpoint", err);
+		nilfs_err(sb, "error %d loading the latest checkpoint", err);
 		return err;
 	}
 
@@ -761,8 +759,7 @@ int nilfs_salvage_orphan_logs(struct the_nilfs *nilfs,
 	if (ri->ri_need_recovery == NILFS_RECOVERY_ROLLFORWARD_DONE) {
 		err = nilfs_prepare_segment_for_recovery(nilfs, sb, ri);
 		if (unlikely(err)) {
-			nilfs_msg(sb, KERN_ERR,
-				  "error %d preparing segment for recovery",
+			nilfs_err(sb, "error %d preparing segment for recovery",
 				  err);
 			goto failed;
 		}
@@ -776,8 +773,7 @@ int nilfs_salvage_orphan_logs(struct the_nilfs *nilfs,
 		nilfs_detach_log_writer(sb);
 
 		if (unlikely(err)) {
-			nilfs_msg(sb, KERN_ERR,
-				  "error %d writing segment for recovery",
+			nilfs_err(sb, "error %d writing segment for recovery",
 				  err);
 			goto failed;
 		}
diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
index 4d10870..31c8250 100644
--- a/fs/nilfs2/segbuf.c
+++ b/fs/nilfs2/segbuf.c
@@ -520,7 +520,7 @@ static int nilfs_segbuf_wait(struct nilfs_segment_buffer *segbuf)
 	} while (--segbuf->sb_nbio > 0);
 
 	if (unlikely(atomic_read(&segbuf->sb_err) > 0)) {
-		nilfs_msg(segbuf->sb_super, KERN_ERR,
+		nilfs_err(segbuf->sb_super,
 			  "I/O error writing log (start-blocknr=%llu, block-count=%lu) in segment %llu",
 			  (unsigned long long)segbuf->sb_pseg_start,
 			  segbuf->sb_sum.nblocks,
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index d918b9d..fc6175b 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -167,7 +167,7 @@ static int nilfs_prepare_segment_lock(struct super_block *sb,
 		 * it is saved and will be restored on
 		 * nilfs_transaction_commit().
 		 */
-		nilfs_msg(sb, KERN_WARNING, "journal info from a different FS");
+		nilfs_warn(sb, "journal info from a different FS");
 		save = current->journal_info;
 	}
 	if (!ti) {
@@ -1992,9 +1992,9 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci,
 			err = nilfs_ifile_get_inode_block(
 				ifile, ii->vfs_inode.i_ino, &ibh);
 			if (unlikely(err)) {
-				nilfs_msg(sci->sc_super, KERN_WARNING,
-					  "log writer: error %d getting inode block (ino=%lu)",
-					  err, ii->vfs_inode.i_ino);
+				nilfs_warn(sci->sc_super,
+					   "log writer: error %d getting inode block (ino=%lu)",
+					   err, ii->vfs_inode.i_ino);
 				return err;
 			}
 			spin_lock(&nilfs->ns_inode_lock);
@@ -2504,7 +2504,7 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
 		if (likely(!err))
 			break;
 
-		nilfs_msg(sb, KERN_WARNING, "error %d cleaning segments", err);
+		nilfs_warn(sb, "error %d cleaning segments", err);
 		set_current_state(TASK_INTERRUPTIBLE);
 		schedule_timeout(sci->sc_interval);
 	}
@@ -2512,9 +2512,9 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
 		int ret = nilfs_discard_segments(nilfs, sci->sc_freesegs,
 						 sci->sc_nfreesegs);
 		if (ret) {
-			nilfs_msg(sb, KERN_WARNING,
-				  "error %d on discard request, turning discards off for the device",
-				  ret);
+			nilfs_warn(sb,
+				   "error %d on discard request, turning discards off for the device",
+				   ret);
 			nilfs_clear_opt(nilfs, DISCARD);
 		}
 	}
@@ -2596,9 +2596,9 @@ static int nilfs_segctor_thread(void *arg)
 	/* start sync. */
 	sci->sc_task = current;
 	wake_up(&sci->sc_wait_task); /* for nilfs_segctor_start_thread() */
-	nilfs_msg(sci->sc_super, KERN_INFO,
-		  "segctord starting. Construction interval = %lu seconds, CP frequency < %lu seconds",
-		  sci->sc_interval / HZ, sci->sc_mjcp_freq / HZ);
+	nilfs_info(sci->sc_super,
+		   "segctord starting. Construction interval = %lu seconds, CP frequency < %lu seconds",
+		   sci->sc_interval / HZ, sci->sc_mjcp_freq / HZ);
 
 	spin_lock(&sci->sc_state_lock);
  loop:
@@ -2671,8 +2671,8 @@ static int nilfs_segctor_start_thread(struct nilfs_sc_info *sci)
 	if (IS_ERR(t)) {
 		int err = PTR_ERR(t);
 
-		nilfs_msg(sci->sc_super, KERN_ERR,
-			  "error %d creating segctord thread", err);
+		nilfs_err(sci->sc_super, "error %d creating segctord thread",
+			  err);
 		return err;
 	}
 	wait_event(sci->sc_wait_task, sci->sc_task != NULL);
@@ -2782,14 +2782,14 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
 		nilfs_segctor_write_out(sci);
 
 	if (!list_empty(&sci->sc_dirty_files)) {
-		nilfs_msg(sci->sc_super, KERN_WARNING,
-			  "disposed unprocessed dirty file(s) when stopping log writer");
+		nilfs_warn(sci->sc_super,
+			   "disposed unprocessed dirty file(s) when stopping log writer");
 		nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1);
 	}
 
 	if (!list_empty(&sci->sc_iput_queue)) {
-		nilfs_msg(sci->sc_super, KERN_WARNING,
-			  "disposed unprocessed inode(s) in iput queue when stopping log writer");
+		nilfs_warn(sci->sc_super,
+			   "disposed unprocessed inode(s) in iput queue when stopping log writer");
 		nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1);
 	}
 
@@ -2868,8 +2868,8 @@ void nilfs_detach_log_writer(struct super_block *sb)
 	spin_lock(&nilfs->ns_inode_lock);
 	if (!list_empty(&nilfs->ns_dirty_files)) {
 		list_splice_init(&nilfs->ns_dirty_files, &garbage_list);
-		nilfs_msg(sb, KERN_WARNING,
-			  "disposed unprocessed dirty file(s) when detaching log writer");
+		nilfs_warn(sb,
+			   "disposed unprocessed dirty file(s) when detaching log writer");
 	}
 	spin_unlock(&nilfs->ns_inode_lock);
 	up_write(&nilfs->ns_segctor_sem);
diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
index 317e728..0f0b68b 100644
--- a/fs/nilfs2/sufile.c
+++ b/fs/nilfs2/sufile.c
@@ -180,9 +180,9 @@ int nilfs_sufile_updatev(struct inode *sufile, __u64 *segnumv, size_t nsegs,
 	down_write(&NILFS_MDT(sufile)->mi_sem);
 	for (seg = segnumv; seg < segnumv + nsegs; seg++) {
 		if (unlikely(*seg >= nilfs_sufile_get_nsegments(sufile))) {
-			nilfs_msg(sufile->i_sb, KERN_WARNING,
-				  "%s: invalid segment number: %llu",
-				  __func__, (unsigned long long)*seg);
+			nilfs_warn(sufile->i_sb,
+				   "%s: invalid segment number: %llu",
+				   __func__, (unsigned long long)*seg);
 			nerr++;
 		}
 	}
@@ -239,9 +239,8 @@ int nilfs_sufile_update(struct inode *sufile, __u64 segnum, int create,
 	int ret;
 
 	if (unlikely(segnum >= nilfs_sufile_get_nsegments(sufile))) {
-		nilfs_msg(sufile->i_sb, KERN_WARNING,
-			  "%s: invalid segment number: %llu",
-			  __func__, (unsigned long long)segnum);
+		nilfs_warn(sufile->i_sb, "%s: invalid segment number: %llu",
+			   __func__, (unsigned long long)segnum);
 		return -EINVAL;
 	}
 	down_write(&NILFS_MDT(sufile)->mi_sem);
@@ -419,9 +418,8 @@ void nilfs_sufile_do_cancel_free(struct inode *sufile, __u64 segnum,
 	kaddr = kmap_atomic(su_bh->b_page);
 	su = nilfs_sufile_block_get_segment_usage(sufile, segnum, su_bh, kaddr);
 	if (unlikely(!nilfs_segment_usage_clean(su))) {
-		nilfs_msg(sufile->i_sb, KERN_WARNING,
-			  "%s: segment %llu must be clean", __func__,
-			  (unsigned long long)segnum);
+		nilfs_warn(sufile->i_sb, "%s: segment %llu must be clean",
+			   __func__, (unsigned long long)segnum);
 		kunmap_atomic(kaddr);
 		return;
 	}
@@ -477,9 +475,8 @@ void nilfs_sufile_do_free(struct inode *sufile, __u64 segnum,
 	kaddr = kmap_atomic(su_bh->b_page);
 	su = nilfs_sufile_block_get_segment_usage(sufile, segnum, su_bh, kaddr);
 	if (nilfs_segment_usage_clean(su)) {
-		nilfs_msg(sufile->i_sb, KERN_WARNING,
-			  "%s: segment %llu is already clean",
-			  __func__, (unsigned long long)segnum);
+		nilfs_warn(sufile->i_sb, "%s: segment %llu is already clean",
+			   __func__, (unsigned long long)segnum);
 		kunmap_atomic(kaddr);
 		return;
 	}
@@ -1222,12 +1219,12 @@ int nilfs_sufile_read(struct super_block *sb, size_t susize,
 	int err;
 
 	if (susize > sb->s_blocksize) {
-		nilfs_msg(sb, KERN_ERR,
-			  "too large segment usage size: %zu bytes", susize);
+		nilfs_err(sb, "too large segment usage size: %zu bytes",
+			  susize);
 		return -EINVAL;
 	} else if (susize < NILFS_MIN_SEGMENT_USAGE_SIZE) {
-		nilfs_msg(sb, KERN_ERR,
-			  "too small segment usage size: %zu bytes", susize);
+		nilfs_err(sb, "too small segment usage size: %zu bytes",
+			  susize);
 		return -EINVAL;
 	}
 
