diff -druNp --no-dereference linux-libre-4.9.222-gnu/arch/mips/kernel/perf_event_mipsxx.c linux-libre-4.9.223-gnu/arch/mips/kernel/perf_event_mipsxx.c
--- linux-libre-4.9.222-gnu/arch/mips/kernel/perf_event_mipsxx.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/arch/mips/kernel/perf_event_mipsxx.c	2020-05-10 04:28:04.000000000 -0400
@@ -1605,7 +1605,6 @@ static const struct mips_perf_event *mip
 		break;
 	case CPU_P5600:
 	case CPU_P6600:
-	case CPU_I6400:
 		/* 8-bit event numbers */
 		raw_id = config & 0x1ff;
 		base_id = raw_id & 0xff;
@@ -1618,6 +1617,11 @@ static const struct mips_perf_event *mip
 		raw_event.range = P;
 #endif
 		break;
+	case CPU_I6400:
+		/* 8-bit event numbers */
+		base_id = config & 0xff;
+		raw_event.cntr_mask = CNTR_EVEN | CNTR_ODD;
+		break;
 	case CPU_1004K:
 		if (IS_BOTH_COUNTERS_1004K_EVENT(base_id))
 			raw_event.cntr_mask = CNTR_EVEN | CNTR_ODD;
diff -druNp --no-dereference linux-libre-4.9.222-gnu/arch/powerpc/kernel/pci_of_scan.c linux-libre-4.9.223-gnu/arch/powerpc/kernel/pci_of_scan.c
--- linux-libre-4.9.222-gnu/arch/powerpc/kernel/pci_of_scan.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/arch/powerpc/kernel/pci_of_scan.c	2020-05-10 04:28:04.000000000 -0400
@@ -82,10 +82,16 @@ static void of_pci_parse_addrs(struct de
 	const __be32 *addrs;
 	u32 i;
 	int proplen;
+	bool mark_unset = false;
 
 	addrs = of_get_property(node, "assigned-addresses", &proplen);
-	if (!addrs)
-		return;
+	if (!addrs || !proplen) {
+		addrs = of_get_property(node, "reg", &proplen);
+		if (!addrs || !proplen)
+			return;
+		mark_unset = true;
+	}
+
 	pr_debug("    parse addresses (%d bytes) @ %p\n", proplen, addrs);
 	for (; proplen >= 20; proplen -= 20, addrs += 5) {
 		flags = pci_parse_of_flags(of_read_number(addrs, 1), 0);
@@ -110,6 +116,8 @@ static void of_pci_parse_addrs(struct de
 			continue;
 		}
 		res->flags = flags;
+		if (mark_unset)
+			res->flags |= IORESOURCE_UNSET;
 		res->name = pci_name(dev);
 		region.start = base;
 		region.end = base + size - 1;
diff -druNp --no-dereference linux-libre-4.9.222-gnu/drivers/iio/adc/ad7793.c linux-libre-4.9.223-gnu/drivers/iio/adc/ad7793.c
--- linux-libre-4.9.222-gnu/drivers/iio/adc/ad7793.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/drivers/iio/adc/ad7793.c	2020-05-10 04:28:04.000000000 -0400
@@ -570,7 +570,7 @@ static const struct iio_info ad7797_info
 	.read_raw = &ad7793_read_raw,
 	.write_raw = &ad7793_write_raw,
 	.write_raw_get_fmt = &ad7793_write_raw_get_fmt,
-	.attrs = &ad7793_attribute_group,
+	.attrs = &ad7797_attribute_group,
 	.validate_trigger = ad_sd_validate_trigger,
 	.driver_module = THIS_MODULE,
 };
diff -druNp --no-dereference linux-libre-4.9.222-gnu/drivers/net/dsa/b53/b53_common.c linux-libre-4.9.223-gnu/drivers/net/dsa/b53/b53_common.c
--- linux-libre-4.9.222-gnu/drivers/net/dsa/b53/b53_common.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/drivers/net/dsa/b53/b53_common.c	2020-05-10 04:28:04.000000000 -0400
@@ -1109,6 +1109,7 @@ static int b53_arl_read(struct b53_devic
 			u16 vid, struct b53_arl_entry *ent, u8 *idx,
 			bool is_valid)
 {
+	DECLARE_BITMAP(free_bins, B53_ARLTBL_MAX_BIN_ENTRIES);
 	unsigned int i;
 	int ret;
 
@@ -1116,6 +1117,8 @@ static int b53_arl_read(struct b53_devic
 	if (ret)
 		return ret;
 
+	bitmap_zero(free_bins, dev->num_arl_entries);
+
 	/* Read the bins */
 	for (i = 0; i < dev->num_arl_entries; i++) {
 		u64 mac_vid;
@@ -1127,13 +1130,21 @@ static int b53_arl_read(struct b53_devic
 			   B53_ARLTBL_DATA_ENTRY(i), &fwd_entry);
 		b53_arl_to_entry(ent, mac_vid, fwd_entry);
 
-		if (!(fwd_entry & ARLTBL_VALID))
+		if (!(fwd_entry & ARLTBL_VALID)) {
+			set_bit(i, free_bins);
 			continue;
+		}
 		if ((mac_vid & ARLTBL_MAC_MASK) != mac)
 			continue;
 		*idx = i;
+		return 0;
 	}
 
+	if (bitmap_weight(free_bins, dev->num_arl_entries) == 0)
+		return -ENOSPC;
+
+	*idx = find_first_bit(free_bins, dev->num_arl_entries);
+
 	return -ENOENT;
 }
 
@@ -1163,10 +1174,21 @@ static int b53_arl_op(struct b53_device
 	if (op)
 		return ret;
 
-	/* We could not find a matching MAC, so reset to a new entry */
-	if (ret) {
+	switch (ret) {
+	case -ENOSPC:
+		dev_dbg(dev->dev, "{%pM,%.4d} no space left in ARL\n",
+			addr, vid);
+		return is_valid ? ret : 0;
+	case -ENOENT:
+		/* We could not find a matching MAC, so reset to a new entry */
+		dev_dbg(dev->dev, "{%pM,%.4d} not found, using idx: %d\n",
+			addr, vid, idx);
 		fwd_entry = 0;
-		idx = 1;
+		break;
+	default:
+		dev_dbg(dev->dev, "{%pM,%.4d} found, using idx: %d\n",
+			addr, vid, idx);
+		break;
 	}
 
 	memset(&ent, 0, sizeof(ent));
diff -druNp --no-dereference linux-libre-4.9.222-gnu/drivers/net/dsa/b53/b53_regs.h linux-libre-4.9.223-gnu/drivers/net/dsa/b53/b53_regs.h
--- linux-libre-4.9.222-gnu/drivers/net/dsa/b53/b53_regs.h	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/drivers/net/dsa/b53/b53_regs.h	2020-05-10 04:28:04.000000000 -0400
@@ -280,6 +280,9 @@
 #define   ARLTBL_STATIC			BIT(15)
 #define   ARLTBL_VALID			BIT(16)
 
+/* Maximum number of bin entries in the ARL for all switches */
+#define B53_ARLTBL_MAX_BIN_ENTRIES	4
+
 /* ARL Search Control Register (8 bit) */
 #define B53_ARL_SRCH_CTL		0x50
 #define B53_ARL_SRCH_CTL_25		0x20
diff -druNp --no-dereference linux-libre-4.9.222-gnu/drivers/net/ethernet/broadcom/bcmsysport.c linux-libre-4.9.223-gnu/drivers/net/ethernet/broadcom/bcmsysport.c
--- linux-libre-4.9.222-gnu/drivers/net/ethernet/broadcom/bcmsysport.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/drivers/net/ethernet/broadcom/bcmsysport.c	2020-05-10 04:28:04.000000000 -0400
@@ -504,7 +504,8 @@ static struct sk_buff *bcm_sysport_rx_re
 	dma_addr_t mapping;
 