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index e21a4f9..c2244cf 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -115,7 +115,7 @@ static void nilfs_set_error(struct super_block *sb)
  *
  * This implements the body of nilfs_error() macro.  Normally,
  * nilfs_error() should be used.  As for sustainable errors such as a
- * single-shot I/O error, nilfs_msg() should be used instead.
+ * single-shot I/O error, nilfs_err() should be used instead.
  *
  * Callers should not add a trailing newline since this will do it.
  */
@@ -196,8 +196,7 @@ static int nilfs_sync_super(struct super_block *sb, int flag)
 	}
 
 	if (unlikely(err)) {
-		nilfs_msg(sb, KERN_ERR, "unable to write superblock: err=%d",
-			  err);
+		nilfs_err(sb, "unable to write superblock: err=%d", err);
 		if (err == -EIO && nilfs->ns_sbh[1]) {
 			/*
 			 * sbp[0] points to newer log than sbp[1],
@@ -267,7 +266,7 @@ struct nilfs_super_block **nilfs_prepare_super(struct super_block *sb,
 		    sbp[1]->s_magic == cpu_to_le16(NILFS_SUPER_MAGIC)) {
 			memcpy(sbp[0], sbp[1], nilfs->ns_sbsize);
 		} else {
-			nilfs_msg(sb, KERN_CRIT, "superblock broke");
+			nilfs_crit(sb, "superblock broke");
 			return NULL;
 		}
 	} else if (sbp[1] &&
@@ -377,9 +376,9 @@ static int nilfs_move_2nd_super(struct super_block *sb, loff_t sb2off)
 	offset = sb2off & (nilfs->ns_blocksize - 1);
 	nsbh = sb_getblk(sb, newblocknr);
 	if (!nsbh) {
-		nilfs_msg(sb, KERN_WARNING,
-			  "unable to move secondary superblock to block %llu",
-			  (unsigned long long)newblocknr);
+		nilfs_warn(sb,
+			   "unable to move secondary superblock to block %llu",
+			   (unsigned long long)newblocknr);
 		ret = -EIO;
 		goto out;
 	}
@@ -573,7 +572,7 @@ int nilfs_attach_checkpoint(struct super_block *sb, __u64 cno, int curr_mnt,
 	up_read(&nilfs->ns_segctor_sem);
 	if (unlikely(err)) {
 		if (err == -ENOENT || err == -EINVAL) {
-			nilfs_msg(sb, KERN_ERR,
+			nilfs_err(sb,
 				  "Invalid checkpoint (checkpoint number=%llu)",
 				  (unsigned long long)cno);
 			err = -EINVAL;
@@ -671,8 +670,7 @@ static int nilfs_statfs(struct dentry *dentry, struct kstatfs *buf)
 	err = nilfs_ifile_count_free_inodes(root->ifile,
 					    &nmaxinodes, &nfreeinodes);
 	if (unlikely(err)) {
-		nilfs_msg(sb, KERN_WARNING,
-			  "failed to count free inodes: err=%d", err);
+		nilfs_warn(sb, "failed to count free inodes: err=%d", err);
 		if (err == -ERANGE) {
 			/*
 			 * If nilfs_palloc_count_max_entries() returns
@@ -804,7 +802,7 @@ static int parse_options(char *options, struct super_block *sb, int is_remount)
 			break;
 		case Opt_snapshot:
 			if (is_remount) {
-				nilfs_msg(sb, KERN_ERR,
+				nilfs_err(sb,
 					  "\"%s\" option is invalid for remount",
 					  p);
 				return 0;
@@ -820,8 +818,7 @@ static int parse_options(char *options, struct super_block *sb, int is_remount)
 			nilfs_clear_opt(nilfs, DISCARD);
 			break;
 		default:
-			nilfs_msg(sb, KERN_ERR,
-				  "unrecognized mount option \"%s\"", p);
+			nilfs_err(sb, "unrecognized mount option \"%s\"", p);
 			return 0;
 		}
 	}
@@ -857,10 +854,10 @@ static int nilfs_setup_super(struct super_block *sb, int is_mount)
 	mnt_count = le16_to_cpu(sbp[0]->s_mnt_count);
 
 	if (nilfs->ns_mount_state & NILFS_ERROR_FS) {
-		nilfs_msg(sb, KERN_WARNING, "mounting fs with errors");
+		nilfs_warn(sb, "mounting fs with errors");
 #if 0
 	} else if (max_mnt_count >= 0 && mnt_count >= max_mnt_count) {
-		nilfs_msg(sb, KERN_WARNING, "maximal mount count reached");
+		nilfs_warn(sb, "maximal mount count reached");
 #endif
 	}
 	if (!max_mnt_count)
@@ -923,7 +920,7 @@ int nilfs_check_feature_compatibility(struct super_block *sb,
 	features = le64_to_cpu(sbp->s_feature_incompat) &
 		~NILFS_FEATURE_INCOMPAT_SUPP;
 	if (features) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "couldn't mount because of unsupported optional features (%llx)",
 			  (unsigned long long)features);
 		return -EINVAL;
@@ -931,7 +928,7 @@ int nilfs_check_feature_compatibility(struct super_block *sb,
 	features = le64_to_cpu(sbp->s_feature_compat_ro) &
 		~NILFS_FEATURE_COMPAT_RO_SUPP;
 	if (!sb_rdonly(sb) && features) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "couldn't mount RDWR because of unsupported optional features (%llx)",
 			  (unsigned long long)features);
 		return -EINVAL;
@@ -950,12 +947,12 @@ static int nilfs_get_root_dentry(struct super_block *sb,
 	inode = nilfs_iget(sb, root, NILFS_ROOT_INO);
 	if (IS_ERR(inode)) {
 		ret = PTR_ERR(inode);
-		nilfs_msg(sb, KERN_ERR, "error %d getting root inode", ret);
+		nilfs_err(sb, "error %d getting root inode", ret);
 		goto out;
 	}
 	if (!S_ISDIR(inode->i_mode) || !inode->i_blocks || !inode->i_size) {
 		iput(inode);
-		nilfs_msg(sb, KERN_ERR, "corrupt root inode");
+		nilfs_err(sb, "corrupt root inode");
 		ret = -EINVAL;
 		goto out;
 	}
@@ -983,7 +980,7 @@ static int nilfs_get_root_dentry(struct super_block *sb,
 	return ret;
 
  failed_dentry:
-	nilfs_msg(sb, KERN_ERR, "error %d getting root dentry", ret);
+	nilfs_err(sb, "error %d getting root dentry", ret);
 	goto out;
 }
 
@@ -1003,7 +1000,7 @@ static int nilfs_attach_snapshot(struct super_block *s, __u64 cno,
 		ret = (ret == -ENOENT) ? -EINVAL : ret;
 		goto out;
 	} else if (!ret) {
-		nilfs_msg(s, KERN_ERR,
+		nilfs_err(s,
 			  "The specified checkpoint is not a snapshot (checkpoint number=%llu)",
 			  (unsigned long long)cno);
 		ret = -EINVAL;
@@ -1012,7 +1009,7 @@ static int nilfs_attach_snapshot(struct super_block *s, __u64 cno,
 
 	ret = nilfs_attach_checkpoint(s, cno, false, &root);
 	if (ret) {
-		nilfs_msg(s, KERN_ERR,
+		nilfs_err(s,
 			  "error %d while loading snapshot (checkpoint number=%llu)",
 			  ret, (unsigned long long)cno);
 		goto out;
@@ -1109,7 +1106,7 @@ nilfs_fill_super(struct super_block *sb, void *data, int silent)
 	cno = nilfs_last_cno(nilfs);
 	err = nilfs_attach_checkpoint(sb, cno, true, &fsroot);
 	if (err) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "error %d while loading last checkpoint (checkpoint number=%llu)",
 			  err, (unsigned long long)cno);
 		goto failed_unload;
@@ -1172,8 +1169,8 @@ static int nilfs_remount(struct super_block *sb, int *flags, char *data)
 	err = -EINVAL;
 
 	if (!nilfs_valid_fs(nilfs)) {
-		nilfs_msg(sb, KERN_WARNING,
-			  "couldn't remount because the filesystem is in an incomplete recovery state");
+		nilfs_warn(sb,
+			   "couldn't remount because the filesystem is in an incomplete recovery state");
 		goto restore_opts;
 	}
 