 	/* Allocate a new SKB for a new packet */
-	skb = netdev_alloc_skb(priv->netdev, RX_BUF_LENGTH);
+	skb = __netdev_alloc_skb(priv->netdev, RX_BUF_LENGTH,
+				 GFP_ATOMIC | __GFP_NOWARN);
 	if (!skb) {
 		priv->mib.alloc_rx_buff_failed++;
 		netif_err(priv, rx_err, ndev, "SKB alloc failed\n");
diff -druNp --no-dereference linux-libre-4.9.222-gnu/drivers/net/ethernet/broadcom/genet/bcmgenet.c linux-libre-4.9.223-gnu/drivers/net/ethernet/broadcom/genet/bcmgenet.c
--- linux-libre-4.9.222-gnu/drivers/net/ethernet/broadcom/genet/bcmgenet.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/drivers/net/ethernet/broadcom/genet/bcmgenet.c	2020-05-10 04:28:04.000000000 -0400
@@ -1596,7 +1596,8 @@ static struct sk_buff *bcmgenet_rx_refil
 	dma_addr_t mapping;
 
 	/* Allocate a new Rx skb */
-	skb = netdev_alloc_skb(priv->dev, priv->rx_buf_len + SKB_ALIGNMENT);
+	skb = __netdev_alloc_skb(priv->dev, priv->rx_buf_len + SKB_ALIGNMENT,
+				 GFP_ATOMIC | __GFP_NOWARN);
 	if (!skb) {
 		priv->mib.alloc_rx_buff_failed++;
 		netif_err(priv, rx_err, priv->dev,
diff -druNp --no-dereference linux-libre-4.9.222-gnu/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c linux-libre-4.9.223-gnu/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
--- linux-libre-4.9.222-gnu/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c	2020-05-10 04:28:04.000000000 -0400
@@ -40,12 +40,16 @@ static u32 stmmac_config_sub_second_incr
 	unsigned long data;
 	u32 reg_value;
 
-	/* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
-	 *	formula = (1/ptp_clock) * 1000000000
-	 * where ptp_clock is 50MHz if fine method is used to update system
+	/* For GMAC3.x, 4.x versions, in "fine adjustement mode" set sub-second
+	 * increment to twice the number of nanoseconds of a clock cycle.
+	 * The calculation of the default_addend value by the caller will set it
+	 * to mid-range = 2^31 when the remainder of this division is zero,
+	 * which will make the accumulator overflow once every 2 ptp_clock
+	 * cycles, adding twice the number of nanoseconds of a clock cycle :
+	 * 2000000000ULL / ptp_clock.
 	 */
 	if (value & PTP_TCR_TSCFUPDT)
-		data = (1000000000ULL / 50000000);
+		data = (2000000000ULL / ptp_clock);
 	else
 		data = (1000000000ULL / ptp_clock);
 
diff -druNp --no-dereference linux-libre-4.9.222-gnu/drivers/net/wimax/i2400m/usb-fw.c linux-libre-4.9.223-gnu/drivers/net/wimax/i2400m/usb-fw.c
--- linux-libre-4.9.222-gnu/drivers/net/wimax/i2400m/usb-fw.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/drivers/net/wimax/i2400m/usb-fw.c	2020-05-10 04:28:04.000000000 -0400
@@ -354,6 +354,7 @@ out:
 		usb_autopm_put_interface(i2400mu->usb_iface);
 	d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n",
 		i2400m, ack, ack_size, (long) result);
+	usb_put_urb(&notif_urb);
 	return result;
 
 error_exceeded:
diff -druNp --no-dereference linux-libre-4.9.222-gnu/drivers/vhost/vsock.c linux-libre-4.9.223-gnu/drivers/vhost/vsock.c
--- linux-libre-4.9.222-gnu/drivers/vhost/vsock.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/drivers/vhost/vsock.c	2020-05-10 04:28:04.000000000 -0400
@@ -460,6 +460,11 @@ static int vhost_vsock_start(struct vhos
 		mutex_unlock(&vq->mutex);
 	}
 
+	/* Some packets may have been queued before the device was started,
+	 * let's kick the send worker to send them.
+	 */
+	vhost_work_queue(&vsock->dev, &vsock->send_pkt_work);
+
 	mutex_unlock(&vsock->dev.mutex);
 	return 0;
 
diff -druNp --no-dereference linux-libre-4.9.222-gnu/fs/cifs/connect.c linux-libre-4.9.223-gnu/fs/cifs/connect.c
--- linux-libre-4.9.222-gnu/fs/cifs/connect.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/fs/cifs/connect.c	2020-05-10 04:28:04.000000000 -0400
@@ -341,8 +341,10 @@ static int reconn_set_ipaddr(struct TCP_
 		return rc;
 	}
 