@@ -1203,9 +1200,9 @@ static int nilfs_remount(struct super_block *sb, int *flags, char *data)
 			~NILFS_FEATURE_COMPAT_RO_SUPP;
 		up_read(&nilfs->ns_sem);
 		if (features) {
-			nilfs_msg(sb, KERN_WARNING,
-				  "couldn't remount RDWR because of unsupported optional features (%llx)",
-				  (unsigned long long)features);
+			nilfs_warn(sb,
+				   "couldn't remount RDWR because of unsupported optional features (%llx)",
+				   (unsigned long long)features);
 			err = -EROFS;
 			goto restore_opts;
 		}
@@ -1264,7 +1261,7 @@ static int nilfs_parse_snapshot_option(const char *option,
 	return 0;
 
 parse_error:
-	nilfs_msg(NULL, KERN_ERR, "invalid option \"%s\": %s", option, msg);
+	nilfs_err(NULL, "invalid option \"%s\": %s", option, msg);
 	return 1;
 }
 
@@ -1367,7 +1364,7 @@ nilfs_mount(struct file_system_type *fs_type, int flags,
 	} else if (!sd.cno) {
 		if (nilfs_tree_is_busy(s->s_root)) {
 			if ((flags ^ s->s_flags) & MS_RDONLY) {
-				nilfs_msg(s, KERN_ERR,
+				nilfs_err(s,
 					  "the device already has a %s mount.",
 					  sb_rdonly(s) ? "read-only" : "read/write");
 				err = -EBUSY;
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 33fba75..cd6aace 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -270,8 +270,8 @@ nilfs_checkpoints_checkpoints_number_show(struct nilfs_checkpoints_attr *attr,
 	err = nilfs_cpfile_get_stat(nilfs->ns_cpfile, &cpstat);
 	up_read(&nilfs->ns_segctor_sem);
 	if (err < 0) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "unable to get checkpoint stat: err=%d", err);
+		nilfs_err(nilfs->ns_sb, "unable to get checkpoint stat: err=%d",
+			  err);
 		return err;
 	}
 
@@ -293,8 +293,8 @@ nilfs_checkpoints_snapshots_number_show(struct nilfs_checkpoints_attr *attr,
 	err = nilfs_cpfile_get_stat(nilfs->ns_cpfile, &cpstat);
 	up_read(&nilfs->ns_segctor_sem);
 	if (err < 0) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "unable to get checkpoint stat: err=%d", err);
+		nilfs_err(nilfs->ns_sb, "unable to get checkpoint stat: err=%d",
+			  err);
 		return err;
 	}
 
@@ -412,8 +412,8 @@ nilfs_segments_dirty_segments_show(struct nilfs_segments_attr *attr,
 	err = nilfs_sufile_get_stat(nilfs->ns_sufile, &sustat);
 	up_read(&nilfs->ns_segctor_sem);
 	if (err < 0) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "unable to get segment stat: err=%d", err);
+		nilfs_err(nilfs->ns_sb, "unable to get segment stat: err=%d",
+			  err);
 		return err;
 	}
 
@@ -787,15 +787,15 @@ nilfs_superblock_sb_update_frequency_store(struct nilfs_superblock_attr *attr,
 
 	err = kstrtouint(skip_spaces(buf), 0, &val);
 	if (err) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "unable to convert string: err=%d", err);
+		nilfs_err(nilfs->ns_sb, "unable to convert string: err=%d",
+			  err);
 		return err;
 	}
 
 	if (val < NILFS_SB_FREQ) {
 		val = NILFS_SB_FREQ;
-		nilfs_msg(nilfs->ns_sb, KERN_WARNING,
-			  "superblock update frequency cannot be lesser than 10 seconds");
+		nilfs_warn(nilfs->ns_sb,
+			   "superblock update frequency cannot be lesser than 10 seconds");
 	}
 
 	down_write(&nilfs->ns_sem);
@@ -998,8 +998,7 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
 	nilfs->ns_dev_subgroups = kzalloc(devgrp_size, GFP_KERNEL);
 	if (unlikely(!nilfs->ns_dev_subgroups)) {
 		err = -ENOMEM;
-		nilfs_msg(sb, KERN_ERR,
-			  "unable to allocate memory for device group");
+		nilfs_err(sb, "unable to allocate memory for device group");
 		goto failed_create_device_group;
 	}
 
@@ -1108,15 +1107,13 @@ int __init nilfs_sysfs_init(void)
 	nilfs_kset = kset_create_and_add(NILFS_ROOT_GROUP_NAME, NULL, fs_kobj);
 	if (!nilfs_kset) {
 		err = -ENOMEM;
-		nilfs_msg(NULL, KERN_ERR,
-			  "unable to create sysfs entry: err=%d", err);
+		nilfs_err(NULL, "unable to create sysfs entry: err=%d", err);
 		goto failed_sysfs_init;
 	}
 
 	err = sysfs_create_group(&nilfs_kset->kobj, &nilfs_feature_attr_group);
 	if (unlikely(err)) {
-		nilfs_msg(NULL, KERN_ERR,
-			  "unable to create feature group: err=%d", err);
+		nilfs_err(NULL, "unable to create feature group: err=%d", err);
 		goto cleanup_sysfs_init;
 	}
 
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index e04d2c2..e0a887e 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -192,7 +192,7 @@ static int nilfs_store_log_cursor(struct the_nilfs *nilfs,
 		nilfs_get_segnum_of_block(nilfs, nilfs->ns_last_pseg);
 	nilfs->ns_cno = nilfs->ns_last_cno + 1;
 	if (nilfs->ns_segnum >= nilfs->ns_nsegments) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
+		nilfs_err(nilfs->ns_sb,
 			  "pointed segment number is out of range: segnum=%llu, nsegments=%lu",
 			  (unsigned long long)nilfs->ns_segnum,
 			  nilfs->ns_nsegments);
@@ -219,12 +219,12 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb)
 	int err;
 
 	if (!valid_fs) {
-		nilfs_msg(sb, KERN_WARNING, "mounting unchecked fs");
+		nilfs_warn(sb, "mounting unchecked fs");
 		if (s_flags & MS_RDONLY) {
-			nilfs_msg(sb, KERN_INFO,
-				  "recovery required for readonly filesystem");
-			nilfs_msg(sb, KERN_INFO,
-				  "write access will be enabled during recovery");
+			nilfs_info(sb,
+				   "recovery required for readonly filesystem");
+			nilfs_info(sb,
+				   "write access will be enabled during recovery");
 		}
 	}
 
@@ -239,12 +239,11 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb)
 			goto scan_error;
 
 		if (!nilfs_valid_sb(sbp[1])) {
-			nilfs_msg(sb, KERN_WARNING,
-				  "unable to fall back to spare super block");
+			nilfs_warn(sb,
+				   "unable to fall back to spare super block");
 			goto scan_error;
 		}
-		nilfs_msg(sb, KERN_INFO,
-			  "trying rollback from an earlier position");
+		nilfs_info(sb, "trying rollback from an earlier position");
 
 		/*
 		 * restore super block with its spare and reconfigure
@@ -257,9 +256,9 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb)
 		/* verify consistency between two super blocks */
 		blocksize = BLOCK_SIZE << le32_to_cpu(sbp[0]->s_log_block_size);
 		if (blocksize != nilfs->ns_blocksize) {
-			nilfs_msg(sb, KERN_WARNING,
-				  "blocksize differs between two super blocks (%d != %d)",
-				  blocksize, nilfs->ns_blocksize);
+			nilfs_warn(sb,
+				   "blocksize differs between two super blocks (%d != %d)",
+				   blocksize, nilfs->ns_blocksize);
 			goto scan_error;
 		}
 
@@ -278,8 +277,7 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb)
 
 	err = nilfs_load_super_root(nilfs, sb, ri.ri_super_root);
 	if (unlikely(err)) {
-		nilfs_msg(sb, KERN_ERR, "error %d while loading super root",
-			  err);
+		nilfs_err(sb, "error %d while loading super root", err);
 		goto failed;
 	}
 
@@ -294,28 +292,28 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb)
 		__u64 features;
 
 		if (nilfs_test_opt(nilfs, NORECOVERY)) {
-			nilfs_msg(sb, KERN_INFO,
-				  "norecovery option specified, skipping roll-forward recovery");
+			nilfs_info(sb,
+				   "norecovery option specified, skipping roll-forward recovery");
 			goto skip_recovery;
 		}
 		features = le64_to_cpu(nilfs->ns_sbp[0]->s_feature_compat_ro) &
 			~NILFS_FEATURE_COMPAT_RO_SUPP;
 		if (features) {
-			nilfs_msg(sb, KERN_ERR,
+			nilfs_err(sb,
 				  "couldn't proceed with recovery because of unsupported optional features (%llx)",
 				  (unsigned long long)features);
 			err = -EROFS;
 			goto failed_unload;
 		}
 		if (really_read_only) {
-			nilfs_msg(sb, KERN_ERR,
+			nilfs_err(sb,
 				  "write access unavailable, cannot proceed");
 			err = -EROFS;
 			goto failed_unload;
 		}
 		sb->s_flags &= ~MS_RDONLY;
 	} else if (nilfs_test_opt(nilfs, NORECOVERY)) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "recovery cancelled because norecovery option was specified for a read/write mount");
 		err = -EINVAL;
 		goto failed_unload;
@@ -331,12 +329,12 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb)
 	up_write(&nilfs->ns_sem);
 