+	spin_lock(&cifs_tcp_ses_lock);
 	rc = cifs_convert_address((struct sockaddr *)&server->dstaddr, ipaddr,
 				  strlen(ipaddr));
+	spin_unlock(&cifs_tcp_ses_lock);
 	kfree(ipaddr);
 
 	return !rc ? -1 : 0;
diff -druNp --no-dereference linux-libre-4.9.222-gnu/include/linux/ieee80211.h linux-libre-4.9.223-gnu/include/linux/ieee80211.h
--- linux-libre-4.9.222-gnu/include/linux/ieee80211.h	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/include/linux/ieee80211.h	2020-05-10 04:28:04.000000000 -0400
@@ -620,6 +620,15 @@ static inline bool ieee80211_is_qos_null
 }
 
 /**
+ * ieee80211_is_any_nullfunc - check if frame is regular or QoS nullfunc frame
+ * @fc: frame control bytes in little-endian byteorder
+ */
+static inline bool ieee80211_is_any_nullfunc(__le16 fc)
+{
+	return (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc));
+}
+
+/**
  * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
  * @fc: frame control field in little-endian byteorder
  */
diff -druNp --no-dereference linux-libre-4.9.222-gnu/lib/mpi/longlong.h linux-libre-4.9.223-gnu/lib/mpi/longlong.h
--- linux-libre-4.9.222-gnu/lib/mpi/longlong.h	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/lib/mpi/longlong.h	2020-05-10 04:28:04.000000000 -0400
@@ -756,22 +756,22 @@ do {									\
 do { \
 	if (__builtin_constant_p(bh) && (bh) == 0) \
 		__asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "%r" ((USItype)(ah)), \
 		"%r" ((USItype)(al)), \
 		"rI" ((USItype)(bl))); \
 	else if (__builtin_constant_p(bh) && (bh) == ~(USItype) 0) \
 		__asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "%r" ((USItype)(ah)), \
 		"%r" ((USItype)(al)), \
 		"rI" ((USItype)(bl))); \
 	else \
 		__asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "%r" ((USItype)(ah)), \
 		"r" ((USItype)(bh)), \
 		"%r" ((USItype)(al)), \
@@ -781,36 +781,36 @@ do { \
 do { \
 	if (__builtin_constant_p(ah) && (ah) == 0) \
 		__asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "r" ((USItype)(bh)), \
 		"rI" ((USItype)(al)), \
 		"r" ((USItype)(bl))); \
 	else if (__builtin_constant_p(ah) && (ah) == ~(USItype) 0) \
 		__asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "r" ((USItype)(bh)), \
 		"rI" ((USItype)(al)), \
 		"r" ((USItype)(bl))); \
 	else if (__builtin_constant_p(bh) && (bh) == 0) \
 		__asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "r" ((USItype)(ah)), \
 		"rI" ((USItype)(al)), \
 		"r" ((USItype)(bl))); \
 	else if (__builtin_constant_p(bh) && (bh) == ~(USItype) 0) \
 		__asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "r" ((USItype)(ah)), \
 		"rI" ((USItype)(al)), \
 		"r" ((USItype)(bl))); \
 	else \
 		__asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "r" ((USItype)(ah)), \
 		"r" ((USItype)(bh)), \
 		"rI" ((USItype)(al)), \
@@ -821,7 +821,7 @@ do { \
 do { \
 	USItype __m0 = (m0), __m1 = (m1); \
 	__asm__ ("mulhwu %0,%1,%2" \
-	: "=r" ((USItype) ph) \
+	: "=r" (ph) \
 	: "%r" (__m0), \
 	"r" (__m1)); \
 	(pl) = __m0 * __m1; \
diff -druNp --no-dereference linux-libre-4.9.222-gnu/Makefile linux-libre-4.9.223-gnu/Makefile
--- linux-libre-4.9.222-gnu/Makefile	2020-05-05 14:30:33.000000000 -0400
+++ linux-libre-4.9.223-gnu/Makefile	2020-05-10 17:30:41.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 222
+SUBLEVEL = 223
 EXTRAVERSION = -gnu
 NAME = Roaring Lionus
 
diff -druNp --no-dereference linux-libre-4.9.222-gnu/net/mac80211/mlme.c linux-libre-4.9.223-gnu/net/mac80211/mlme.c
--- linux-libre-4.9.222-gnu/net/mac80211/mlme.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/net/mac80211/mlme.c	2020-05-10 04:28:04.000000000 -0400
@@ -2277,7 +2277,7 @@ void ieee80211_sta_tx_notify(struct ieee
 	if (!ieee80211_is_data(hdr->frame_control))
 	    return;
 