 	if (err) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "error %d updating super block. recovery unfinished.",
 			  err);
 		goto failed_unload;
 	}
-	nilfs_msg(sb, KERN_INFO, "recovery complete");
+	nilfs_info(sb, "recovery complete");
 
  skip_recovery:
 	nilfs_clear_recovery_info(&ri);
@@ -344,7 +342,7 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb)
 	return 0;
 
  scan_error:
-	nilfs_msg(sb, KERN_ERR, "error %d while searching super root", err);
+	nilfs_err(sb, "error %d while searching super root", err);
 	goto failed;
 
  failed_unload:
@@ -408,7 +406,7 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
 	u64 nsegments, nblocks;
 
 	if (le32_to_cpu(sbp->s_rev_level) < NILFS_MIN_SUPP_REV) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
+		nilfs_err(nilfs->ns_sb,
 			  "unsupported revision (superblock rev.=%d.%d, current rev.=%d.%d). Please check the version of mkfs.nilfs(2).",
 			  le32_to_cpu(sbp->s_rev_level),
 			  le16_to_cpu(sbp->s_minor_rev_level),
@@ -421,13 +419,11 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
 
 	nilfs->ns_inode_size = le16_to_cpu(sbp->s_inode_size);
 	if (nilfs->ns_inode_size > nilfs->ns_blocksize) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "too large inode size: %d bytes",
+		nilfs_err(nilfs->ns_sb, "too large inode size: %d bytes",
 			  nilfs->ns_inode_size);
 		return -EINVAL;
 	} else if (nilfs->ns_inode_size < NILFS_MIN_INODE_SIZE) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "too small inode size: %d bytes",
+		nilfs_err(nilfs->ns_sb, "too small inode size: %d bytes",
 			  nilfs->ns_inode_size);
 		return -EINVAL;
 	}
@@ -436,8 +432,7 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
 
 	nilfs->ns_blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment);
 	if (nilfs->ns_blocks_per_segment < NILFS_SEG_MIN_BLOCKS) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
-			  "too short segment: %lu blocks",
+		nilfs_err(nilfs->ns_sb, "too short segment: %lu blocks",
 			  nilfs->ns_blocks_per_segment);
 		return -EINVAL;
 	}
@@ -447,7 +442,7 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
 		le32_to_cpu(sbp->s_r_segments_percentage);
 	if (nilfs->ns_r_segments_percentage < 1 ||
 	    nilfs->ns_r_segments_percentage > 99) {
-		nilfs_msg(nilfs->ns_sb, KERN_ERR,
+		nilfs_err(nilfs->ns_sb,
 			  "invalid reserved segments percentage: %lu",
 			  nilfs->ns_r_segments_percentage);
 		return -EINVAL;
@@ -589,16 +584,16 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs,
 
 	if (!sbp[0]) {
 		if (!sbp[1]) {
-			nilfs_msg(sb, KERN_ERR, "unable to read superblock");
+			nilfs_err(sb, "unable to read superblock");
 			return -EIO;
 		}
-		nilfs_msg(sb, KERN_WARNING,
-			  "unable to read primary superblock (blocksize = %d)",
-			  blocksize);
+		nilfs_warn(sb,
+			   "unable to read primary superblock (blocksize = %d)",
+			   blocksize);
 	} else if (!sbp[1]) {
-		nilfs_msg(sb, KERN_WARNING,
-			  "unable to read secondary superblock (blocksize = %d)",
-			  blocksize);
+		nilfs_warn(sb,
+			   "unable to read secondary superblock (blocksize = %d)",
+			   blocksize);
 	}
 
 	/*
@@ -620,14 +615,14 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs,
 	}
 	if (!valid[swp]) {
 		nilfs_release_super_block(nilfs);
-		nilfs_msg(sb, KERN_ERR, "couldn't find nilfs on the device");
+		nilfs_err(sb, "couldn't find nilfs on the device");
 		return -EINVAL;
 	}
 
 	if (!valid[!swp])
-		nilfs_msg(sb, KERN_WARNING,
-			  "broken superblock, retrying with spare superblock (blocksize = %d)",
-			  blocksize);
+		nilfs_warn(sb,
+			   "broken superblock, retrying with spare superblock (blocksize = %d)",
+			   blocksize);
 	if (swp)
 		nilfs_swap_super_block(nilfs);
 
@@ -661,7 +656,7 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb, char *data)
 
 	blocksize = sb_min_blocksize(sb, NILFS_MIN_BLOCK_SIZE);
 	if (!blocksize) {
-		nilfs_msg(sb, KERN_ERR, "unable to set blocksize");
+		nilfs_err(sb, "unable to set blocksize");
 		err = -EINVAL;
 		goto out;
 	}
@@ -680,7 +675,7 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb, char *data)
 	blocksize = BLOCK_SIZE << le32_to_cpu(sbp->s_log_block_size);
 	if (blocksize < NILFS_MIN_BLOCK_SIZE ||
 	    blocksize > NILFS_MAX_BLOCK_SIZE) {
-		nilfs_msg(sb, KERN_ERR,
+		nilfs_err(sb,
 			  "couldn't mount because of unsupported filesystem blocksize %d",
 			  blocksize);
 		err = -EINVAL;
@@ -690,7 +685,7 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb, char *data)
 		int hw_blocksize = bdev_logical_block_size(sb->s_bdev);
 
 		if (blocksize < hw_blocksize) {
-			nilfs_msg(sb, KERN_ERR,
+			nilfs_err(sb,
 				  "blocksize %d too small for device (sector-size = %d)",
 				  blocksize, hw_blocksize);
 			err = -EINVAL;
diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c
index e3d1673..ef9bcfe 100644
--- a/fs/sysv/itree.c
+++ b/fs/sysv/itree.c
@@ -82,9 +82,6 @@ static inline sysv_zone_t *block_end(struct buffer_head *bh)
 	return (sysv_zone_t*)((char*)bh->b_data + bh->b_size);
 }
 
-/*
- * Requires read_lock(&pointers_lock) or write_lock(&pointers_lock)
- */
 static Indirect *get_branch(struct inode *inode,
 			    int depth,
 			    int offsets[],
@@ -104,15 +101,18 @@ static Indirect *get_branch(struct inode *inode,
 		bh = sb_bread(sb, block);
 		if (!bh)
 			goto failure;
+		read_lock(&pointers_lock);
 		if (!verify_chain(chain, p))
 			goto changed;
 		add_chain(++p, bh, (sysv_zone_t*)bh->b_data + *++offsets);
+		read_unlock(&pointers_lock);
 		if (!p->key)
 			goto no_block;
 	}
 	return NULL;
 
 changed:
+	read_unlock(&pointers_lock);
 	brelse(bh);
 	*err = -EAGAIN;
 	goto no_block;
@@ -218,9 +218,7 @@ static int get_block(struct inode *inode, sector_t iblock, struct buffer_head *b
 		goto out;
 
 reread:
-	read_lock(&pointers_lock);
 	partial = get_branch(inode, depth, offsets, chain, &err);
-	read_unlock(&pointers_lock);
 
 	/* Simplest case - block found, no allocation needed */
 	if (!partial) {
@@ -290,9 +288,9 @@ static Indirect *find_shared(struct inode *inode,
 	*top = 0;
 	for (k = depth; k > 1 && !offsets[k-1]; k--)
 		;
+	partial = get_branch(inode, k, offsets, chain, &err);
 
 	write_lock(&pointers_lock);
-	partial = get_branch(inode, k, offsets, chain, &err);
 	if (!partial)
 		partial = chain + k-1;
 	/*
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 7cdd346..b1ec5e2 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -273,9 +273,6 @@ static int write_begin_slow(struct address_space *mapping,
 				return err;
 			}
 		}
-
-		SetPageUptodate(page);
-		ClearPageError(page);
 	}
 
 	if (PagePrivate(page))
@@ -474,9 +471,6 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping,
 				return err;
 			}
 		}
-
-		SetPageUptodate(page);
-		ClearPageError(page);
 	}
 
 	err = allocate_budget(c, page, ui, appending);
@@ -486,10 +480,8 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping,
 		 * If we skipped reading the page because we were going to
 		 * write all of it, then it is not up to date.
 		 */
-		if (skipped_read) {
+		if (skipped_read)
 			ClearPageChecked(page);
-			ClearPageUptodate(page);
-		}
 		/*
 		 * Budgeting failed which means it would have to force
 		 * write-back but didn't, because we set the @fast flag in the
@@ -580,6 +572,9 @@ static int ubifs_write_end(struct file *file, struct address_space *mapping,
 		goto out;
 	}
 
+	if (len == PAGE_SIZE)
+		SetPageUptodate(page);
+
 	if (!PagePrivate(page)) {
 		SetPagePrivate(page);
 		atomic_long_inc(&c->dirty_pg_cnt);
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 6a79783..cc8ae1f 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -596,6 +596,15 @@ static inline bool pm_suspended_storage(void)
 }
 #endif /* CONFIG_PM_SLEEP */
 