-	if (ieee80211_is_nullfunc(hdr->frame_control) &&
+	if (ieee80211_is_any_nullfunc(hdr->frame_control) &&
 	    sdata->u.mgd.probe_send_count > 0) {
 		if (ack)
 			ieee80211_sta_reset_conn_monitor(sdata);
diff -druNp --no-dereference linux-libre-4.9.222-gnu/net/mac80211/rx.c linux-libre-4.9.223-gnu/net/mac80211/rx.c
--- linux-libre-4.9.222-gnu/net/mac80211/rx.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/net/mac80211/rx.c	2020-05-10 04:28:04.000000000 -0400
@@ -1231,8 +1231,7 @@ ieee80211_rx_h_check_dup(struct ieee8021
 		return RX_CONTINUE;
 
 	if (ieee80211_is_ctl(hdr->frame_control) ||
-	    ieee80211_is_nullfunc(hdr->frame_control) ||
-	    ieee80211_is_qos_nullfunc(hdr->frame_control) ||
+	    ieee80211_is_any_nullfunc(hdr->frame_control) ||
 	    is_multicast_ether_addr(hdr->addr1))
 		return RX_CONTINUE;
 
@@ -1617,8 +1616,7 @@ ieee80211_rx_h_sta_process(struct ieee80
 	 * Drop (qos-)data::nullfunc frames silently, since they
 	 * are used only to control station power saving mode.
 	 */
-	if (ieee80211_is_nullfunc(hdr->frame_control) ||
-	    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
+	if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
 		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
 
 		/*
@@ -2112,7 +2110,7 @@ static int ieee80211_drop_unencrypted(st
 
 	/* Drop unencrypted frames if key is set. */
 	if (unlikely(!ieee80211_has_protected(fc) &&
-		     !ieee80211_is_nullfunc(fc) &&
+		     !ieee80211_is_any_nullfunc(fc) &&
 		     ieee80211_is_data(fc) && rx->key))
 		return -EACCES;
 
diff -druNp --no-dereference linux-libre-4.9.222-gnu/net/mac80211/status.c linux-libre-4.9.223-gnu/net/mac80211/status.c
--- linux-libre-4.9.222-gnu/net/mac80211/status.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/net/mac80211/status.c	2020-05-10 04:28:04.000000000 -0400
@@ -480,8 +480,7 @@ static void ieee80211_report_ack_skb(str
 		rcu_read_lock();
 		sdata = ieee80211_sdata_from_skb(local, skb);
 		if (sdata) {
-			if (ieee80211_is_nullfunc(hdr->frame_control) ||
-			    ieee80211_is_qos_nullfunc(hdr->frame_control))
+			if (ieee80211_is_any_nullfunc(hdr->frame_control))
 				cfg80211_probe_status(sdata->dev, hdr->addr1,
 						      cookie, acked,
 						      GFP_ATOMIC);
@@ -914,7 +913,7 @@ void ieee80211_tx_status(struct ieee8021
 			I802_DEBUG_INC(local->dot11FailedCount);
 	}
 