+/*
+ * Check if the gfp flags allow compaction - GFP_NOIO is a really
+ * tricky context because the migration might require IO.
+ */
+static inline bool gfp_compaction_allowed(gfp_t gfp_mask)
+{
+	return IS_ENABLED(CONFIG_COMPACTION) && (gfp_mask & __GFP_IO);
+}
+
 #if (defined(CONFIG_MEMORY_ISOLATION) && defined(CONFIG_COMPACTION)) || defined(CONFIG_CMA)
 /* The below functions must be run on a range from a single zone. */
 extern int alloc_contig_range(unsigned long start, unsigned long end,
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index 0f7c8f8..d118df7 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -190,7 +190,7 @@ struct rpc_wait_queue {
 	unsigned char		maxpriority;		/* maximum priority (0 if queue is not a priority queue) */
 	unsigned char		priority;		/* current priority */
 	unsigned char		nr;			/* # tasks remaining for cookie */
-	unsigned short		qlen;			/* total # tasks waiting in queue */
+	unsigned int		qlen;			/* total # tasks waiting in queue */
 	struct rpc_timer	timer_list;
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) || IS_ENABLED(CONFIG_TRACEPOINTS)
 	const char *		name;
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index ceab3a5..3d85113 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -173,6 +173,7 @@ void inet_csk_init_xmit_timers(struct sock *sk,
 			       void (*delack_handler)(unsigned long),
 			       void (*keepalive_handler)(unsigned long));
 void inet_csk_clear_xmit_timers(struct sock *sk);
+void inet_csk_clear_xmit_timers_sync(struct sock *sk);
 
 static inline void inet_csk_schedule_ack(struct sock *sk)
 {
diff --git a/include/net/sock.h b/include/net/sock.h
index 8a85488..bb6206b 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1556,6 +1556,13 @@ static inline void sock_owned_by_me(const struct sock *sk)
 #endif
 }
 
+static inline void sock_not_owned_by_me(const struct sock *sk)
+{
+#ifdef CONFIG_LOCKDEP
+	WARN_ON_ONCE(lockdep_sock_is_held(sk) && debug_locks);
+#endif
+}
+
 static inline bool sock_owned_by_user(const struct sock *sk)
 {
 	sock_owned_by_me(sk);
@@ -2103,6 +2110,8 @@ void sk_reset_timer(struct sock *sk, struct timer_list *timer,
 
 void sk_stop_timer(struct sock *sk, struct timer_list *timer);
 
+void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer);
+
 int __sk_queue_drop_skb(struct sock *sk, struct sk_buff_head *sk_queue,
 			struct sk_buff *skb, unsigned int flags,
 			void (*destructor)(struct sock *sk,
diff --git a/include/soc/fsl/qman.h b/include/soc/fsl/qman.h
index d4dfefd..5c004b2 100644
--- a/include/soc/fsl/qman.h
+++ b/include/soc/fsl/qman.h
@@ -1160,6 +1160,15 @@ int qman_delete_cgr(struct qman_cgr *cgr);
 void qman_delete_cgr_safe(struct qman_cgr *cgr);
 
 /**
+ * qman_update_cgr_safe - Modifies a congestion group object from any CPU
+ * @cgr: the 'cgr' object to modify
+ * @opts: state of the CGR settings
+ *
+ * This will select the proper CPU and modify the CGR settings.
+ */
+int qman_update_cgr_safe(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts);
+
+/**
  * qman_query_cgr_congested - Queries CGR's congestion status
  * @cgr: the 'cgr' object to query
  * @result: returns 'cgr's congestion status, 1 (true) if congested
diff --git a/init/initramfs.c b/init/initramfs.c
index 5ea7f1b..33fdbdc 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -650,7 +650,7 @@ static int __init populate_rootfs(void)
 		printk(KERN_INFO "rootfs image is not initramfs (%s)"
 				"; looks like an initrd\n", err);
 		fd = sys_open("/initrd.image",
-			      O_WRONLY|O_CREAT, 0700);
+			      O_WRONLY|O_CREAT|O_LARGEFILE, 0700);
 		if (fd >= 0) {
 			ssize_t written = xwrite(fd, (char *)initrd_start,
 						initrd_end - initrd_start);
diff --git a/kernel/events/core.c b/kernel/events/core.c
index c62064b..fcbe2b0 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5911,9 +5911,16 @@ static void perf_output_read_group(struct perf_output_handle *handle,
 {
 	struct perf_event *leader = event->group_leader, *sub;
 	u64 read_format = event->attr.read_format;
+	unsigned long flags;
 	u64 values[5];
 	int n = 0;
 
+	/*
+	 * Disabling interrupts avoids all counter scheduling
+	 * (context switches, timer based rotation and IPIs).
+	 */
+	local_irq_save(flags);
+
 	values[n++] = 1 + leader->nr_siblings;
 
 	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
@@ -5945,6 +5952,8 @@ static void perf_output_read_group(struct perf_output_handle *handle,
 
 		__output_copy(handle, values, n * sizeof(u64));
 	}
+
+	local_irq_restore(flags);
 }
 
 #define PERF_FORMAT_TOTAL_TIMES (PERF_FORMAT_TOTAL_TIME_ENABLED|\
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 8be5948..87c2aa8 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -222,6 +222,7 @@ static int __init mem_sleep_default_setup(char *str)
 		if (mem_sleep_labels[state] &&
 		    !strcmp(str, mem_sleep_labels[state])) {
 			mem_sleep_default = state;
+			mem_sleep_current = state;
 			break;
 		}
 
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index d9662d9..6382f36 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1912,6 +1912,12 @@ static int console_trylock_spinning(void)
 	 */
 	mutex_acquire(&console_lock_dep_map, 0, 1, _THIS_IP_);
 
+	/*
+	 * Update @console_may_schedule for trylock because the previous
+	 * owner may have been schedulable.
+	 */
+	console_may_schedule = 0;
+
 	return 1;
 }
 
diff --git a/kernel/sys.c b/kernel/sys.c
index 6752175..3343903 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1204,7 +1204,7 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
 	if (!strncmp(current->comm, "bpfloader", 9) ||
 	    !strncmp(current->comm, "netbpfload", 10) ||
 	    !strncmp(current->comm, "netd", 4)) {
-		strcpy(tmp.release, "5.4.0");
+		strcpy(tmp.release, "5.4.186");
 		pr_debug("fake uname: %s/%d release=%s\n",
 			 current->comm, current->pid, tmp.release);
 	}
diff --git a/mm/compaction.c b/mm/compaction.c
index 0d8a825..5907fbd 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1721,16 +1721,11 @@ enum compact_result try_to_compact_pages(gfp_t gfp_mask, unsigned int order,
 		unsigned int alloc_flags, const struct alloc_context *ac,
 		enum compact_priority prio)
 {
-	int may_perform_io = gfp_mask & __GFP_IO;
 	struct zoneref *z;
 	struct zone *zone;
 	enum compact_result rc = COMPACT_SKIPPED;
 
-	/*
-	 * Check if the GFP flags allow compaction - GFP_NOIO is really
-	 * tricky context because the migration might require IO
-	 */
-	if (!may_perform_io)
+	if (!gfp_compaction_allowed(gfp_mask))
 		return COMPACT_SKIPPED;
 
 	trace_mm_compaction_try_to_compact_pages(order, gfp_mask, prio);
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index de9a601..6606990 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -996,7 +996,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
 	if (kill)
 		collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED);
 
-	unmap_success = try_to_unmap(p, ttu, NULL);
+	unmap_success = try_to_unmap(hpage, ttu, NULL);
 	if (!unmap_success)
 		pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n",
 		       pfn, page_mapcount(p));
diff --git a/mm/memory.c b/mm/memory.c
index 221e812..62dfdcb 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4536,6 +4536,10 @@ int follow_phys(struct vm_area_struct *vma,
 		goto out;
 	pte = *ptep;
 
+	/* Never return PFNs of anon folios in COW mappings. */
+	if (vm_normal_page(vma, address, pte))
+		goto unlock;
+
 	if ((flags & FOLL_WRITE) && !pte_write(pte))
 		goto unlock;
 
diff --git a/mm/memtest.c b/mm/memtest.c
index f53ace7..d407373 100644
--- a/mm/memtest.c
+++ b/mm/memtest.c
@@ -46,10 +46,10 @@ static void __init memtest(u64 pattern, phys_addr_t start_phys, phys_addr_t size
 	last_bad = 0;
 
 	for (p = start; p < end; p++)
-		*p = pattern;
+		WRITE_ONCE(*p, pattern);
 
 	for (p = start; p < end; p++, start_phys_aligned += incr) {
-		if (*p == pattern)
+		if (READ_ONCE(*p) == pattern)
 			continue;
 		if (start_phys_aligned == last_bad + incr) {
 			last_bad += incr;
diff --git a/mm/migrate.c b/mm/migrate.c
index d4ee46b..539a435 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -508,8 +508,12 @@ int migrate_page_move_mapping(struct address_space *mapping,
 	if (PageSwapBacked(page)) {
 		__SetPageSwapBacked(newpage);
 		if (PageSwapCache(page)) {
+			int i;
+
 			SetPageSwapCache(newpage);
-			set_page_private(newpage, page_private(page));
+			for (i = 0; i < (1 << compound_order(page)); i++)
+				set_page_private(newpage + i,
+						 page_private(page + i));
 		}
 	} else {
 		VM_BUG_ON_PAGE(PageSwapCache(page), page);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index cfd470d..99583d8 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4012,6 +4012,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
 						struct alloc_context *ac)
 {
 	bool can_direct_reclaim = gfp_mask & __GFP_DIRECT_RECLAIM;
+	bool can_compact = gfp_compaction_allowed(gfp_mask);
 	const bool costly_order = order > PAGE_ALLOC_COSTLY_ORDER;
 	struct page *page = NULL;
 	unsigned int alloc_flags;
@@ -4077,7 +4078,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
 	 * Don't try this for allocations that are allowed to ignore
 	 * watermarks, as the ALLOC_NO_WATERMARKS attempt didn't yet happen.
 	 */
-	if (can_direct_reclaim &&
+	if (can_direct_reclaim && can_compact &&
 			(costly_order ||
 			   (order > 0 && ac->migratetype != MIGRATE_MOVABLE))
 			&& !gfp_pfmemalloc_allowed(gfp_mask)) {
@@ -4163,9 +4164,10 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
 