-	if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) &&
+	if (ieee80211_is_any_nullfunc(fc) && ieee80211_has_pm(fc) &&
 	    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
 	    !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
 	    local->ps_sdata && !(local->scanning)) {
diff -druNp --no-dereference linux-libre-4.9.222-gnu/net/mac80211/tx.c linux-libre-4.9.223-gnu/net/mac80211/tx.c
--- linux-libre-4.9.222-gnu/net/mac80211/tx.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/net/mac80211/tx.c	2020-05-10 04:28:04.000000000 -0400
@@ -294,7 +294,7 @@ ieee80211_tx_h_check_assoc(struct ieee80
 	if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
 	    test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
 	    !ieee80211_is_probe_req(hdr->frame_control) &&
-	    !ieee80211_is_nullfunc(hdr->frame_control))
+	    !ieee80211_is_any_nullfunc(hdr->frame_control))
 		/*
 		 * When software scanning only nullfunc frames (to notify
 		 * the sleep state to the AP) and probe requests (for the
diff -druNp --no-dereference linux-libre-4.9.222-gnu/net/sctp/sm_make_chunk.c linux-libre-4.9.223-gnu/net/sctp/sm_make_chunk.c
--- linux-libre-4.9.222-gnu/net/sctp/sm_make_chunk.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/net/sctp/sm_make_chunk.c	2020-05-10 04:28:04.000000000 -0400
@@ -856,7 +856,11 @@ struct sctp_chunk *sctp_make_shutdown(co
 	sctp_shutdownhdr_t shut;
 	__u32 ctsn;
 
-	ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
+	if (chunk && chunk->asoc)
+		ctsn = sctp_tsnmap_get_ctsn(&chunk->asoc->peer.tsn_map);
+	else
+		ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
+
 	shut.cum_tsn_ack = htonl(ctsn);
 
 	retval = sctp_make_control(asoc, SCTP_CID_SHUTDOWN, 0,
diff -druNp --no-dereference linux-libre-4.9.222-gnu/net/sunrpc/xprtrdma/backchannel.c linux-libre-4.9.223-gnu/net/sunrpc/xprtrdma/backchannel.c
--- linux-libre-4.9.222-gnu/net/sunrpc/xprtrdma/backchannel.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/net/sunrpc/xprtrdma/backchannel.c	2020-05-10 04:28:04.000000000 -0400
@@ -71,21 +71,13 @@ out_fail:
 static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt,
 				 unsigned int count)
 {
-	struct rpcrdma_rep *rep;
 	int rc = 0;
 
 	while (count--) {
-		rep = rpcrdma_create_rep(r_xprt);
-		if (IS_ERR(rep)) {
-			pr_err("RPC:       %s: reply buffer alloc failed\n",
-			       __func__);
-			rc = PTR_ERR(rep);
+		rc = rpcrdma_create_rep(r_xprt);
+		if (rc)
 			break;
-		}
-
-		rpcrdma_recv_buffer_put(rep);
 	}
-
 	return rc;
 }
 
diff -druNp --no-dereference linux-libre-4.9.222-gnu/net/sunrpc/xprtrdma/verbs.c linux-libre-4.9.223-gnu/net/sunrpc/xprtrdma/verbs.c
--- linux-libre-4.9.222-gnu/net/sunrpc/xprtrdma/verbs.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/net/sunrpc/xprtrdma/verbs.c	2020-05-10 04:28:04.000000000 -0400
@@ -891,10 +891,17 @@ rpcrdma_create_req(struct rpcrdma_xprt *
 	return req;
 }
 
-struct rpcrdma_rep *
-rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
+/**
+ * rpcrdma_create_rep - Allocate an rpcrdma_rep object
+ * @r_xprt: controlling transport
+ *
+ * Returns 0 on success or a negative errno on failure.
+ */
+int
+ rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
 {
 	struct rpcrdma_create_data_internal *cdata = &r_xprt->rx_data;
+	struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
 	struct rpcrdma_rep *rep;
 	int rc;
@@ -919,12 +926,18 @@ rpcrdma_create_rep(struct rpcrdma_xprt *
 	rep->rr_recv_wr.wr_cqe = &rep->rr_cqe;
 	rep->rr_recv_wr.sg_list = &rep->rr_rdmabuf->rg_iov;
 	rep->rr_recv_wr.num_sge = 1;
-	return rep;
+
+	spin_lock(&buf->rb_lock);
+	list_add(&rep->rr_list, &buf->rb_recv_bufs);
+	spin_unlock(&buf->rb_lock);
+	return 0;
 
 out_free:
 	kfree(rep);
 out:
-	return ERR_PTR(rc);
+	dprintk("RPC:       %s: reply buffer %d alloc failed\n",
+		__func__, rc);
+	return rc;
 }
 
 int
@@ -967,17 +980,10 @@ rpcrdma_buffer_create(struct rpcrdma_xpr
 	}
 
 	INIT_LIST_HEAD(&buf->rb_recv_bufs);
-	for (i = 0; i < buf->rb_max_requests + RPCRDMA_MAX_BC_REQUESTS; i++) {
-		struct rpcrdma_rep *rep;
-
-		rep = rpcrdma_create_rep(r_xprt);
-		if (IS_ERR(rep)) {
-			dprintk("RPC:       %s: reply buffer %d alloc failed\n",
-				__func__, i);
-			rc = PTR_ERR(rep);
+	for (i = 0; i <= buf->rb_max_requests; i++) {
+		rc = rpcrdma_create_rep(r_xprt);
+		if (rc)
 			goto out;
-		}
-		list_add(&rep->rr_list, &buf->rb_recv_bufs);
 	}
 
 	return 0;
diff -druNp --no-dereference linux-libre-4.9.222-gnu/net/sunrpc/xprtrdma/xprt_rdma.h linux-libre-4.9.223-gnu/net/sunrpc/xprtrdma/xprt_rdma.h
--- linux-libre-4.9.222-gnu/net/sunrpc/xprtrdma/xprt_rdma.h	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/net/sunrpc/xprtrdma/xprt_rdma.h	2020-05-10 04:28:04.000000000 -0400
@@ -502,8 +502,8 @@ int rpcrdma_ep_post_recv(struct rpcrdma_
  * Buffer calls - xprtrdma/verbs.c
  */
 struct rpcrdma_req *rpcrdma_create_req(struct rpcrdma_xprt *);
-struct rpcrdma_rep *rpcrdma_create_rep(struct rpcrdma_xprt *);
 void rpcrdma_destroy_req(struct rpcrdma_req *);
+int rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt);
 int rpcrdma_buffer_create(struct rpcrdma_xprt *);
 void rpcrdma_buffer_destroy(struct rpcrdma_buffer *);
 
diff -druNp --no-dereference linux-libre-4.9.222-gnu/scripts/config linux-libre-4.9.223-gnu/scripts/config
--- linux-libre-4.9.222-gnu/scripts/config	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/scripts/config	2020-05-10 04:28:04.000000000 -0400
@@ -6,6 +6,9 @@ myname=${0##*/}
 # If no prefix forced, use the default CONFIG_
 CONFIG_="${CONFIG_-CONFIG_}"
 
+# We use an uncommon delimiter for sed substitutions
+SED_DELIM=$(echo -en "\001")
+
 usage() {
 	cat >&2 <<EOL
 Manipulate options in a .config file from the command line.
@@ -82,7 +85,7 @@ txt_subst() {
 	local infile="$3"
 	local tmpfile="$infile.swp"
 
-	sed -e "s:$before:$after:" "$infile" >"$tmpfile"
+	sed -e "s$SED_DELIM$before$SED_DELIM$after$SED_DELIM" "$infile" >"$tmpfile"
 	# replace original file with the edited one
 	mv "$tmpfile" "$infile"
 }
diff -druNp --no-dereference linux-libre-4.9.222-gnu/sound/pci/hda/hda_intel.c linux-libre-4.9.223-gnu/sound/pci/hda/hda_intel.c
--- linux-libre-4.9.222-gnu/sound/pci/hda/hda_intel.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/sound/pci/hda/hda_intel.c	2020-05-10 04:28:04.000000000 -0400
@@ -1966,9 +1966,10 @@ static const struct hdac_io_ops pci_hda_
  * some HD-audio PCI entries are exposed without any codecs, and such devices
  * should be ignored from the beginning.
  */
-static const struct snd_pci_quirk driver_blacklist[] = {
-	SND_PCI_QUIRK(0x1462, 0xcb59, "MSI TRX40 Creator", 0),
-	SND_PCI_QUIRK(0x1462, 0xcb60, "MSI TRX40", 0),
+static const struct pci_device_id driver_blacklist[] = {
+	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1043, 0x874f) }, /* ASUS ROG Zenith II / Strix */
+	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb59) }, /* MSI TRX40 Creator */
+	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb60) }, /* MSI TRX40 */
 	{}
 };
 
@@ -1991,7 +1992,7 @@ static int azx_probe(struct pci_dev *pci
 	bool schedule_probe;
 	int err;
 