 	/*
 	 * Do not retry costly high order allocations unless they are
-	 * __GFP_RETRY_MAYFAIL
+	 * __GFP_RETRY_MAYFAIL and we can compact
 	 */
-	if (costly_order && !(gfp_mask & __GFP_RETRY_MAYFAIL))
+	if (costly_order && (!can_compact ||
+			     !(gfp_mask & __GFP_RETRY_MAYFAIL)))
 		goto nopage;
 
 	if (should_reclaim_retry(gfp_mask, order, ac, alloc_flags,
@@ -4178,7 +4180,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
 	 * implementation of the compaction depends on the sufficient amount
 	 * of free memory (see __compaction_suitable)
 	 */
-	if (did_some_progress > 0 &&
+	if (did_some_progress > 0 && can_compact &&
 			should_compact_retry(ac, order, alloc_flags,
 				compact_result, &compact_priority,
 				&compaction_retries))
diff --git a/mm/vmscan.c b/mm/vmscan.c
index a5a2a12..0205bfe 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2798,7 +2798,7 @@ static void shrink_node_memcg(struct pglist_data *pgdat, struct mem_cgroup *memc
 /* Use reclaim/compaction for costly allocs or under memory pressure */
 static bool in_reclaim_compaction(struct scan_control *sc)
 {
-	if (IS_ENABLED(CONFIG_COMPACTION) && sc->order &&
+	if (gfp_compaction_allowed(sc->gfp_mask) && sc->order &&
 			(sc->order > PAGE_ALLOC_COSTLY_ORDER ||
 			 sc->priority < DEF_PRIORITY - 2))
 		return true;
@@ -2992,6 +2992,9 @@ static inline bool compaction_ready(struct zone *zone, struct scan_control *sc)
 	unsigned long watermark;
 	enum compact_result suitable;
 
+	if (!gfp_compaction_allowed(sc->gfp_mask))
+		return false;
+
 	suitable = compaction_suitable(zone, sc->order, 0, sc->reclaim_idx);
 	if (suitable == COMPACT_SUCCESS)
 		/* Allocation should succeed already. Don't reclaim. */
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 815d4fb..8d76721 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -329,7 +329,7 @@ int vlan_vids_add_by_dev(struct net_device *dev,
 		return 0;
 
 	list_for_each_entry(vid_info, &vlan_info->vid_list, list) {
-		if (!vlan_hw_filter_capable(by_dev, vid_info->proto))
+		if (!vlan_hw_filter_capable(by_dev, vid_info))
 			continue;
 		err = vlan_vid_add(dev, vid_info->proto, vid_info->vid);
 		if (err)
@@ -341,7 +341,7 @@ int vlan_vids_add_by_dev(struct net_device *dev,
 	list_for_each_entry_continue_reverse(vid_info,
 					     &vlan_info->vid_list,
 					     list) {
-		if (!vlan_hw_filter_capable(by_dev, vid_info->proto))
+		if (!vlan_hw_filter_capable(by_dev, vid_info))
 			continue;
 		vlan_vid_del(dev, vid_info->proto, vid_info->vid);
 	}
@@ -363,7 +363,7 @@ void vlan_vids_del_by_dev(struct net_device *dev,
 		return;
 
 	list_for_each_entry(vid_info, &vlan_info->vid_list, list) {
-		if (!vlan_hw_filter_capable(by_dev, vid_info->proto))
+		if (!vlan_hw_filter_capable(by_dev, vid_info))
 			continue;
 		vlan_vid_del(dev, vid_info->proto, vid_info->vid);
 	}
diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index 63df63e..b652d1d 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -285,10 +285,12 @@ static int conn_info_min_age_set(void *data, u64 val)
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val > hdev->conn_info_max_age)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val == 0 || val > hdev->conn_info_max_age) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->conn_info_min_age = val;
 	hci_dev_unlock(hdev);
 
@@ -313,10 +315,12 @@ static int conn_info_max_age_set(void *data, u64 val)
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val < hdev->conn_info_min_age)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val == 0 || val < hdev->conn_info_min_age) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->conn_info_max_age = val;
 	hci_dev_unlock(hdev);
 
@@ -594,10 +598,12 @@ static int sniff_min_interval_set(void *data, u64 val)
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val % 2 || val > hdev->sniff_max_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val == 0 || val % 2 || val > hdev->sniff_max_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->sniff_min_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -622,10 +628,12 @@ static int sniff_max_interval_set(void *data, u64 val)
 {
 	struct hci_dev *hdev = data;
 
-	if (val == 0 || val % 2 || val < hdev->sniff_min_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val == 0 || val % 2 || val < hdev->sniff_min_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->sniff_max_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -914,10 +922,12 @@ static int conn_min_interval_set(void *data, u64 val)
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->le_conn_min_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -942,10 +952,12 @@ static int conn_max_interval_set(void *data, u64 val)
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->le_conn_max_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -1054,10 +1066,12 @@ static int adv_min_interval_set(void *data, u64 val)
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0020 || val > 0x4000 || val > hdev->le_adv_max_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val < 0x0020 || val > 0x4000 || val > hdev->le_adv_max_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->le_adv_min_interval = val;
 	hci_dev_unlock(hdev);
 
@@ -1082,10 +1096,12 @@ static int adv_max_interval_set(void *data, u64 val)
 {
 	struct hci_dev *hdev = data;
 
-	if (val < 0x0020 || val > 0x4000 || val < hdev->le_adv_min_interval)
-		return -EINVAL;
-
 	hci_dev_lock(hdev);
+	if (val < 0x0020 || val > 0x4000 || val < hdev->le_adv_min_interval) {
+		hci_dev_unlock(hdev);
+		return -EINVAL;
+	}
+
 	hdev->le_adv_max_interval = val;
 	hci_dev_unlock(hdev);
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c6daea8..f012db5 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2190,6 +2190,31 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 		if (test_bit(HCI_ENCRYPT, &hdev->flags))
 			set_bit(HCI_CONN_ENCRYPT, &conn->flags);
 
+		/* "Link key request" completed ahead of "connect request" completes */
+		if (ev->encr_mode == 1 && !test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
+		    ev->link_type == ACL_LINK) {
+			struct link_key *key;
+			struct hci_cp_read_enc_key_size cp;
+
+			key = hci_find_link_key(hdev, &ev->bdaddr);
+			if (key) {
+				set_bit(HCI_CONN_ENCRYPT, &conn->flags);
+
+				if (!(hdev->commands[20] & 0x10)) {
+					conn->enc_key_size = HCI_LINK_KEY_SIZE;
+				} else {
+					cp.handle = cpu_to_le16(conn->handle);
+					if (hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE,
+							 sizeof(cp), &cp)) {
+						bt_dev_err(hdev, "sending read key size failed");
+						conn->enc_key_size = HCI_LINK_KEY_SIZE;
+					}
+				}
+
+				hci_encrypt_cfm(conn, ev->status);
+			}
+		}
+
 		/* Get remote features */
 		if (conn->type == ACL_LINK) {
 			struct hci_cp_read_remote_features cp;
diff --git a/net/core/sock.c b/net/core/sock.c
index 8807887..567b4c0 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2885,6 +2885,13 @@ void sk_stop_timer(struct sock *sk, struct timer_list* timer)
 }
 EXPORT_SYMBOL(sk_stop_timer);
 
+void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer)
+{
+	if (del_timer_sync(timer))
+		__sock_put(sk);
+}
+EXPORT_SYMBOL(sk_stop_timer_sync);
+
 void sock_init_data(struct socket *sock, struct sock *sk)
 {
 	sk_init_common(sk);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index c7306bb..6a8e8ce 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -550,6 +550,20 @@ void inet_csk_clear_xmit_timers(struct sock *sk)
 }
 EXPORT_SYMBOL(inet_csk_clear_xmit_timers);
 