-	if (snd_pci_quirk_lookup(pci, driver_blacklist)) {
+	if (pci_match_id(driver_blacklist, pci)) {
 		dev_info(&pci->dev, "Skipping the blacklisted device\n");
 		return -ENODEV;
 	}
diff -druNp --no-dereference linux-libre-4.9.222-gnu/sound/soc/codecs/sgtl5000.c linux-libre-4.9.223-gnu/sound/soc/codecs/sgtl5000.c
--- linux-libre-4.9.222-gnu/sound/soc/codecs/sgtl5000.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/sound/soc/codecs/sgtl5000.c	2020-05-10 04:28:04.000000000 -0400
@@ -1464,6 +1464,40 @@ static int sgtl5000_i2c_probe(struct i2c
 		dev_err(&client->dev,
 			"Error %d initializing CHIP_CLK_CTRL\n", ret);
 
+	/* Mute everything to avoid pop from the following power-up */
+	ret = regmap_write(sgtl5000->regmap, SGTL5000_CHIP_ANA_CTRL,
+			   SGTL5000_CHIP_ANA_CTRL_DEFAULT);
+	if (ret) {
+		dev_err(&client->dev,
+			"Error %d muting outputs via CHIP_ANA_CTRL\n", ret);
+		goto disable_clk;
+	}
+
+	/*
+	 * If VAG is powered-on (e.g. from previous boot), it would be disabled
+	 * by the write to ANA_POWER in later steps of the probe code. This
+	 * may create a loud pop even with all outputs muted. The proper way
+	 * to circumvent this is disabling the bit first and waiting the proper
+	 * cool-down time.
+	 */
+	ret = regmap_read(sgtl5000->regmap, SGTL5000_CHIP_ANA_POWER, &value);
+	if (ret) {
+		dev_err(&client->dev, "Failed to read ANA_POWER: %d\n", ret);
+		goto disable_clk;
+	}
+	if (value & SGTL5000_VAG_POWERUP) {
+		ret = regmap_update_bits(sgtl5000->regmap,
+					 SGTL5000_CHIP_ANA_POWER,
+					 SGTL5000_VAG_POWERUP,
+					 0);
+		if (ret) {
+			dev_err(&client->dev, "Error %d disabling VAG\n", ret);
+			goto disable_clk;
+		}
+
+		msleep(SGTL5000_VAG_POWERDOWN_DELAY);
+	}
+
 	/* Follow section 2.2.1.1 of AN3663 */
 	ana_pwr = SGTL5000_ANA_POWER_DEFAULT;
 	if (sgtl5000->num_supplies <= VDDD) {
diff -druNp --no-dereference linux-libre-4.9.222-gnu/sound/soc/codecs/sgtl5000.h linux-libre-4.9.223-gnu/sound/soc/codecs/sgtl5000.h
--- linux-libre-4.9.222-gnu/sound/soc/codecs/sgtl5000.h	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/sound/soc/codecs/sgtl5000.h	2020-05-10 04:28:04.000000000 -0400
@@ -236,6 +236,7 @@
 /*
  * SGTL5000_CHIP_ANA_CTRL
  */
+#define SGTL5000_CHIP_ANA_CTRL_DEFAULT		0x0133
 #define SGTL5000_LINE_OUT_MUTE			0x0100
 #define SGTL5000_HP_SEL_MASK			0x0040
 #define SGTL5000_HP_SEL_SHIFT			6
diff -druNp --no-dereference linux-libre-4.9.222-gnu/tools/testing/selftests/ipc/msgque.c linux-libre-4.9.223-gnu/tools/testing/selftests/ipc/msgque.c
--- linux-libre-4.9.222-gnu/tools/testing/selftests/ipc/msgque.c	2020-05-05 13:14:41.000000000 -0400
+++ linux-libre-4.9.223-gnu/tools/testing/selftests/ipc/msgque.c	2020-05-10 04:28:04.000000000 -0400
@@ -135,7 +135,7 @@ int dump_queue(struct msgque_data *msgqu
 	for (kern_id = 0; kern_id < 256; kern_id++) {
 		ret = msgctl(kern_id, MSG_STAT, &ds);
 		if (ret < 0) {
-			if (errno == -EINVAL)
+			if (errno == EINVAL)
 				continue;
 			printf("Failed to get stats for IPC queue with id %d\n",
 					kern_id);