+void inet_csk_clear_xmit_timers_sync(struct sock *sk)
+{
+	struct inet_connection_sock *icsk = inet_csk(sk);
+
+	/* ongoing timer handlers need to acquire socket lock. */
+	sock_not_owned_by_me(sk);
+
+	icsk->icsk_pending = icsk->icsk_ack.pending = 0;
+
+	sk_stop_timer_sync(sk, &icsk->icsk_retransmit_timer);
+	sk_stop_timer_sync(sk, &icsk->icsk_delack_timer);
+	sk_stop_timer_sync(sk, &sk->sk_timer);
+}
+
 void inet_csk_delete_keepalive_timer(struct sock *sk)
 {
 	sk_stop_timer(sk, &sk->sk_timer);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9af8e43..b6a3a40 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2306,6 +2306,8 @@ void tcp_close(struct sock *sk, long timeout)
 	bh_unlock_sock(sk);
 	local_bh_enable();
 	release_sock(sk);
+	if (!sk->sk_net_refcnt)
+		inet_csk_clear_xmit_timers_sync(sk);
 	sock_put(sk);
 }
 EXPORT_SYMBOL(tcp_close);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index d43abeb..8400b64 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -527,19 +527,19 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
 	if (!w) {
 		/* New dump:
 		 *
-		 * 1. hook callback destructor.
-		 */
-		cb->args[3] = (long)cb->done;
-		cb->done = fib6_dump_done;
-
-		/*
-		 * 2. allocate and initialize walker.
+		 * 1. allocate and initialize walker.
 		 */
 		w = kzalloc(sizeof(*w), GFP_ATOMIC);
 		if (!w)
 			return -ENOMEM;
 		w->func = fib6_dump_node;
 		cb->args[2] = (long)w;
+
+		/* 2. hook callback destructor.
+		 */
+		cb->args[3] = (long)cb->done;
+		cb->done = fib6_dump_done;
+
 	}
 
 	arg.skb = skb;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 05e7400..6ae941f 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1536,15 +1536,14 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 		}
 
 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-		    sta->sdata->u.vlan.sta) {
-			ieee80211_clear_fast_rx(sta);
+		    sta->sdata->u.vlan.sta)
 			RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
-		}
 
 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
 			ieee80211_vif_dec_num_mcast(sta->sdata);
 
 		sta->sdata = vlansdata;
+		ieee80211_check_fast_rx(sta);
 		ieee80211_check_fast_xmit(sta);
 
 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 407346b..d5a1b67 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3202,6 +3202,12 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
 		if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
 			     (NFT_SET_EVAL | NFT_SET_OBJECT))
 			return -EOPNOTSUPP;
+		if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) ==
+			     (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT))
+			return -EOPNOTSUPP;
+		if ((flags & (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) ==
+			     (NFT_SET_CONSTANT | NFT_SET_TIMEOUT))
+			return -EOPNOTSUPP;
 	}
 
 	dtype = 0;
@@ -3242,6 +3248,10 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
 	if (nla[NFTA_SET_TIMEOUT] != NULL) {
 		if (!(flags & NFT_SET_TIMEOUT))
 			return -EINVAL;
+
+		if (flags & NFT_SET_ANONYMOUS)
+			return -EOPNOTSUPP;
+
 		timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
 						nla[NFTA_SET_TIMEOUT])));
 	}
@@ -3249,6 +3259,10 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
 	if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
 		if (!(flags & NFT_SET_TIMEOUT))
 			return -EINVAL;
+
+		if (flags & NFT_SET_ANONYMOUS)
+			return -EOPNOTSUPP;
+
 		gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
 	}
 
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 9f1e801..1700c42 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -37,6 +37,14 @@ static unsigned int optlen(const u8 *opt, unsigned int offset)
 		return opt[offset + 1];
 }
 
+static int nft_skb_copy_to_reg(const struct sk_buff *skb, int offset, u32 *dest, unsigned int len)
+{
+	if (len % NFT_REG32_SIZE)
+		dest[len / NFT_REG32_SIZE] = 0;
+
+	return skb_copy_bits(skb, offset, dest, len);
+}
+
 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
 				 struct nft_regs *regs,
 				 const struct nft_pktinfo *pkt)
@@ -58,8 +66,7 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
 	}
 	offset += priv->offset;
 
-	dest[priv->len / NFT_REG32_SIZE] = 0;
-	if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
+	if (nft_skb_copy_to_reg(pkt->skb, offset, dest, priv->len) < 0)
 		goto err;
 	return;
 err:
@@ -115,7 +122,8 @@ static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
 		if (priv->flags & NFT_EXTHDR_F_PRESENT) {
 			*dest = 1;
 		} else {
-			dest[priv->len / NFT_REG32_SIZE] = 0;
+			if (priv->len % NFT_REG32_SIZE)
+				dest[priv->len / NFT_REG32_SIZE] = 0;
 			memcpy(dest, opt + offset, priv->len);
 		}
 
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 2d9934d..bed8bbc 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -1513,6 +1513,11 @@ static void nci_rx_work(struct work_struct *work)
 		nfc_send_to_raw_sock(ndev->nfc_dev, skb,
 				     RAW_PAYLOAD_NCI, NFC_DIRECTION_RX);
 
+		if (!nci_plen(skb->data)) {
+			kfree_skb(skb);
+			break;
+		}
+
 		/* Process frame */
 		switch (nci_mt(skb->data)) {
 		case NCI_MT_RSP_PKT:
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index 20ea9d1..f2b9016 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -203,14 +203,14 @@ static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a,
 	struct tcf_skbmod *d = to_skbmod(a);
 	unsigned char *b = skb_tail_pointer(skb);
 	struct tcf_skbmod_params  *p = rtnl_dereference(d->skbmod_p);
-	struct tc_skbmod opt = {
-		.index   = d->tcf_index,
-		.refcnt  = d->tcf_refcnt - ref,
-		.bindcnt = d->tcf_bindcnt - bind,
-		.action  = d->tcf_action,
-	};
+	struct tc_skbmod opt;
 	struct tcf_t t;
 
+	memset(&opt, 0, sizeof(opt));
+	opt.index   = d->tcf_index;
+	opt.refcnt  = d->tcf_refcnt - ref,
+	opt.bindcnt = d->tcf_bindcnt - bind;
+	opt.action = d->tcf_action;
 	opt.flags  = p->flags;
 	if (nla_put(skb, TCA_SKBMOD_PARMS, sizeof(opt), &opt))
 		goto nla_put_failure;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index fb3c29b..c5741c9 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1733,6 +1733,9 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
 	if (xp->xfrm_nr == 0)
 		return 0;
 
+	if (xp->xfrm_nr > XFRM_MAX_DEPTH)
+		return -ENOBUFS;
+
 	for (i = 0; i < xp->xfrm_nr; i++) {
 		struct xfrm_user_tmpl *up = &vec[i];
 		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
index e15cd63..c2e41da 100644
--- a/scripts/Makefile.extrawarn
+++ b/scripts/Makefile.extrawarn
@@ -75,5 +75,7 @@
 KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast)
 KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access)
 KBUILD_CFLAGS += $(call cc-disable-warning, cast-function-type-strict)
+KBUILD_CFLAGS += -Wno-enum-compare-conditional
+KBUILD_CFLAGS += -Wno-enum-enum-conversion
 endif
 endif
diff --git a/scripts/module-lto.lds b/scripts/module-lto.lds
deleted file mode 100644
index d0699ae..0000000
--- a/scripts/module-lto.lds
+++ /dev/null
@@ -1,22 +0,0 @@
-
-SECTIONS {
- /DISCARD/ : {
-  *(.eh_frame)
- }
- .bss : {
-  *(.bss .bss.[0-9a-zA-Z_]*)
-  *(.bss..L*)
- }
- .data : {
-  *(.data .data.[0-9a-zA-Z_]*)
-  *(.data..L*)
- }
- .rodata : {
-  *(.rodata .rodata.[0-9a-zA-Z_]*)
-  *(.rodata..L*)
- }
- .text : ALIGN((1 << 12)) {
-  *(.text.__cfi_check)
-  *(.text .text.[0-9a-zA-Z_]* .text..L.cfi*)
- }
-}
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index a6e81ef..0fec3d1 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1323,7 +1323,8 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
 		check_star = 1;
 	} else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
 		check_priv = 1;
-		if (size != TRANS_TRUE_SIZE ||
+		if (!S_ISDIR(d_backing_inode(dentry)->i_mode) ||
+		    size != TRANS_TRUE_SIZE ||
 		    strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
 			rc = -EINVAL;
 	} else
@@ -2749,6 +2750,15 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name,
 	if (value == NULL || size > SMK_LONGLABEL || size == 0)
 		return -EINVAL;
 
+	if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) {
+		if (!S_ISDIR(inode->i_mode) || size != TRANS_TRUE_SIZE ||
+		    strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
+			return -EINVAL;
+
+		nsp->smk_flags |= SMK_INODE_TRANSMUTE;
+		return 0;
+	}
+
 	skp = smk_import_entry(value, size);
 	if (IS_ERR(skp))
 		return PTR_ERR(skp);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 9942735..0f65515 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6746,7 +6746,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
 	SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
-	SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
+	SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
 	SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
@@ -7909,8 +7909,7 @@ static void alc897_hp_automute_hook(struct hda_codec *codec,
 
 	snd_hda_gen_hp_automute(codec, jack);
 	vref = spec->gen.hp_jack_present ? (PIN_HP | AC_PINCTL_VREF_100) : PIN_HP;
-	snd_hda_codec_write(codec, 0x1b, 0, AC_VERB_SET_PIN_WIDGET_CONTROL,
-			    vref);
+	snd_hda_set_pin_ctl(codec, 0x1b, vref);
 }
 
 static void alc897_fixup_lenovo_headset_mic(struct hda_codec *codec,
@@ -7920,6 +7919,9 @@ static void alc897_fixup_lenovo_headset_mic(struct hda_codec *codec,
 	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
 		spec->gen.hp_automute_hook = alc897_hp_automute_hook;
 	}
+	if (action == HDA_FIXUP_ACT_PROBE) {
+		snd_hda_set_pin_ctl_cache(codec, 0x1a, PIN_IN | AC_PINCTL_VREF_100);
+	}
 }
 
 static void alc897_fixup_lenovo_headset_mode(struct hda_codec *codec,
diff --git a/sound/sh/aica.c b/sound/sh/aica.c
index d9acf55..3df531b 100644
--- a/sound/sh/aica.c
+++ b/sound/sh/aica.c
@@ -295,18 +295,21 @@ static void run_spu_dma(struct work_struct *work)
 		dreamcastcard->clicks++;
 		if (unlikely(dreamcastcard->clicks >= AICA_PERIOD_NUMBER))
 			dreamcastcard->clicks %= AICA_PERIOD_NUMBER;
-		mod_timer(&dreamcastcard->timer, jiffies + 1);
+		if (snd_pcm_running(dreamcastcard->substream))
+			mod_timer(&dreamcastcard->timer, jiffies + 1);
 	}
 }
 
-static void aica_period_elapsed(unsigned long timer_var)
+static void aica_period_elapsed(struct timer_list *t)
 {
+	struct snd_card_aica *dreamcastcard = from_timer(dreamcastcard,
+							      t, timer);
+	struct snd_pcm_substream *substream = dreamcastcard->substream;
 	/*timer function - so cannot sleep */
 	int play_period;
 	struct snd_pcm_runtime *runtime;
-	struct snd_pcm_substream *substream;
-	struct snd_card_aica *dreamcastcard;
-	substream = (struct snd_pcm_substream *) timer_var;
+	if (!snd_pcm_running(substream))
+		return;
 	runtime = substream->runtime;
 	dreamcastcard = substream->pcm->private_data;
 	/* Have we played out an additional period? */
@@ -335,13 +338,6 @@ static void spu_begin_dma(struct snd_pcm_substream *substream)
 	dreamcastcard = substream->pcm->private_data;
 	/*get the queue to do the work */
 	schedule_work(&(dreamcastcard->spu_dma_work));
-	/* Timer may already be running */
-	if (unlikely(dreamcastcard->timer.data)) {
-		mod_timer(&dreamcastcard->timer, jiffies + 4);
-		return;
-	}
-	setup_timer(&dreamcastcard->timer, aica_period_elapsed,
-		    (unsigned long) substream);
 	mod_timer(&dreamcastcard->timer, jiffies + 4);
 }
 
@@ -374,13 +370,20 @@ static int snd_aicapcm_pcm_open(struct snd_pcm_substream
 	return 0;
 }
 
+static int snd_aicapcm_pcm_sync_stop(struct snd_pcm_substream *substream)
+{
+	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;
+
+	del_timer_sync(&dreamcastcard->timer);
+	cancel_work_sync(&dreamcastcard->spu_dma_work);
+	return 0;
+}
+
 static int snd_aicapcm_pcm_close(struct snd_pcm_substream
 				 *substream)
 {
 	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;
-	flush_work(&(dreamcastcard->spu_dma_work));
-	if (dreamcastcard->timer.data)
-		del_timer(&dreamcastcard->timer);
+	dreamcastcard->substream = NULL;
 	kfree(dreamcastcard->channel);
 	spu_disable();
 	return 0;
@@ -445,6 +448,7 @@ static const struct snd_pcm_ops snd_aicapcm_playback_ops = {
 	.prepare = snd_aicapcm_pcm_prepare,
 	.trigger = snd_aicapcm_pcm_trigger,
 	.pointer = snd_aicapcm_pcm_pointer,
+	.sync_stop = snd_aicapcm_pcm_sync_stop,
 };
 
 /* TO DO: set up to handle more than one pcm instance */
@@ -600,7 +604,7 @@ static int snd_aica_probe(struct platform_device *devptr)
 {
 	int err;
 	struct snd_card_aica *dreamcastcard;
-	dreamcastcard = kmalloc(sizeof(struct snd_card_aica), GFP_KERNEL);
+	dreamcastcard = kzalloc(sizeof(struct snd_card_aica), GFP_KERNEL);
 	if (unlikely(!dreamcastcard))
 		return -ENOMEM;
 	err = snd_card_new(&devptr->dev, index, SND_AICA_DRIVER,
@@ -615,12 +619,11 @@ static int snd_aica_probe(struct platform_device *devptr)
 	       "Yamaha AICA Super Intelligent Sound Processor for SEGA Dreamcast");
 	/* Prepare to use the queue */
 	INIT_WORK(&(dreamcastcard->spu_dma_work), run_spu_dma);
+	timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0);
 	/* Load the PCM 'chip' */
 	err = snd_aicapcmchip(dreamcastcard, 0);
 	if (unlikely(err < 0))
 		goto freedreamcast;
-	dreamcastcard->timer.data = 0;
-	dreamcastcard->channel = NULL;
 	/* Add basic controls */
 	err = add_aicamixer_controls(dreamcastcard);
 	if (unlikely(err < 0))
diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
index f8d4907..1388067 100644
--- a/sound/soc/soc-ops.c
+++ b/sound/soc/soc-ops.c
@@ -257,7 +257,7 @@ int snd_soc_get_volsw(struct snd_kcontrol *kcontrol,
 	int max = mc->max;
 	int min = mc->min;
 	int sign_bit = mc->sign_bit;
-	unsigned int mask = (1 << fls(max)) - 1;
+	unsigned int mask = (1ULL << fls(max)) - 1;
 	unsigned int invert = mc->invert;
 	int val;
 	int ret;
diff --git a/tools/iio/iio_utils.c b/tools/iio/iio_utils.c
index d174487..1ef51c7 100644
--- a/tools/iio/iio_utils.c
+++ b/tools/iio/iio_utils.c
@@ -376,7 +376,7 @@ int build_channel_array(const char *device_dir,
 		goto error_close_dir;
 	}
 
-	seekdir(dp, 0);
+	rewinddir(dp);
 	while (ent = readdir(dp), ent) {
 		if (strcmp(ent->d_name + strlen(ent->d_name) - strlen("_en"),
 			   "_en") == 0) {
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
index 2aba622..470d03e 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -1112,6 +1112,7 @@ unsigned int get_pkg_num(int cpu)
 	retval = fscanf(fp, "%d\n", &pkg);
 	if (retval != 1)
 		errx(1, "%s: failed to parse", pathname);
+	fclose(fp);
 	return pkg;
 }
 
diff --git a/tools/testing/selftests/net/reuseaddr_conflict.c b/tools/testing/selftests/net/reuseaddr_conflict.c
index 7c5b126..bfb07dc 100644
--- a/tools/testing/selftests/net/reuseaddr_conflict.c
+++ b/tools/testing/selftests/net/reuseaddr_conflict.c
@@ -109,6 +109,6 @@ int main(void)
 	fd1 = open_port(0, 1);
 	if (fd1 >= 0)
 		error(1, 0, "Was allowed to create an ipv4 reuseport on an already bound non-reuseport socket with no ipv6");
-	fprintf(stderr, "Success");
+	fprintf(stderr, "Success\n");
 	return 0;
 }
diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
index 57bcb27..cb839d0 100644
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -110,7 +110,27 @@ static void async_pf_execute(struct work_struct *work)
 		swake_up(&vcpu->wq);
 
 	mmput(mm);
-	kvm_put_kvm(vcpu->kvm);
+}
+
+static void kvm_flush_and_free_async_pf_work(struct kvm_async_pf *work)
+{
+	/*
+	 * The async #PF is "done", but KVM must wait for the work item itself,
+	 * i.e. async_pf_execute(), to run to completion.  If KVM is a module,
+	 * KVM must ensure *no* code owned by the KVM (the module) can be run
+	 * after the last call to module_put().  Note, flushing the work item
+	 * is always required when the item is taken off the completion queue.
+	 * E.g. even if the vCPU handles the item in the "normal" path, the VM
+	 * could be terminated before async_pf_execute() completes.
+	 *
+	 * Wake all events skip the queue and go straight done, i.e. don't
+	 * need to be flushed (but sanity check that the work wasn't queued).
+	 */
+	if (work->wakeup_all)
+		WARN_ON_ONCE(work->work.func);
+	else
+		flush_work(&work->work);
+	kmem_cache_free(async_pf_cache, work);
 }
 
 void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)
@@ -137,7 +157,6 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)
 #else
 		if (cancel_work_sync(&work->work)) {
 			mmput(work->mm);
-			kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
 			kmem_cache_free(async_pf_cache, work);
 		}
 #endif
@@ -149,7 +168,10 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)
 			list_first_entry(&vcpu->async_pf.done,
 					 typeof(*work), link);
 		list_del(&work->link);
-		kmem_cache_free(async_pf_cache, work);
+
+		spin_unlock(&vcpu->async_pf.lock);
+		kvm_flush_and_free_async_pf_work(work);
+		spin_lock(&vcpu->async_pf.lock);
 	}
 	spin_unlock(&vcpu->async_pf.lock);
 
@@ -173,7 +195,7 @@ void kvm_check_async_pf_completion(struct kvm_vcpu *vcpu)
 
 		list_del(&work->queue);
 		vcpu->async_pf.queued--;
-		kmem_cache_free(async_pf_cache, work);
+		kvm_flush_and_free_async_pf_work(work);
 	}
 }
 
@@ -202,7 +224,6 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
 	work->arch = *arch;
 	work->mm = current->mm;
 	mmget(work->mm);
-	kvm_get_kvm(work->vcpu->kvm);
 
 	/* this can't really happen otherwise gfn_to_pfn_async
 	   would succeed */